Data Obfuscation: Steganography
- ID
- T1001.002
- Tactics
- TA0011 Command and Control
- Sub-technique of
- T1001 Data Obfuscation
- Platforms
- Linux, macOS, Windows, ESXi
- Data sources
- Process Creation, File Creation, Network Connection Creation, Network Traffic Content, File Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
Detection
- DET0235 Detecting Steganographic Command and Control via File + Network Correlation
Data components: Process Creation, File Creation, Network Connection Creation, Network Traffic Content, File Metadata
Mitigations (1)
- M1031 Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.