Esc
Steganography - T1001.002
(ATT&CK® Technique)
Definition
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
D3FEND Inferred Relationships
Browse the D3FEND knowledge graph by clicking on the nodes below.
graph LR; T1001002["Steganography"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1001002 OffensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic"; click T1001002 href "/offensive-technique/attack/T1001.002/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";Client-serverPayloadProfiling["Client-server Payload Profiling"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; Client-serverPayloadProfiling["Client-server Payload Profiling"] -.-> | May Detect | T1001002["Steganography"] ; class Client-serverPayloadProfiling DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.-> | May Detect | T1001002["Steganography"] ; class NetworkTrafficCommunityDeviation DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.-> | May Detect | T1001002["Steganography"] ; class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.-> | May Detect | T1001002["Steganography"] ; class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; RelayPatternAnalysis["Relay Pattern Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; RelayPatternAnalysis["Relay Pattern Analysis"] -.-> | May Detect | T1001002["Steganography"] ; class RelayPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.-> | May Detect | T1001002["Steganography"] ; class RemoteTerminalSessionDetection DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.-> | May Detect | T1001002["Steganography"] ; class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.-> | May Detect | T1001002["Steganography"] ; class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; NetworkTrafficFiltering["Network Traffic Filtering"] --> | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficFiltering["Network Traffic Filtering"] -.-> | May Isolate | T1001002["Steganography"] ; class NetworkTrafficFiltering DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; OutboundTrafficFiltering["Outbound Traffic Filtering"] --> | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; OutboundTrafficFiltering["Outbound Traffic Filtering"] -.-> | May Isolate | T1001002["Steganography"] ; class OutboundTrafficFiltering DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";