T1027.003 Steganography — ATT&CK Technique
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. Duqu was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server. By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file (.png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.
Detection coverage (5)
- Steganography Hide Zip Information in Picture File low
- Steganography Hide Files with Steghide low
- Steganography Extract Files with Steghide low
- Steganography Unzip Hidden Information From Picture File low
- Findstr Launching .lnk File medium
Malware using this technique
- PowerDuke
- Pikabot
- Bandook
- Avenger
- PolyglotDuke
- RegDuke
- ProLock
- RDAT
- Okrum
- Diavol
- Raindrop
- IcedID
- ObliqueRAT
- build_downer
- LiteDuke
- Invoke-PSImage
- ABK
- Ramsay
- BBK