Detect Steganography in IBM QRadar
Adversaries may use steganographic techniques to hide command and control traffic within digital media files (images, PDFs, etc.) to evade detection. Commands or data can be embedded in image files (JPG, PNG, GIF, BMP) or documents using techniques such as Least Significant Bit (LSB) encoding, appending data after EOF markers, or hiding data in file format metadata and structures (e.g., IDAT chunks in PNG). Real-world malware including HAMMERTOSS, LunarWeb, LunarMail, ZeroT, LightNeuron, RDAT, Duqu, and Sliver have leveraged steganographic C2 channels. Detection focuses on process behavior (tools that process or download image files with unusual patterns), network anomalies (HTTP traffic downloading image files at regular intervals with response size variance), and file system indicators (known steganography utilities being executed).
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1001 Data Obfuscation
- Sub-technique
- T1001.002 Steganography
- Canonical reference
- https://attack.mitre.org/techniques/T1001/002/
QRadar Detection Query
-- Detection 1: Known steganography tool execution (Sysmon Event ID 1 / WinEvent 4688)
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
logsourcename(logsourceid) AS LogSource,
"username" AS UserName,
"hostname" AS HostName,
"ProcessPath" AS ImagePath,
"CommandLine" AS CommandLine,
"ParentProcessPath" AS ParentImage,
QIDNAME(qid) AS EventName,
'StegoToolExecution' AS DetectionType
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 232)
AND (qid = 5000001 OR qid = 4688
OR (CATEGORYNAME(category) LIKE '%Process%' AND eventid = 1)
OR (CATEGORYNAME(category) LIKE '%Process%' AND eventid = 4688))
AND (
LOWER("ProcessPath") MATCHES '(steghide|outguess|stegdetect|openstego|silenteye|stegosuite|snow\.exe|jphide|jpseek|camouflage)'
OR LOWER("CommandLine") MATCHES '(steghide|outguess|openstego|invoke-psimage|invoke-steganography|lockbits|getpixel|setpixel|bitmapimage|idat)'
OR (
LOWER("ProcessPath") MATCHES '(powershell\.exe|pwsh\.exe)'
AND LOWER("CommandLine") MATCHES '(lsb|steganograph)'
)
OR (
LOWER("ProcessPath") MATCHES 'certutil\.exe'
AND LOWER("CommandLine") MATCHES '(-encode|-decode)'
AND LOWER("CommandLine") MATCHES '\.(jpg|jpeg|png|gif|bmp)'
)
)
AND LOGSOURCETIME(starttime) > NOW() - 1 DAYS
UNION ALL
-- Detection 2: Suspicious image file writes by LOLBins (Sysmon Event ID 11)
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
logsourcename(logsourceid) AS LogSource,
"username" AS UserName,
"hostname" AS HostName,
"ProcessPath" AS ImagePath,
"CommandLine" AS CommandLine,
"TargetFilename" AS ParentImage,
QIDNAME(qid) AS EventName,
'SuspiciousImageWrite' AS DetectionType
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 232)
AND eventid = 11
AND LOWER("TargetFilename") MATCHES '\.(jpg|jpeg|png|gif|bmp|tiff|webp)$'
AND LOWER("ProcessPath") MATCHES '(powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)'
AND LOGSOURCETIME(starttime) > NOW() - 1 DAYS
ORDER BY starttime DESCAQL query detecting steganography tool execution, PowerShell LSB manipulation, certutil encoding on image files, and suspicious image writes by LOLBins. Uses Sysmon event IDs 1 and 11 sourced from Windows log sources in QRadar.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate forensic investigations or red team exercises using steganography tools
- Security awareness training involving steganography demonstrations
- Automated image conversion pipelines using certutil or PowerShell for image encoding tasks
- Development environments testing image processing libraries with pixel manipulation
- Pen testers running authorized tools during an engagement
Other platforms for T1001.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Steghide - Embed and Extract Data in JPEG
Expected signal: Sysmon Event ID 1 (Linux equivalent via auditd execve syscall): Process creation for 'steghide' with arguments 'embed' and 'extract'. File creation events for /tmp/carrier_test.jpg modification and /tmp/extracted_payload.txt creation. Auditd SYSCALL records for open/write on image file.
- Test 2PowerShell LSB Steganography - Encode Command in PNG
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'GetPixel', 'SetPixel', 'Bitmap', 'LSB'. Sysmon Event ID 11: File Create for C:\Temp\stego_test.png by powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with full script content including bitmap manipulation code.
- Test 3Python Steganography - Embed Data Using PIL
Expected signal: Auditd EXECVE syscall for python3 with script content referencing PIL, Image.open, getdata, putdata. File creation events for /tmp/carrier_image.png and /tmp/stego_output.png. If Sysmon for Linux is deployed: Event ID 1 for python3 process, Event ID 11 for .png file creation.
- Test 4Windows CMD Binary Copy - Append Data to JPEG (Polyglot File)
Expected signal: Sysmon Event ID 1: Process Create for certutil.exe with -urlcache arguments, and cmd.exe with 'copy /b' and .jpg in command line. Sysmon Event ID 3: Network connection from certutil.exe to httpbin.org. Sysmon Event ID 11: File creation for output_stego.jpg. Windows Security Event ID 4688 if process auditing enabled.
References (13)
- https://attack.mitre.org/techniques/T1001/002/
- https://www.welivesecurity.com/en/eset-research/lunar-toolset-eset-turla-2024/
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt29-hammertoss.pdf
- https://github.com/BishopFox/sliver
- https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-turla/
- https://www.proofpoint.com/us/threat-insight/post/new-trojan-zerot-delivered-alongside-plugx-targeted-attacks
- https://www.trendmicro.com/en_us/research/17/k/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography.html
- https://unit42.paloaltonetworks.com/rdat-tool-uses-steganography-and-dns-over-https/
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://github.com/ragibson/Steganography
- https://github.com/nicowillis/steg-tools
Unlock Pro Content
Get the full detection package for T1001.002 including response playbook, investigation guide, and atomic red team tests.