t1406-001-steganography

name	T1406.001_steganography
description	Adversaries may use steganography techniques in order to prevent the detection of hidden information.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","mobile","t1406.001","defense-evasion","android","sub-technique"]
technique_id	T1406.001
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Android"]
mitre_url	https://attack.mitre.org/techniques/T1406/001
tech_stack	["android"]
cwe_ids	["CWE-693"]
chains_with	["T1406","T1406.002"]
prerequisites	["T1406"]
severity_boost	{"T1406":"Chain with T1406 for deeper attack path","T1406.002":"Chain with T1406.002 for deeper attack path"}

T1406.001 Steganography

Sub-technique of: T1406

High-Level Description

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.

Kill Chain Phase

• Defense Evasion (TA0030)

Platforms: Android

What to Check

• Identify if Steganography technique is applicable to target mobile environment
• Check Android devices for indicators of Steganography
• Assess detection coverage (1 detection strategies)

How to Test

Identify Attack Surface

Determine if the target mobile environment is susceptible to Steganography by examining the target platforms (Android).

Assess Existing Defenses

Review whether mitigations for T1406.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Remediation Guide

No specific mitigations documented for this technique.

Detection

Detection of Steganography

Risk Assessment

Finding	Severity	Impact
Steganography technique applicable	Low	Defense Evasion

CWE Categories

CWE ID	Title
CWE-693	Protection Mechanism Failure

References

• MITRE ATT&CK Mobile - T1406.001