Steganography lets attackers move malicious code and stolen data inside files that look harmless, so controls that only check file type, reputation or extension wave them through. An image on a compromised website, an audio file fetched by a poisoned package or a picture attached to an outbound email can each carry a payload or a slice of exfiltrated data that no signature recognises. This guide explains, at the level MITRE ATT&CK describes it, how steganography is used in intrusions, where it sits in the attack chain, and how defenders detect, contain and investigate it. It is written for SOC analysts, detection engineers, incident responders and security architects. It contains no encoding methods, tooling or attacker procedures: the focus is detection, response and design choices that remove the hiding places.
Key takeaways
- Steganography hides the existence of data, not just its meaning. ATT&CK tracks it as T1027.003 for hiding payloads and T1001.002 for hiding command and control, and in practice it is almost always paired with encryption, a loader and a separate execution step.
- The carrier is rarely the dangerous part. A stego image cannot run itself; something on the host has to fetch it, read it and decode it. That loader, script or macro is where detection pays off.
- Behaviour beats pixel analysis at enterprise scale. ATT&CK's detection strategies focus on process lineage: script hosts or unexpected processes opening media files, then running code or connecting outbound.
- Content transformation removes the hiding place. Re-encoding or rebuilding images and documents at the boundary (D3FEND Content Rebuild, D3-CNR) destroys most embedded data without needing to detect it first.
- Supply chain and exfiltration are now the main use cases. The 2026 telnyx PyPI compromise hid its second stage in WAV files, and NIST SP 800-53 lists monitoring for steganography among exfiltration controls.
What steganography is and how it differs from obfuscation
ATT&CK defines the stealth sub-technique Steganography (T1027.003) as hiding information in digital media such as images, audio tracks, video clips or text files to prevent detection. Its sibling, Steganography (T1001.002) under Data Obfuscation, covers hiding command and control traffic, including passing image or document files that carry embedded instructions. Both sit beside related techniques that defenders often confuse with them.
| Technique | ATT&CK ID | What is hidden, and how it differs |
|---|---|---|
| Steganography (payload) | T1027.003 | Code or data inside a media file that still opens and displays normally; the file's purpose appears legitimate |
| Steganography (C2) | T1001.002 | Commands or stolen data inside files or messages exchanged with attacker infrastructure |
| Embedded Payloads | T1027.009 | A payload appended to or inside another file (often an executable) without the pretence of a valid media carrier |
| Encrypted/Encoded File | T1027.013 | Content is unreadable but its presence is obvious; steganography usually wraps an encrypted blob like this |
| HTML Smuggling | T1027.006 | A payload assembled by browser script from data inside an HTML page or attachment |
| Deobfuscate/Decode Files or Information | T1140 | The step on the victim where hidden content is extracted; this is the detection opportunity |
The practical distinction for defenders: encryption makes data unreadable, steganography makes it invisible. A scanner that sees a valid PNG with a normal header and plausible pixel data has no reason to look further unless something else on the host behaves oddly. See the Fileless Malware Guide for how hidden payloads are often decoded straight into memory.
Where it appears in the attack chain
The ATT&CK procedure examples for T1027.003 and T1001.002 show four recurring roles. None requires the defender to understand the encoding.
| Role | Examples recorded in ATT&CK | Best control point |
|---|---|---|
| Second-stage delivery | TA551 hid encoded data for malware DLLs in PNG files; ObliqueRAT hid its payload in BMP images on compromised websites; Andariel hid executables in PNG files | Web proxy and egress control on the host that fetched the image; the macro or script that requested it |
| Concealing a loader's payload on disk | Okrum embedded its payload in a legitimate PNG; Pikabot stored encrypted module fragments in PNG resources; Raindrop, an APT29 loader found during the SolarWinds investigations, hid the start of its encoded payload inside legitimate 7-Zip code | Endpoint behaviour, memory scanning, application control |
| Command and control | HAMMERTOSS read commands appended to image files; Duqu uploaded data appended to a blank JPG over HTTP or HTTPS | Network analytics: who fetches images from where, how often, and from which process |
| Exfiltration | Duqu encrypted collected data and hid it inside an image before sending it to its C2 server | DLP, egress volume baselines, media uploads from unusual processes |
Supply chain attacks have added a fifth pattern. In the telnyx PyPI compromise, two malicious releases fetched a WAV file and extracted a credential harvester from the audio data on import; ATT&CK records TeamPCP hiding payloads in WAV frame data. Developer and CI hosts that install packages are now as likely to receive a stego carrier as a user's inbox. See the Malicious Package and Dependency Confusion Guide.
Detection: focus on the decoder, not the pixels
ATT&CK v20 pairs each technique with a detection strategy: DET0119 (steganographic abuse in file and script execution) for T1027.003 and DET0235 (file and network correlation) for T1001.002. Their analytics share a theme: a process that has no business reading media files does so, and then executes code or talks to the internet.
| Signal | Telemetry source | What to look for |
|---|---|---|
| Media file read by a script host | Sysmon Event ID 1 (process creation), Security 4663 (object access, where auditing is enabled), EDR file events | powershell.exe, wscript.exe, mshta.exe, python or Office processes opening .png, .jpg, .bmp or .wav files, especially in temp or user profile paths |
| Media file written after compression or encryption | Sysmon Event ID 11 (file create) | New image or audio files created by archivers, scripts or unsigned binaries shortly before outbound connections |
| Image fetch followed by execution | Sysmon Event ID 3 (network connection) and 22 (DNS query), proxy logs | A non-browser process downloading an image, then a child process, DLL load or memory allocation within seconds |
| Content-type mismatch | Proxy, NDR, email gateway | Declared MIME type disagrees with file signature, or an image is far larger than its dimensions justify |
| Steganography or media tooling on servers | auditd execve, EDR process inventory | Image or audio processing utilities run by service accounts or on hosts with no media workload, then outbound transfers |
| Repetitive media beaconing | NetFlow, proxy | Regular-interval fetches or uploads of small images to the same uncommon host from one endpoint |
- Process lineage is the highest-value rule. Office applications spawning script hosts that then read image files is a pattern ATT&CK records for Invoke-PSImage style tooling. See the Sysmon Guide and the Endpoint Telemetry Guide.
- Script logging catches the decode step. PowerShell Script Block Logging (Event ID 4104) and AMSI record the decoded script, not the image. See the PowerShell Security Guide.
- File content rules help on known families. D3FEND File Content Analysis (D3-FCOA) covers YARA-style rules that look for executable headers or script fragments inside media files, or data after a format's end marker. Treat them as hunting aids, not prevention. See the YARA Rules Guide.
- Network visibility needs decryption or metadata. Carriers almost always travel over HTTPS. Use TLS inspection where policy allows, otherwise rely on SNI, JA4-style client fingerprints, byte counts and timing. See the TLS Inspection Guide and the NDR Guide.
Statistical steganalysis, which tests image noise for embedding artefacts, is useful in a forensic lab on a short list of suspect files. It produces too many false positives and costs too much compute to run on every image crossing a gateway, and it misses carriers that append data rather than altering pixels.
Prevention: remove the hiding places
Detection is hard; transformation is reliable. MITRE D3FEND lists Content Rebuild (D3-CNR), which rebuilds a file to its specification so unreferenced components are removed, and Content Format Conversion (D3-CFC), which flattens or normalises content. The NCSC's import pattern applies the same idea: transform complex formats into simpler ones, then verify syntax and semantics, and raise every verification failure as an alert.
| Control | Effect on hidden data | Trade-off |
|---|---|---|
| Re-encode images (for example, decode and re-save at a fixed quality, strip metadata) | Destroys most pixel-level embedding and drops appended data and metadata fields | Small quality loss; breaks signed or forensic images, so exempt those flows explicitly |
| Content disarm and reconstruction on email and web downloads | Rebuilds documents and embedded images, removing objects that are not referenced by the format | Cost and latency; users need a route to request originals |
| Strict file-type validation (magic bytes, size against dimensions) | Catches polyglots and carriers with appended payloads | Does not catch well-formed pixel embedding |
| Egress allowlisting for servers and CI runners | Stops a loader fetching its carrier from an arbitrary host | Needs an owned list of package mirrors and APIs |
| Application control and script restrictions | Stops the decoder running even if the carrier arrives | Rollout effort; see the Windows Endpoint Hardening Guide |
| Office macro blocking and ASR rules | Removes the most common trigger that fetches stego images | Exceptions for business macros; see the Office Macro Blocking Guide |
Choosing where to transform
- Inbound email and web: transformation at the gateway gives the widest cover for user-facing delivery. Small organisations often get this from a cloud email service's attachment sanitisation; check whether images inside documents are rebuilt or merely scanned.
- User uploads to your applications: re-encode every uploaded image server side before storage or display. This also protects your customers from files planted on your site, which is how ObliqueRAT's carriers were hosted.
- Cross-domain and high-assurance transfers: use the full NCSC pattern (transform, protocol break, verify) and treat verification failure as an incident signal.
- Developer and build hosts: you cannot transform package contents, so rely on egress control, pinned and hashed dependencies, and runtime detection on install scripts.
Exfiltration and insider use
NIST SP 800-53 Rev. 5 names monitoring for steganography in the discussion of SC-7(10) Prevent Exfiltration, alongside traffic profile analysis and DLP, and SI-4(18) covers analysing traffic for covert exfiltration. Content-aware DLP inspects text and known file fingerprints, so a spreadsheet hidden inside a holiday photo usually passes. Compensating controls are behavioural:
- Baseline media uploads: alert on large or frequent image or audio uploads to personal cloud storage, webmail or paste sites from hosts that handle sensitive data.
- Watch the staging step: sensitive files read, compressed or encrypted, then a new media file created by the same process tree, is the DET0235 pattern.
- Restrict tooling: steganography and media-processing utilities on finance, HR or engineering endpoints with no media role are worth an alert on install or first run.
- Combine with identity context: leavers, users on notice and accounts with recent privilege changes deserve tighter thresholds.
See the Data Exfiltration Guide, the DLP Guide and the Insider Data Theft Guide.
Investigating a suspected stego carrier
- Contain the host, not just the file. If a process decoded a carrier, assume the payload ran. Isolate the endpoint through EDR and preserve memory before rebooting, because many stego loaders decode straight into memory.
- Preserve the carrier with its context. Keep the original file, its hash, its Zone.Identifier stream on Windows, the URL or package it came from, and the process that read it. A re-saved or forwarded copy may have lost the hidden data.
- Find the decoder. Work back from the process that opened the media file: parent process, command line, script block logs and loaded modules. This identifies the loader family faster than analysing the image.
- Analyse in a lab only. Hand the carrier and the decoder to malware analysts in an isolated environment (D3FEND Dynamic Analysis, D3-DA). See the Ghidra for Malware Analysis Guide.
- Scope by carrier, not only by hash. Carriers are often unique per victim. Search proxy and EDR data for the same hosting domain, the same fetching process and the same file size pattern across the estate.
- Rotate what the payload could reach. In the telnyx case the payload harvested cloud keys, SSH keys and tokens from the environment, so every secret on an affected host or runner had to be treated as exposed.
- Feed detections back. Turn the decoder behaviour into a lineage rule and the carrier traits into a hunting rule, then test both against the preserved sample.
See the Digital Forensics (DFIR) Guide and the Malware Outbreak Playbook.
Where identity fits
The most damaging recent stego payloads were credential stealers aimed at machine identities: publishing tokens, cloud access keys, SSH keys and CI secrets. A build runner that can reach the internet and holds long-lived keys is the ideal target, because the carrier arrives through a trusted dependency. Short-lived, narrowly scoped credentials (for example OIDC trusted publishing instead of stored package tokens), egress limits on runners and fast revocation reduce what a hidden payload can steal. See the CI/CD Pipeline Identity Security Guide.
Measuring the programme
- Transformation coverage: share of inbound email attachments, web downloads and application uploads that are rebuilt or re-encoded rather than only scanned (target: all user uploads to your own applications).
- Lineage rule coverage: share of endpoints and servers sending process, file and network events that the media-access rules can use.
- Egress posture: share of servers and CI runners on an egress allowlist.
- Rule quality: monthly alerts from media-access and content-mismatch rules, with true positive rate and median triage time.
- Exercise results: detection rate and time to detect in purple team tests that use benign stego carriers fetched by a script host.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK | T1027.003, T1001.002, T1140; mitigations M1049 and M1040 (parent T1027), M1031 (T1001.002) | Technique description, detection strategies DET0119 and DET0235, antimalware, endpoint behaviour prevention, network intrusion prevention |
| MITRE D3FEND | D3-CNR, D3-CFC, D3-FCOA, D3-DA, D3-NTA | Content rebuild and conversion, file content rules, sandbox analysis, network traffic analysis |
| NIST SP 800-53 Rev. 5 | SI-3, SI-4(18), SC-7(10), SI-20 | SI-3 notes malicious code can be hidden using steganography; covert exfiltration analysis; exfiltration prevention; tainting with steganographic data to trace leaks |
| NIST CSF 2.0 | DE.CM-01, DE.CM-09, DE.AE-02, PR.DS-02 | Network and endpoint monitoring, event analysis, protecting data in transit |
| CIS Controls v8.1 | Controls 9, 10, 13 | Email and web browser protections, malware defences, network monitoring and defence |
| ISO/IEC 27001:2022 Annex A | A.8.7, A.8.12, A.8.16 | Protection against malware, data leakage prevention, monitoring activities |
Common failure patterns
- Trusting file type as safety. Allowing images through every filter because they are "not executable" ignores that the executable part is already on the host. The TA551 campaigns paired Word macros with PNG carriers for exactly this reason.
- Buying steganalysis instead of lineage. Teams deploy image analysis at the gateway and never write the rule for a script host opening a PNG, which is cheaper and catches unknown encodings.
- Re-encoding only some paths. Uploads to the main web app are sanitised but the support portal or marketing CMS stores originals, giving attackers a trusted domain to host carriers.
- Open egress from build systems. CI runners that can fetch from any host let a poisoned dependency download its second stage, as in the telnyx PyPI compromise.
- Losing the evidence. Responders forward the suspicious image through chat or email, which recompresses it and strips the hidden data, then conclude it was benign.
- DLP as the only exfiltration control. Content inspection without upload volume baselines misses data hidden in media.
Practitioner checklist
- Write and test a detection for script hosts, Office processes and interpreters reading image or audio files and then executing code or connecting outbound.
- Enable PowerShell Script Block Logging and AMSI-integrated antimalware so the decoded content is logged even when the carrier is not detected.
- Re-encode and strip metadata from every image uploaded to applications you operate, on every path.
- Check whether your email and web controls rebuild images inside documents or only scan them, and close the gap for high-risk users.
- Put servers and CI runners on egress allowlists and pin dependencies with hashes.
- Alert on content-type mismatches and oversized media in proxy and gateway logs.
- Baseline media uploads from sensitive hosts and alert on deviations alongside DLP.
- Add stego carrier handling to the incident playbook: preserve originals with Zone.Identifier and source, never forward by chat or email.
- Run a purple team exercise with a benign carrier at least yearly and record time to detect.
Standards and references
- MITRE ATT&CK: Obfuscated Files or Information: Steganography (T1027.003)
- MITRE ATT&CK: Data Obfuscation: Steganography (T1001.002)
- MITRE D3FEND: Content Rebuild
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- NCSC: Pattern: Safely Importing Data
- Palo Alto Networks Unit 42: TA551 (Shathak) and IcedID
Related NHI Mgmt Group resources: Malware Guide · Fileless Malware Guide · Data Exfiltration Guide · Command and Control (C2) Guide · Threat Hunting Guide