// MITRE ATT&CK
T1001.002 · Steganography
Sub-técnica de T1001 · Data Obfuscation.
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of comp...
¿Cómo detectarlo y mitigarlo?
La detección de Steganography parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Técnicas relacionadas
T1132.001
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1071
Application Layer Protocol T1219
Remote Access Tools
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1071
Application Layer Protocol T1219
Remote Access Tools
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.