T1027.003 Steganography
sub-techniqueEnterpriseAdversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. Duqu was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server. By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide PowerShell commands in an image file (.png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
detected by (3)
Data components that detect this.
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (10)
Threat groups associated with this.
software (19)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (5)
Sigma detection rules related to this.
source
Where this definition is published.