# T1001.002 - Data Obfuscation via Steganography

## Description from ATT&CK

> Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.

[Source](https://attack.mitre.org/techniques/T1001/002)

## Atomic Tests

- [Atomic Test #1: Steganographic Tarball Embedding](#atomic-test-1-steganographic-tarball-embedding)
- [Atomic Test #2: Embedded Script in Image Execution via Extract-Invoke-PSImage](#atomic-test-2-embedded-script-in-image-execution-via-extract-invoke-psimage)
- [Atomic Test #3: Execute Embedded Script in Image via Steganography](#atomic-test-3-execute-embedded-script-in-image-via-steganography)

### Atomic Test #1: Steganographic Tarball Embedding

This atomic test, named "Steganographic Tarball Embedding", simulates the technique of data obfuscation via steganography by embedding a tar archive file (tarball) 
within an image.

The test begins by ensuring the availability of the image file and the tarball file containing data . It then generates random passwords and saves them to a 
file. Subsequently, the tarball file is created, containing the passwords file. The test executor command reads the contents of the image 
file and the tarball file as byte arrays and appends them together to form a new image file. This process effectively embeds the tarball 
file within the image, utilizing steganography techniques for data obfuscation.

This atomic test simulates the technique of data obfuscation via steganography, enabling attackers to clandestinely transfer files across systems undetected. 
By embedding the tarball file within the image, adversaries can obscure their activities, facilitating covert communication and data exfiltration.

**Supported Platforms:** Windows

**auto_generated_guid:** `c7921449-8b62-4c4d-8a83-d9281ac0190b`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| image_file | Image file which will be downloaded to be used to hide data | path | PathToAtomicsFolder&#92;T1001.002&#92;bin&#92;T1001.002.jpg|
| tar_file | Tarz file containing random passwords | path | $env:PUBLIC&#92;Downloads&#92;T1001.002.tarz|
| new_image_file | new image file ready for extraction | path | $env:PUBLIC&#92;Downloads&#92;T1001.002New.jpg|
| passwords_file | Text file containing random passwords | path | $env:TEMP&#92;random_passwords.txt|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Get-Content "#{image_file}", "#{tar_file}" -Encoding byte -ReadCount 0 | Set-Content "#{new_image_file}" -Encoding byte
```

#### Cleanup Commands

```powershell
Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore
Remove-Item -Path "#{new_image_file}" -Force -ErrorAction Ignore
```

#### Dependencies: Run with `powershell`!

##### Description: Image file must exist

###### Check Prereq Commands

```powershell
if (!(Test-Path "#{image_file}")) {exit 1} else {
{exit 0}
}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{image_file}") -ErrorAction ignore | Out-Null
Write-Output "Downloading image file..."
$imageUrl = "https://github.com/raghavsingh7/Pictures/raw/a9617d9fce[PII_REDACTED]20a1e0366315c2c5e19d/lime.jpg"
Invoke-WebRequest -Uri $imageUrl -OutFile "#{image_file}"
```

##### Description: File to hide within tarz file must exist

###### Check Prereq Commands

```powershell
if (!(Test-Path "#{passwords_file}")) {exit 1} else {
{exit 0}
}
```

###### Get Prereq Commands

```powershell
Write-Output "Generating random passwords and saving to file..."
$passwords = 1..10 | ForEach-Object { -join ((1..12) | ForEach-Object { @('A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z') + @('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z') + @('0','1','2','3','4','5','6','7','8','9') + @('!','@','#','$','%','^','&','*','(','(',')','-','=','+','_','[',']','{','}','|',';',';',':',',','<','>','?') | Get-Random }) }
$passwords | Out-File -FilePath "#{passwords_file}"
```

##### Description: Tarz file to embed in image must exist

###### Check Prereq Commands

```powershell
if (!(Test-Path "#{tar_file}")) {exit 1} else {
{exit 0}
}
```

###### Get Prereq Commands

```powershell
Write-Output "Generating tarz file..."
tar -cvf "#{tar_file}" "#{passwords_file}"
```

### Atomic Test #2: Embedded Script in Image Execution via Extract-Invoke-PSImage

This atomic test demonstrates the technique of data obfuscation via steganography, where a PowerShell script is concealed within an image file. 
The PowerShell script is embedded using steganography techniques, making it undetectable by traditional security measures. The script is hidden 
within the pixels of the image, enabling attackers to covertly transfer and execute malicious code across systems.

The test begins by ensuring the availability of the malicious image file and the Extract-Invoke-PSImage script. The test proceeds to extract the hidden 
PowerShell script (decoded.ps1) from the image file using the Extract-Invoke-PSImage tool. The extracted script is then decoded from base64 encoding and saved as a 
separate PowerShell (textExtraction.ps1). Consequently, the textExtraction.ps1 script is executed.

In the case of this atomic test, the malicious image file which is downloaded has the powershell command Start-Process notepad embedded within in base64. This
is done to emulate an attackers behaviour in the case they were to execute malware embedded within the image file.

**Supported Platforms:** Windows

**auto_generated_guid:** `04bb8e3d-1670-46ab-a3f1-5cee64da29b6`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| image_file | Malicious Image file which will be downloaded | path | PathToAtomicsFolder&#92;T1001.002&#92;bin&#92;evil_kitten.jpg|
| psimage_script | Extract-Invoke-PSImage Script downloaded | path | PathToAtomicsFolder&#92;ExternalPayloads&#92;Extract-Invoke-PSImage.ps1|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
cd "PathToAtomicsFolder\ExternalPayloads\"
Import-Module .\Extract-Invoke-PSImage.ps1
$extractedScript=Extract-Invoke-PSImage -Image "#{image_file}" -Out "$HOME\result.ps1"
$scriptContent = Get-Content "$HOME\result.ps1" -Raw
$base64Pattern = "(?<=^|[^A-Za-z0-9+/])(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(==)?|[A-Za-z0-9+/]{3}=)?(?=$|[^A-Za-z0-9+/])"
$base64Strings = [regex]::Matches($scriptContent, $base64Pattern) | ForEach-Object { $_.Value }
$base64Strings |