Detect Steganography in Sumo Logic CSE
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. Adversaries commonly hide malicious payloads within PNG, BMP, JPG, and GIF files, often extracting PE executables or shellcode at runtime using LSB (Least Significant Bit) manipulation or custom XOR-based extraction. Threat actors including APT37, APT29, Andariel, Tropic Trooper, BRONZE BUTLER, and MuddyWater have used steganography to hide C2 configurations, shellcode, and full malware payloads within seemingly benign images.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.003 Steganography
- Canonical reference
- https://attack.mitre.org/techniques/T1027/003/
Sumo Detection Query
(_sourceCategory="windows/sysmon" OR _sourceCategory="Windows/Sysmon" OR _sourceCategory="os/windows")
| where EventID = "1" OR EventID = "11"
| eval cmdline = toLowerCase(CommandLine)
| eval targetfile = toLowerCase(TargetFilename)
| eval procimg = toLowerCase(Image)
| eval IsStegoTool = if (
cmdline matches "(?i).*(invoke-psimage|steghide|openstego|outguess|stegdetect).*",
1, 0)
| eval IsImageExtract = if (
(cmdline matches "(?i).*\.(png|jpg|jpeg|bmp|gif|tiff).*")
AND (cmdline matches "(?i).*(extract|lsb|decode|steg|hidden|payload).*"),
1, 0)
| eval IsBrowserExeDrop = if (
EventID = "11"
AND (targetfile matches "(?i).*\\(pictures|downloads|temp)\\.*\.(exe|dll)$")
AND (procimg matches "(?i).*(chrome|msedge|iexplore|firefox|explorer)\.exe.*"),
1, 0)
| where IsStegoTool = 1 OR IsImageExtract = 1 OR IsBrowserExeDrop = 1
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, TargetFilename, IsStegoTool, IsImageExtract, IsBrowserExeDrop
| sort by _messageTime descSumo Logic query detecting steganography tool execution and image-based payload extraction using Sysmon EventID 1 (process creation) and EventID 11 (file creation). Classifies each match by detection type: known tool invocation (IsStegoTool), image-file extraction command pattern (IsImageExtract), or browser-originated PE/DLL drop in a user-accessible directory (IsBrowserExeDrop).
Data Sources
Required Tables
False Positives & Tuning
- Penetration testers or purple team operators running steghide, outguess, or invoke-psimage on Sumo-monitored endpoints during scoped exercises
- Forensic and incident response toolkits (e.g., KAPE triage, Autopsy forensic suite) that perform LSB or decode operations against image files as part of artifact collection
- Software deployment workflows where browsers download and stage installers in Downloads or Temp before a deployment management agent moves them; EXE appears in a user directory but is legitimately signed
Other platforms for T1027.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Hide and Extract Payload with Invoke-PSImage
Expected signal: Sysmon Event ID 3: Network connection to raw.githubusercontent.com. Sysmon Event ID 11: stego_test.png created in %TEMP%. PowerShell ScriptBlock Log Event ID 4104: Invoke-PSImage commands and the embedded script. The PNG will have slightly modified pixel values to carry the hidden payload.
- Test 2Embed Secret Message in Image using steghide
Expected signal: Sysmon Event ID 1: steghide.exe process creation with 'embed' then 'extract' arguments. Sysmon Event ID 11: stego_output.jpg and extracted_payload.txt created in %TEMP%. The steghide tool name will appear in process command lines.
- Test 3Simulate C2 Configuration Retrieval via Steganographic Image
Expected signal: Sysmon Event ID 1: powershell.exe with Invoke-WebRequest to external URL. Sysmon Event ID 3: Network connection to microsoft.com port 443. PowerShell ScriptBlock Log Event ID 4104: the extraction code using bitwise AND on image bytes.
- Test 4Detect High-Entropy Data in Image with binwalk
Expected signal: Process execution for dd and binwalk commands. Auditd execve records for both commands. The binwalk output will show signatures of embedded data within the image file.
References (5)
- https://attack.mitre.org/techniques/T1027/003/
- https://en.wikipedia.org/wiki/Duqu
- https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/
- https://github.com/peewpw/Invoke-PSImage
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.003/T1027.003.md
Unlock Pro Content
Get the full detection package for T1027.003 including response playbook, investigation guide, and atomic red team tests.