TeamPCPG1056 ↗
Has hidden malicious payloads in the frame data of WAV audio files.12
tfMITRE ATT&CK sub-technique
Steganography T1027.003
sub-technique of T1027 Obfuscated Files or Information
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 05 February 2020
- Last modified
- 12 May 2026
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
10
Threat groupsTop 19%
Threat groups81st percentile · 81% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.19
Tools & malwareTop 18%
Tools & malware82nd percentile · 82% of ATT&CK techniques have this many tools implementing them or fewer.5
Detection rules64th pct
Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.Steganography MITRE reference T1027.003
Top 19%of all ATT&CK techniques for number of groups
10 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Earth LuscaG1006 ↗
Has used steganography to hide shellcode in a BMP image file.1
AndarielG0138 ↗
TA551G0127 ↗
Has hidden encoded data for malware DLLs in a PNG.1
APT-C-36G0099 ↗
Has used steganography to hide malicious code, typically in the resource section of executable files.1223
Tropic TrooperG0081 ↗
Has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.1
All 10 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation SpalaxC0005 ↗
For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.1
Operation GhostC0023 ↗
During Operation Ghost, APT29 used steganography to hide payloads inside valid images.1
All 2 campaigns for this technique
19 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PikabotS1145 ↗
Loads a set of PNG images stored in the malware's resources section (RCDATA), each with an encrypted section containing portions of the core Pikabot core module. These sections are loaded and decrypted using a bitwise XOR operation with a hardcoded 32 bit key.1
DiavolS0659 ↗
Has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.1
ProLockS0654 ↗
Can use .jpg and .bmp files to store its payload.1
ObliqueRATS0644 ↗
Can hide its payload in BMP images hosted on compromised websites.1
RaindropS0565 ↗
Used steganography to locate the start of its encoded payload within legitimate 7-Zip code.1
LiteDukeS0513 ↗
Has used image files to hide its loader component.1
All 19 software entries for this technique · 6 newest in this preview
Offense vs defense T1027.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 0
first rule: 2020 Q2 · 2 of 2 campaigns plottedSteganography detection strategy DET0119
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Steganographic Abuse in File & Script Execution
3 platforms
AN0331 · Windows
Detects execution of image viewers or PowerShell scripts accessing or decoding files with mismatched MIME headers or embedded script-like byte patterns; often correlated with suspicious parent-child process lineage and outbound connections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcessImage | Tune to identify image editors/viewers invoking script interpreters (e.g., mspaint.exe > powershell.exe) |
| MimeHeaderMismatchTolerance | Adjust tolerance for image file headers that do not match file extensions or content structure |
| TimeWindow | Define the temporal range to correlate decoding → execution → network beaconing |
AN0332 · Linux
Detects access to media files followed by execution of scripts (bash, Python, etc.) referencing those same files, or outbound traffic triggered shortly after file read. Correlates unusual use of tools like steghide, exiftool, or image libraries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File AccessDC0055 | auditd:SYSCALL | open |
| Network Connection CreationDC0082 | auditd:SYSCALL | connect |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredToolsList | Define the list of steganographic or image-parsing tools to alert on (e.g., steghide, imagemagick) |
| ScriptInterpreterMatch | Tune to detect script engines accessing media files (e.g., python script.py image.png) |
AN0333 · macOS
Detects manipulation of PNG, JPG, or GIF files by user-initiated scripts followed by script execution or exfiltration behavior, especially from osascript, python, or bash, in combination with LaunchAgent persistence or curl activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | process_events |
| File AccessDC0055 | macos:osquery | file_events |
| Network Connection CreationDC0082 | macos:unifiedlog | network connection events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| StegoToolNamePatterns | Adapt to known or emerging tools using stego methods on macOS (e.g., Invoke-PSImage, stegsolve) |
| ParentScriptSources | Update list of trusted versus unknown scripting hosts launching activity tied to image handling |