Steganography
Subtechnique · ATTACK:enterprise:T1001.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1001.002",
"title": "Steganography",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1001/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--eec23884-3fa1-4d8a-ac50-6f104d51e235",
"external_id": "T1001.002",
"domain": "enterprise",
"created": "2020-03-15T00:37:58.963Z",
"modified": "2025-10-24T17:49:35.060Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
{
"source_name": "University of Birmingham C2",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06f14692-8825-4947-9a63-fb4b4384b7ed
ESET Turla Lunar toolset May 2024ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c393451-a750-4c8a-81be-4d0e9e84a6eb
Novetta-AxiomATTACK:enterprise:S0037 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34c4b497-00e3-415c-8e09-3b73667d9bbe
FireEye APT29ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41b7f3d7-b42e-4301-ac9e-ecad27e826a0
GitHub Sliver HTTPATTACK:enterprise:C0023 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42868389-76f1-4dbf-9b7e-f657d6c8e0cc
ESET Dukes October 2019ATTACK:enterprise:S0672 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ae58878-d6b9-4f0d-bca1-f2f3b5e2adce
Novetta-AxiomATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4be17eba-9ee0-46ff-b019-ce32c25ad146
ESET LightNeuron May 2019ATTACK:enterprise:S0230 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84f88ed3-28fe-4936-8ea2-2d4f6d015c0c
Proofpoint TA459 April 2017 · Proofpoint ZeroT Feb 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a566127b-1d88-4b38-84dd-4686e2837399
Trend Micro Daserf Nov 2017ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a760c63f-6459-430d-88ce-291513c47d11
Unit42 RDAT July 2020ATTACK:enterprise:S1142 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf50a79a-2df0-4da5-86bd-b534c5c09494
ESET Turla Lunar toolset May 2024ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0905059-1f3c-414c-8027-b8ec2e4b3c89
Symantec W32.DuquATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2097180-b02f-4ffc-b0a6-8e8bb899a551
ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f01cbea5-8528-45e8-afdf-d1f382980d8a
FireEye SUNBURST Backdoor December 2020 · FireEye SUNBURST Additional Details Dec 2020 · Symantec Sunburst Sending Data January 2021ATTACK:enterprise:T1001.002 → subtechnique-of → ATTACK:enterprise:T1001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2d8189b-efc4-47ff-8b63-ec58e18abc7e