Detect Steganography in Sumo Logic CSE
Adversaries may use steganographic techniques to hide command and control traffic within digital media files (images, PDFs, etc.) to evade detection. Commands or data can be embedded in image files (JPG, PNG, GIF, BMP) or documents using techniques such as Least Significant Bit (LSB) encoding, appending data after EOF markers, or hiding data in file format metadata and structures (e.g., IDAT chunks in PNG). Real-world malware including HAMMERTOSS, LunarWeb, LunarMail, ZeroT, LightNeuron, RDAT, Duqu, and Sliver have leveraged steganographic C2 channels. Detection focuses on process behavior (tools that process or download image files with unusual patterns), network anomalies (HTTP traffic downloading image files at regular intervals with response size variance), and file system indicators (known steganography utilities being executed).
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1001 Data Obfuscation
- Sub-technique
- T1001.002 Steganography
- Canonical reference
- https://attack.mitre.org/techniques/T1001/002/
Sumo Detection Query
// Detection 1: Known steganography tool execution
(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*)
| where EventID in ("1", "4688")
| parse field=CommandLine "*" as cmd_lower
| eval cmd_lower = toLowerCase(CommandLine)
| eval image_lower = toLowerCase(Image)
| eval stego_tool = if(
image_lower matches "(steghide|outguess|stegdetect|openstego|silenteye|stegosuite|snow\.exe|jphide|jpseek|camouflage)"
or cmd_lower matches "(steghide|outguess|openstego|invoke-psimage|invoke-steganography)",
1, 0)
| eval lsb_manipulation = if(
image_lower matches "(powershell\.exe|pwsh\.exe)"
and cmd_lower matches "(lsb|lockbits|getpixel|setpixel|bitmapimage|idat|steganograph)",
1, 0)
| eval certutil_encoding = if(
image_lower matches "certutil\.exe"
and cmd_lower matches "(-encode|-decode)"
and cmd_lower matches "\.(jpg|jpeg|png|gif|bmp)",
1, 0)
| eval binary_copy = if(
cmd_lower matches "copy.*/b.*\.(jpg|jpeg|png|gif|bmp)|copy.*\.(jpg|jpeg|png|gif|bmp).*/b",
1, 0)
| eval suspicion_score = stego_tool + lsb_manipulation + certutil_encoding + binary_copy
| where suspicion_score > 0
| fields _time, host, User, Image, CommandLine, ParentImage, stego_tool, lsb_manipulation, certutil_encoding, binary_copy, suspicion_score
| sort by suspicion_score desc, _time desc
// Detection 2: Suspicious image file writes (Sysmon Event 11)
// Run separately:
// (_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
// | where EventID = "11"
// | where toLowerCase(TargetFilename) matches "\.(jpg|jpeg|png|gif|bmp|tiff|webp)$"
// | where toLowerCase(Image) matches "(powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)"
// | fields _time, host, User, Image, TargetFilename
// | sort by _time descSumo Logic CSE query detecting steganography tool execution, PowerShell LSB manipulation, certutil encoding on image files, and binary copy tricks. Uses a suspicion scoring model. Requires Sysmon or Windows Security audit logging forwarded to Sumo Logic.
Data Sources
Required Tables
False Positives & Tuning
- Digital forensics teams using steganography analysis tools in authorized investigations
- Security researchers analyzing malware samples containing steganographic content
- Legitimate image batch processing scripts using PowerShell and pixel-level operations
- CTF participants using steganography tools on competition infrastructure
- Pentesters authorized to use steganographic C2 channels during red team exercises
Other platforms for T1001.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Steghide - Embed and Extract Data in JPEG
Expected signal: Sysmon Event ID 1 (Linux equivalent via auditd execve syscall): Process creation for 'steghide' with arguments 'embed' and 'extract'. File creation events for /tmp/carrier_test.jpg modification and /tmp/extracted_payload.txt creation. Auditd SYSCALL records for open/write on image file.
- Test 2PowerShell LSB Steganography - Encode Command in PNG
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'GetPixel', 'SetPixel', 'Bitmap', 'LSB'. Sysmon Event ID 11: File Create for C:\Temp\stego_test.png by powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with full script content including bitmap manipulation code.
- Test 3Python Steganography - Embed Data Using PIL
Expected signal: Auditd EXECVE syscall for python3 with script content referencing PIL, Image.open, getdata, putdata. File creation events for /tmp/carrier_image.png and /tmp/stego_output.png. If Sysmon for Linux is deployed: Event ID 1 for python3 process, Event ID 11 for .png file creation.
- Test 4Windows CMD Binary Copy - Append Data to JPEG (Polyglot File)
Expected signal: Sysmon Event ID 1: Process Create for certutil.exe with -urlcache arguments, and cmd.exe with 'copy /b' and .jpg in command line. Sysmon Event ID 3: Network connection from certutil.exe to httpbin.org. Sysmon Event ID 11: File creation for output_stego.jpg. Windows Security Event ID 4688 if process auditing enabled.
References (13)
- https://attack.mitre.org/techniques/T1001/002/
- https://www.welivesecurity.com/en/eset-research/lunar-toolset-eset-turla-2024/
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt29-hammertoss.pdf
- https://github.com/BishopFox/sliver
- https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-turla/
- https://www.proofpoint.com/us/threat-insight/post/new-trojan-zerot-delivered-alongside-plugx-targeted-attacks
- https://www.trendmicro.com/en_us/research/17/k/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography.html
- https://unit42.paloaltonetworks.com/rdat-tool-uses-steganography-and-dns-over-https/
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://github.com/ragibson/Steganography
- https://github.com/nicowillis/steg-tools
Unlock Pro Content
Get the full detection package for T1001.002 including response playbook, investigation guide, and atomic red team tests.