Steganography (T1001.002) is a sub-technique of Data Obfuscation in the command and control tactic. Adversaries hide data inside digital messages passed between systems, and that hidden data can carry C2 instructions. MITRE lists Linux, macOS, Windows and ESXi.
How attackers use it
MITRE notes that image or document files with embedded data can themselves be the channel. A file that looks like a harmless picture moves across the network, and the instructions ride inside it. The traffic looks like normal file transfer because, in a sense, it is.
How to detect it
Because the content looks normal, MITRE's strategy correlates file activity with network activity:
- Creation or modification of common media files (such as jpg, png or wav) right after suspicious processing like compression or encryption, particularly alongside lateral movement or exfiltration.
- Unusual use of steganography or media-processing tools, followed by outbound traffic to external addresses with high data output and media content types.
- On macOS, unexpected use of Preview, ImageMagick or binary editors to alter images or documents, then outbound connections with mismatched content types.
- On ESXi, suspicious changes to file artifacts on datastores, followed by beaconing or POST requests to external addresses.
The common thread is a mismatch. An image upload whose size, frequency or structure does not fit an image is worth a closer look.
How to reduce the risk
MITRE lists Network Intrusion Prevention. Network signatures can mitigate some obfuscation activity. Pair that with controls on which processes may send media files to the internet, and with logging that records both file writes and outbound connections so you can line them up.
What a defender can realistically do
Detecting hidden bytes inside a picture is a research problem. Spotting that a picture should not be moving is a log problem, and that is the one to work on.
Ask where images and documents flow on your servers. A database server or a build agent that uploads image files to the internet has no obvious reason to. Put that fact into a rule: servers in these roles may not send media content types outward, and any attempt is logged and reviewed.
Quick check
Why does detection need both file and network data?
Either side alone looks ordinary. The signal is a media file written after odd processing, followed soon after by outbound traffic that does not match what that file type should look like.
