An image is not always just an image. Steganography hides information inside ordinary looking media, so a file that passes every glance and every type filter can still carry a payload or stolen data.
MITRE tracks this as Steganography, technique T1027.003, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Steganographic techniques can hide data in digital media such as images, audio tracks, video clips or text files. MITRE gives two uses from its page. Malware has encrypted information gathered from a victim and hidden it inside an image before sending that image to a command and control server. And a threat group has hidden PowerShell commands in a PNG with a tool called Invoke-PSImage, then executed them on the victim system. That code went on to download another obfuscated script to gather information.
The file itself looks harmless. The giveaway is the thing that reads it.
How to detect it
MITRE's strategy (DET0119) is behavioral. It looks for scripts or tools that read media files and then act:
- Windows. Image viewers or PowerShell scripts accessing or decoding files with mismatched MIME headers or embedded script-like byte patterns, often with odd parent and child process relationships and outbound connections.
- Linux. Access to media files followed by a script that references the same files, or outbound traffic soon after the read. Unusual use of tools such as steghide or exiftool, or image libraries.
- macOS. PNG, JPG or GIF files manipulated by user-initiated scripts, followed by script execution or exfiltration. MITRE notes osascript, python and bash, sometimes alongside LaunchAgent persistence or curl activity.
Ask a simple question of any alert: why is a shell or a scripting engine opening a picture?
How to reduce the risk
MITRE lists no specific mitigation for this sub-technique. Practical steps rely on watching behavior:
- Alert when script interpreters read image or audio files they have no reason to read.
- Inspect and log outbound traffic from the process that touched the file.
- Limit which scripting engines can run on endpoints that have no need for them.
Quick check
What is the best clue that a media file is carrying something hidden?
What happens around it. A script or unusual tool reading or decoding the file, then spawning processes or making outbound connections, is a stronger signal than the file's own contents.
Sources
- MITRE ATT&CK, Steganography (T1027.003)
