Detect Steganography in CrowdStrike LogScale
Adversaries may use steganographic techniques to hide command and control traffic within digital media files (images, PDFs, etc.) to evade detection. Commands or data can be embedded in image files (JPG, PNG, GIF, BMP) or documents using techniques such as Least Significant Bit (LSB) encoding, appending data after EOF markers, or hiding data in file format metadata and structures (e.g., IDAT chunks in PNG). Real-world malware including HAMMERTOSS, LunarWeb, LunarMail, ZeroT, LightNeuron, RDAT, Duqu, and Sliver have leveraged steganographic C2 channels. Detection focuses on process behavior (tools that process or download image files with unusual patterns), network anomalies (HTTP traffic downloading image files at regular intervals with response size variance), and file system indicators (known steganography utilities being executed).
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1001 Data Obfuscation
- Sub-technique
- T1001.002 Steganography
- Canonical reference
- https://attack.mitre.org/techniques/T1001/002/
LogScale Detection Query
// Detection 1: Known steganography tool execution via Falcon process telemetry
#event_simpleName=ProcessRollup2
| FileName =~ regex("(?i)(steghide|outguess|stegdetect|openstego|silenteye|stegosuite|snow\\.exe|jphide|jpseek|camouflage)")
OR CommandLine =~ regex("(?i)(steghide|outguess|openstego|invoke-psimage|invoke-steganography|lockbits|getpixel|setpixel|bitmapimage|idat)")
OR (FileName =~ regex("(?i)(powershell\.exe|pwsh\.exe|python\.exe|python3\.exe)") AND CommandLine =~ regex("(?i)(lsb|steganograph|lockbits|getpixel|setpixel|bitmapimage|idat)"))
OR (FileName =~ regex("(?i)certutil\.exe") AND CommandLine =~ regex("(?i)(-encode|-decode)") AND CommandLine =~ regex("(?i)\\.(jpg|jpeg|png|gif|bmp)"))
OR CommandLine =~ regex("(?i)copy\\s.*/[bB].*\\.(jpg|jpeg|png|gif|bmp)")
| eval DetectionType = case(
FileName =~ regex("(?i)(steghide|outguess|stegdetect|openstego|silenteye|stegosuite|snow\\.exe|jphide|jpseek|camouflage)"), "KnownStegoTool",
FileName =~ regex("(?i)(powershell\.exe|pwsh\.exe)") AND CommandLine =~ regex("(?i)(lsb|lockbits|getpixel|setpixel|bitmapimage|idat|steganograph)"), "LSBManipulation",
FileName =~ regex("(?i)certutil\.exe") AND CommandLine =~ regex("(?i)(-encode|-decode)"), "CertutilEncoding",
CommandLine =~ regex("(?i)copy.*/[bB].*\\.(jpg|jpeg|png|gif|bmp)"), "BinaryCopyToImage",
"CommandLineMatch"
)
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, DetectionType])
| sort(field=@timestamp, order=desc)
// Detection 2: Image file writes by suspicious processes (Sysmon-equivalent via Falcon)
// Run separately in LogScale:
// #event_simpleName=PeFileWritten OR #event_simpleName=SyntheticProcessRollup2
// | TargetFileName =~ regex("(?i)\\.(jpg|jpeg|png|gif|bmp|tiff|webp)$")
// | ImageFileName =~ regex("(?i)(powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)")
// | table([@timestamp, ComputerName, UserName, ImageFileName, TargetFileName, CommandLine])
// | sort(field=@timestamp, order=desc)CrowdStrike LogScale (Falcon) query detecting known steganography tool execution, PowerShell LSB pixel manipulation, certutil encoding on image files, and binary copy tricks used to embed data in image files. Uses Falcon ProcessRollup2 telemetry with regex-based scoring. Includes a commented secondary query for image file write detection.
Data Sources
Required Tables
False Positives & Tuning
- Authorized red team operators using steganographic C2 during an engagement
- Security researchers analyzing steganographic malware samples on dedicated analysis hosts
- Legitimate graphic processing automation using PowerShell and System.Drawing APIs
- Forensic investigators using stegdetect or similar tools to analyze images in evidence
- CTF competition participants running steganography challenges on shared infrastructure
Other platforms for T1001.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Steghide - Embed and Extract Data in JPEG
Expected signal: Sysmon Event ID 1 (Linux equivalent via auditd execve syscall): Process creation for 'steghide' with arguments 'embed' and 'extract'. File creation events for /tmp/carrier_test.jpg modification and /tmp/extracted_payload.txt creation. Auditd SYSCALL records for open/write on image file.
- Test 2PowerShell LSB Steganography - Encode Command in PNG
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'GetPixel', 'SetPixel', 'Bitmap', 'LSB'. Sysmon Event ID 11: File Create for C:\Temp\stego_test.png by powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with full script content including bitmap manipulation code.
- Test 3Python Steganography - Embed Data Using PIL
Expected signal: Auditd EXECVE syscall for python3 with script content referencing PIL, Image.open, getdata, putdata. File creation events for /tmp/carrier_image.png and /tmp/stego_output.png. If Sysmon for Linux is deployed: Event ID 1 for python3 process, Event ID 11 for .png file creation.
- Test 4Windows CMD Binary Copy - Append Data to JPEG (Polyglot File)
Expected signal: Sysmon Event ID 1: Process Create for certutil.exe with -urlcache arguments, and cmd.exe with 'copy /b' and .jpg in command line. Sysmon Event ID 3: Network connection from certutil.exe to httpbin.org. Sysmon Event ID 11: File creation for output_stego.jpg. Windows Security Event ID 4688 if process auditing enabled.
References (13)
- https://attack.mitre.org/techniques/T1001/002/
- https://www.welivesecurity.com/en/eset-research/lunar-toolset-eset-turla-2024/
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt29-hammertoss.pdf
- https://github.com/BishopFox/sliver
- https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-turla/
- https://www.proofpoint.com/us/threat-insight/post/new-trojan-zerot-delivered-alongside-plugx-targeted-attacks
- https://www.trendmicro.com/en_us/research/17/k/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography.html
- https://unit42.paloaltonetworks.com/rdat-tool-uses-steganography-and-dns-over-https/
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://github.com/ragibson/Steganography
- https://github.com/nicowillis/steg-tools
Unlock Pro Content
Get the full detection package for T1001.002 including response playbook, investigation guide, and atomic red team tests.