{"id":"T1027.003","name":"Steganography","url":"https://attack.mitre.org/techniques/T1027/003","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0119","stix_id":"x-mitre-detection-strategy--a57c9ffb-8b18-4178-a07f-e596abe389bd","name":"Detection Strategy for Steganographic Abuse in File & Script Execution","url":"https://attack.mitre.org/detectionstrategies/DET0119","analytics":[{"id":"AN0331","stix_id":"x-mitre-analytic--a7666a4d-ece8-4e5b-ae85-d2987f14b950","name":"Analytic 0331","description":"Detects execution of image viewers or PowerShell scripts accessing or decoding files with mismatched MIME headers or embedded script-like byte patterns; often correlated with suspicious parent-child process lineage and outbound connections.","url":"https://attack.mitre.org/detectionstrategies/DET0119#AN0331","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"ParentProcessImage","description":"Tune to identify image editors/viewers invoking script interpreters (e.g., `mspaint.exe` > `powershell.exe`)"},{"field":"MimeHeaderMismatchTolerance","description":"Adjust tolerance for image file headers that do not match file extensions or content structure"},{"field":"TimeWindow","description":"Define the temporal range to correlate decoding → execution → network beaconing"}],"live":true,"detection_strategies":["DET0119"],"techniques":["T1027.003"]},{"id":"AN0332","stix_id":"x-mitre-analytic--f884a712-ace6-426c-ab81-8ff33e83be92","name":"Analytic 0332","description":"Detects access to media files followed by execution of scripts (bash, Python, etc.) referencing those same files, or outbound traffic triggered shortly after file read. Correlates unusual use of tools like `steghide`, `exiftool`, or image libraries.","url":"https://attack.mitre.org/detectionstrategies/DET0119#AN0332","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"connect","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"MonitoredToolsList","description":"Define the list of steganographic or image-parsing tools to alert on (e.g., `steghide`, `imagemagick`)"},{"field":"ScriptInterpreterMatch","description":"Tune to detect script engines accessing media files (e.g., `python script.py image.png`)"}],"live":true,"detection_strategies":["DET0119"],"techniques":["T1027.003"]},{"id":"AN0333","stix_id":"x-mitre-analytic--eb5334b4-8a19-4efd-a225-44a2783c6d39","name":"Analytic 0333","description":"Detects manipulation of PNG, JPG, or GIF files by user-initiated scripts followed by script execution or exfiltration behavior, especially from `osascript`, `python`, or `bash`, in combination with LaunchAgent persistence or curl activity.","url":"https://attack.mitre.org/detectionstrategies/DET0119#AN0333","platforms":["macOS"],"log_source_references":[{"name":"macos:osquery","channel":"file_events","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-osquery"},{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"},{"name":"macos:unifiedlog","channel":"network connection events","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"StegoToolNamePatterns","description":"Adapt to known or emerging tools using stego methods on macOS (e.g., `Invoke-PSImage`, `stegsolve`)"},{"field":"ParentScriptSources","description":"Update list of trusted versus unknown scripting hosts launching activity tied to image handling"}],"live":true,"detection_strategies":["DET0119"],"techniques":["T1027.003"]}],"live":true,"version":"1.0","techniques":["T1027.003"]}],"sigma_rules":[{"id":"33339be3-148b-4e16-af56-ad16ec6c7e7b","title":"Findstr Launching .lnk File","author":"Trent Liffick","status":"test","level":"medium","date":"2020-05-01","modified":"2024-01-15","description":"Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack","references":["https://www.bleepingcomputer.com/news/security/hhsgov-open-redirect-used-by-coronavirus-phishing-to-spread-malware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1202","attack.t1027.003"],"path":"rules/windows/process_creation/proc_creation_win_findstr_lnk.yml","techniques":["T1036","T1202","T1027.003"],"cves":[]},{"id":"45810b50-7edc-42ca-813b-bdac02fb946b","title":"Steganography Hide Zip Information in Picture File","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-09","modified":"2022-10-09","description":"Detects appending of zip file to image","references":["https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.stealth","attack.t1027.003"],"path":"rules/linux/auditd/execve/lnx_auditd_hidden_zip_files_steganography.yml","techniques":["T1027.003"],"cves":[]},{"id":"a5a827d9-1bbe-4952-9293-c59d897eb41b","title":"Steganography Extract Files with Steghide","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-11","modified":"2022-10-09","description":"Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.","references":["https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.stealth","attack.t1027.003"],"path":"rules/linux/auditd/execve/lnx_auditd_steghide_extract_steganography.yml","techniques":["T1027.003"],"cves":[]},{"id":"ce446a9e-30b9-4483-8e38-d2c9ad0a2280","title":"Steganography Hide Files with Steghide","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-11","modified":"2022-10-09","description":"Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.","references":["https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.stealth","attack.t1027.003"],"path":"rules/linux/auditd/execve/lnx_auditd_steghide_embed_steganography.yml","techniques":["T1027.003"],"cves":[]},{"id":"edd595d7-7895-4fa7-acb3-85a18a8772ca","title":"Steganography Unzip Hidden Information From Picture File","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-09","modified":"2022-10-09","description":"Detects extracting of zip file from image file","references":["https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.stealth","attack.t1027.003"],"path":"rules/linux/auditd/execve/lnx_auditd_unzip_hidden_zip_files_steganography.yml","techniques":["T1027.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}