[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EW53W64M92C4P6436K9JSX":3,"skill-same:01M6EW53W64M92C4P6436K9JSX":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6EW53W64M92C4P6436K9JSX","performing-steganography-detection",null,"Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-steganography-detection\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"detection","performing steganography detection","steganography","Audio","channels","detect","de","files","images","hidden-data","steganalysis","image","Media","analysis","t1059","covert-channels","image-analysis","forensics","communication","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-steganography-detection\ndescription: Detect and extract hidden data embedded in images, audio, and other media\n  files using steganalysis tools to uncover covert communication channels.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- steganography\n- steganalysis\n- hidden-data\n- covert-channels\n- image-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1059\n---\n\n# Performing Steganography Detection\n\n## When to Use\n- When suspecting covert data hiding in images, audio, or video files\n- During investigations involving suspected data exfiltration via media files\n- For analyzing files in espionage or insider threat investigations\n- When standard file analysis reveals anomalies in media file properties\n- For detecting communication channels using steganographic techniques\n\n## Prerequisites\n- StegDetect, zsteg, stegsolve, binwalk for analysis\n- steghide, OpenStego for extraction attempts\n- ExifTool for metadata analysis\n- Python with Pillow, numpy for custom analysis\n- Understanding of common steganographic techniques (LSB, DCT, spread spectrum)\n- Sample files for comparison and statistical analysis\n\n## Workflow\n\n### Step 1: Initial File Assessment and Metadata Analysis\n\n```bash\n# Install steganography detection tools\nsudo apt-get install steghide stegsnow\npip install zsteg\npip install stegoveritas\ngem install zsteg  # Ruby-based tool for PNG\u002FBMP\n\n# Examine file metadata for anomalies\nexiftool \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmetadata.txt\n\n# Check for unusual file size (larger than expected for resolution\u002Fformat)\nidentify -verbose \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | head -30\n\n# Verify file type matches extension\nfile \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg\n# Confirm JPEG signature vs actual content\n\n# Check for appended data after file footer\npython3 \u003C\u003C 'PYEOF'\nimport os\n\nfilepath = '\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg'\nfilesize = os.path.getsize(filepath)\n\nwith open(filepath, 'rb') as f:\n    data = f.read()\n\n# JPEG files end with FF D9\njpeg_end = data.rfind(b'\\xff\\xd9')\nif jpeg_end > 0:\n    trailing_bytes = filesize - jpeg_end - 2\n    if trailing_bytes > 0:\n        print(f\"WARNING: {trailing_bytes} bytes of data after JPEG end marker!\")\n        print(f\"  File size: {filesize} bytes\")\n        print(f\"  JPEG data: {jpeg_end + 2} bytes\")\n        print(f\"  Hidden data: {trailing_bytes} bytes\")\n        # Extract trailing data\n        with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ftrailing_data.bin', 'wb') as out:\n            out.write(data[jpeg_end + 2:])\n    else:\n        print(\"No trailing data detected after JPEG end marker\")\n\n# Check for embedded ZIP\u002FRAR archives\nzip_offset = data.find(b'PK\\x03\\x04')\nrar_offset = data.find(b'Rar!\\x1a\\x07')\nif zip_offset > 0:\n    print(f\"ZIP archive found at offset {zip_offset}\")\nif rar_offset > 0:\n    print(f\"RAR archive found at offset {rar_offset}\")\nPYEOF\n```\n\n### Step 2: Run Automated Steganalysis Tools\n\n```bash\n# Use binwalk to detect embedded files and data\nbinwalk \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbinwalk_scan.txt\n\n# Extract embedded files\nbinwalk --extract --directory \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbinwalk_extracted\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg\n\n# Use zsteg for PNG and BMP analysis (LSB detection)\nzsteg \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fzsteg_results.txt\n\n# zsteg with all checks\nzsteg -a \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png\n\n# Use stegoveritas for comprehensive analysis\nstegoveritas \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg \\\n   -out \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstegoveritas\u002F\n\n# Stegoveritas performs:\n# - Metadata extraction\n# - LSB analysis (multiple bit planes)\n# - Color map analysis\n# - Trailing data detection\n# - Embedded file extraction\n# - Image transformation analysis\n\n# Use steghide for JPEG\u002FBMP\u002FWAV\u002FAU extraction attempts\n# Try with empty password\nsteghide extract -sf \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg -p \"\" \\\n   -xf \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteghide_extract.bin 2>&1\n\n# Try with common passwords\nfor pwd in password secret hidden stego test 123456 admin; do\n    result=$(steghide extract -sf \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg \\\n       -p \"$pwd\" -xf \"\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteghide_$pwd.bin\" 2>&1)\n    if echo \"$result\" | grep -q \"extracted\"; then\n        echo \"SUCCESS with password: $pwd\"\n    fi\ndone\n```\n\n### Step 3: Perform LSB (Least Significant Bit) Analysis\n\n```bash\n# Custom LSB analysis with Python\npython3 \u003C\u003C 'PYEOF'\nfrom PIL import Image\nimport numpy as np\n\nimg = Image.open('\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png')\npixels = np.array(img)\n\n# Extract LSB from each color channel\nfor channel, name in enumerate(['Red', 'Green', 'Blue']):\n    if channel >= pixels.shape[2]:\n        break\n\n    lsb_data = pixels[:, :, channel] & 1\n\n    # Count distribution (should be ~50\u002F50 for natural images)\n    zeros = np.sum(lsb_data == 0)\n    ones = np.sum(lsb_data == 1)\n    total = zeros + ones\n    ratio = ones \u002F total\n\n    print(f\"{name} channel LSB: 0s={zeros} ({zeros\u002Ftotal*100:.1f}%), 1s={ones} ({ones\u002Ftotal*100:.1f}%)\")\n    if abs(ratio - 0.5) \u003C 0.01:\n        print(f\"  NEUTRAL - Close to random (could be stego or natural)\")\n    elif ratio > 0.55 or ratio \u003C 0.45:\n        print(f\"  ANOMALY - Significant deviation from expected distribution\")\n\n# Extract LSB data as bytes\nlsb_bits = (pixels[:, :, 0] & 1).flatten()\nlsb_bytes = np.packbits(lsb_bits)\n\n# Check if extracted data has structure\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsb_extracted.bin', 'wb') as f:\n    f.write(lsb_bytes.tobytes())\n\n# Check for known file signatures in extracted data\nimport struct\nheader = bytes(lsb_bytes[:16])\nprint(f\"\\nLSB extracted header (hex): {header.hex()}\")\nif header[:4] == b'PK\\x03\\x04':\n    print(\"  DETECTED: ZIP archive in LSB data!\")\nelif header[:3] == b'GIF':\n    print(\"  DETECTED: GIF image in LSB data!\")\nelif header[:4] == b'\\x89PNG':\n    print(\"  DETECTED: PNG image in LSB data!\")\nelif header[:2] == b'\\xff\\xd8':\n    print(\"  DETECTED: JPEG image in LSB data!\")\n\n# Generate LSB visualization\nlsb_img = Image.fromarray((lsb_data * 255).astype(np.uint8))\nlsb_img.save('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsb_visualization.png')\nprint(\"\\nLSB visualization saved to lsb_visualization.png\")\nPYEOF\n```\n\n### Step 4: Analyze Audio and Video Steganography\n\n```bash\n# Spectral analysis of audio files\npython3 \u003C\u003C 'PYEOF'\nimport wave\nimport numpy as np\n\n# Analyze WAV file for audio steganography\nwith wave.open('\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_audio.wav', 'r') as wav:\n    frames = wav.readframes(wav.getnframes())\n    samples = np.frombuffer(frames, dtype=np.int16)\n\n    # LSB analysis of audio samples\n    lsb = samples & 1\n    zeros = np.sum(lsb == 0)\n    ones = np.sum(lsb == 1)\n    total = len(lsb)\n\n    print(f\"Audio LSB Analysis:\")\n    print(f\"  Samples: {total}\")\n    print(f\"  LSB 0s: {zeros} ({zeros\u002Ftotal*100:.1f}%)\")\n    print(f\"  LSB 1s: {ones} ({ones\u002Ftotal*100:.1f}%)\")\n\n    # Extract LSB data\n    lsb_bytes = np.packbits(lsb)\n    with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faudio_lsb.bin', 'wb') as f:\n        f.write(lsb_bytes.tobytes())\n\n    # Chi-square test for randomness\n    from scipy import stats\n    chi2, p_value = stats.chisquare([zeros, ones])\n    print(f\"  Chi-square: {chi2:.4f}, p-value: {p_value:.4f}\")\n    if p_value \u003C 0.05:\n        print(f\"  ANOMALY: LSB distribution is not random (potential stego)\")\nPYEOF\n\n# Use steghide on audio files\nsteghide info \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_audio.wav\n\n# Analyze with sonic-visualiser or audacity for spectral anomalies\n# (Check spectrogram for hidden images encoded in frequency domain)\n```\n\n### Step 5: Generate Steganalysis Report\n\n```bash\n# Compile findings\npython3 \u003C\u003C 'PYEOF'\nimport os, json\n\nreport = {\n    \"case\": \"2024-001\",\n    \"files_analyzed\": [],\n    \"findings\": []\n}\n\nanalysis_dir = '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F'\nfor f in os.listdir(analysis_dir):\n    if f.endswith('.txt'):\n        with open(os.path.join(analysis_dir, f)) as fh:\n            content = fh.read()\n            if 'DETECTED' in content or 'SUCCESS' in content or 'WARNING' in content:\n                report[\"findings\"].append({\n                    \"source\": f,\n                    \"content\": content[:500]\n                })\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteg_report.json', 'w') as f:\n    json.dump(report, f, indent=2)\n\nprint(\"Steganalysis report generated\")\nprint(f\"Total findings: {len(report['findings'])}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LSB (Least Significant Bit) | Embedding data in the lowest-order bits of pixel or sample values |\n| DCT steganography | Hiding data in JPEG discrete cosine transform coefficients |\n| Spread spectrum | Distributing hidden data across the entire carrier signal |\n| Steganalysis | The science of detecting the presence of hidden information |\n| Chi-square attack | Statistical test detecting non-random LSB distributions |\n| Cover medium | The original file used to carry hidden data (image, audio, video) |\n| Stego medium | The resulting file after hidden data has been embedded |\n| Capacity | Maximum amount of data that can be hidden without visible distortion |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| steghide | Embed\u002Fextract data in JPEG, BMP, WAV, AU files |\n| zsteg | Detect LSB steganography in PNG and BMP files |\n| binwalk | Detect embedded files and data within binary files |\n| stegoveritas | Comprehensive steganalysis tool with multiple detection methods |\n| StegSolve | Java GUI tool for image bit plane and filter analysis |\n| OpenStego | Open-source steganography and watermarking tool |\n| ExifTool | Metadata extraction and analysis for media files |\n| stegseek | Fast steghide password cracker for JPEG stego extraction |\n\n## Common Scenarios\n\n**Scenario 1: Covert Communication Investigation**\nExamine images exchanged between suspects via messaging platforms, run stegoveritas and zsteg on all PNG\u002FBMP files, attempt steghide extraction with known passwords on JPEG files, analyze LSB distributions for statistical anomalies, extract and decode any hidden messages.\n\n**Scenario 2: Data Exfiltration via Image Upload**\nMonitor images uploaded to cloud services for unusual file sizes, compare image metadata with expected camera\u002Fdevice profiles, run binwalk to detect embedded archives, analyze JPEG quantization tables for steghide signatures, extract and examine any hidden payloads.\n\n**Scenario 3: Malware Command and Control**\nAnalyze images downloaded by malware for embedded commands, check for data appended after file end markers, examine DNS query responses for base64-encoded data in TXT records, analyze PNG IDAT chunks for anomalous compressed data sizes.\n\n**Scenario 4: Intellectual Property Theft via Audio Files**\nAnalyze audio files for embedded documents in LSB, check spectrograms for visual patterns hidden in frequency domain, compare audio file sizes with expected sizes for bitrate and duration, extract and analyze any hidden data payloads.\n\n## Output Format\n\n```\nSteganalysis Summary:\n  Files Analyzed: 45 (32 images, 8 audio, 5 video)\n\n  Detection Results:\n    suspect_image_03.png:\n      zsteg: Text detected in R channel LSB\n      Content: \"Meet at location B, Tuesday 1400\"\n      Method: LSB embedding in Red channel\n\n    suspect_photo_17.jpg:\n      steghide: Data extracted with password \"secret123\"\n      Hidden file: confidential_report.pdf (234 KB)\n      Method: DCT coefficient modification\n\n    profile_pic.png:\n      binwalk: ZIP archive embedded at offset 45678\n      Contents: 3 spreadsheet files with financial data\n      Method: Data appended after PNG IEND marker\n\n    recording_05.wav:\n      LSB analysis: Non-random distribution (p \u003C 0.001)\n      Extracted: 12 KB binary payload (further analysis needed)\n      Method: Audio LSB embedding\n\n  Clean Files: 41 (no steganographic indicators)\n  Suspicious Files: 4 (data extracted)\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteg_report.json\n```\n","# Performing Steganography Detection\n\n## When to Use\n- When suspecting covert data hiding in images, audio, or video files\n- During investigations involving suspected data exfiltration via media files\n- For analyzing files in espionage or insider threat investigations\n- When standard file analysis reveals anomalies in media file properties\n- For detecting communication channels using steganographic techniques\n\n## Prerequisites\n- StegDetect, zsteg, stegsolve, binwalk for analysis\n- steghide, OpenStego for extraction attempts\n- ExifTool for metadata analysis\n- Python with Pillow, numpy for custom analysis\n- Understanding of common steganographic techniques (LSB, DCT, spread spectrum)\n- Sample files for comparison and statistical analysis\n\n## Workflow\n\n### Step 1: Initial File Assessment and Metadata Analysis\n\n```bash\n# Install steganography detection tools\nsudo apt-get install steghide stegsnow\npip install zsteg\npip install stegoveritas\ngem install zsteg  # Ruby-based tool for PNG\u002FBMP\n\n# Examine file metadata for anomalies\nexiftool \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmetadata.txt\n\n# Check for unusual file size (larger than expected for resolution\u002Fformat)\nidentify -verbose \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | head -30\n\n# Verify file type matches extension\nfile \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg\n# Confirm JPEG signature vs actual content\n\n# Check for appended data after file footer\npython3 \u003C\u003C 'PYEOF'\nimport os\n\nfilepath = '\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg'\nfilesize = os.path.getsize(filepath)\n\nwith open(filepath, 'rb') as f:\n    data = f.read()\n\n# JPEG files end with FF D9\njpeg_end = data.rfind(b'\\xff\\xd9')\nif jpeg_end > 0:\n    trailing_bytes = filesize - jpeg_end - 2\n    if trailing_bytes > 0:\n        print(f\"WARNING: {trailing_bytes} bytes of data after JPEG end marker!\")\n        print(f\"  File size: {filesize} bytes\")\n        print(f\"  JPEG data: {jpeg_end + 2} bytes\")\n        print(f\"  Hidden data: {trailing_bytes} bytes\")\n        # Extract trailing data\n        with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ftrailing_data.bin', 'wb') as out:\n            out.write(data[jpeg_end + 2:])\n    else:\n        print(\"No trailing data detected after JPEG end marker\")\n\n# Check for embedded ZIP\u002FRAR archives\nzip_offset = data.find(b'PK\\x03\\x04')\nrar_offset = data.find(b'Rar!\\x1a\\x07')\nif zip_offset > 0:\n    print(f\"ZIP archive found at offset {zip_offset}\")\nif rar_offset > 0:\n    print(f\"RAR archive found at offset {rar_offset}\")\nPYEOF\n```\n\n### Step 2: Run Automated Steganalysis Tools\n\n```bash\n# Use binwalk to detect embedded files and data\nbinwalk \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbinwalk_scan.txt\n\n# Extract embedded files\nbinwalk --extract --directory \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbinwalk_extracted\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg\n\n# Use zsteg for PNG and BMP analysis (LSB detection)\nzsteg \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fzsteg_results.txt\n\n# zsteg with all checks\nzsteg -a \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png\n\n# Use stegoveritas for comprehensive analysis\nstegoveritas \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg \\\n   -out \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstegoveritas\u002F\n\n# Stegoveritas performs:\n# - Metadata extraction\n# - LSB analysis (multiple bit planes)\n# - Color map analysis\n# - Trailing data detection\n# - Embedded file extraction\n# - Image transformation analysis\n\n# Use steghide for JPEG\u002FBMP\u002FWAV\u002FAU extraction attempts\n# Try with empty password\nsteghide extract -sf \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg -p \"\" \\\n   -xf \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteghide_extract.bin 2>&1\n\n# Try with common passwords\nfor pwd in password secret hidden stego test 123456 admin; do\n    result=$(steghide extract -sf \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg \\\n       -p \"$pwd\" -xf \"\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteghide_$pwd.bin\" 2>&1)\n    if echo \"$result\" | grep -q \"extracted\"; then\n        echo \"SUCCESS with password: $pwd\"\n    fi\ndone\n```\n\n### Step 3: Perform LSB (Least Significant Bit) Analysis\n\n```bash\n# Custom LSB analysis with Python\npython3 \u003C\u003C 'PYEOF'\nfrom PIL import Image\nimport numpy as np\n\nimg = Image.open('\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png')\npixels = np.array(img)\n\n# Extract LSB from each color channel\nfor channel, name in enumerate(['Red', 'Green', 'Blue']):\n    if channel >= pixels.shape[2]:\n        break\n\n    lsb_data = pixels[:, :, channel] & 1\n\n    # Count distribution (should be ~50\u002F50 for natural images)\n    zeros = np.sum(lsb_data == 0)\n    ones = np.sum(lsb_data == 1)\n    total = zeros + ones\n    ratio = ones \u002F total\n\n    print(f\"{name} channel LSB: 0s={zeros} ({zeros\u002Ftotal*100:.1f}%), 1s={ones} ({ones\u002Ftotal*100:.1f}%)\")\n    if abs(ratio - 0.5) \u003C 0.01:\n        print(f\"  NEUTRAL - Close to random (could be stego or natural)\")\n    elif ratio > 0.55 or ratio \u003C 0.45:\n        print(f\"  ANOMALY - Significant deviation from expected distribution\")\n\n# Extract LSB data as bytes\nlsb_bits = (pixels[:, :, 0] & 1).flatten()\nlsb_bytes = np.packbits(lsb_bits)\n\n# Check if extracted data has structure\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsb_extracted.bin', 'wb') as f:\n    f.write(lsb_bytes.tobytes())\n\n# Check for known file signatures in extracted data\nimport struct\nheader = bytes(lsb_bytes[:16])\nprint(f\"\\nLSB extracted header (hex): {header.hex()}\")\nif header[:4] == b'PK\\x03\\x04':\n    print(\"  DETECTED: ZIP archive in LSB data!\")\nelif header[:3] == b'GIF':\n    print(\"  DETECTED: GIF image in LSB data!\")\nelif header[:4] == b'\\x89PNG':\n    print(\"  DETECTED: PNG image in LSB data!\")\nelif header[:2] == b'\\xff\\xd8':\n    print(\"  DETECTED: JPEG image in LSB data!\")\n\n# Generate LSB visualization\nlsb_img = Image.fromarray((lsb_data * 255).astype(np.uint8))\nlsb_img.save('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsb_visualization.png')\nprint(\"\\nLSB visualization saved to lsb_visualization.png\")\nPYEOF\n```\n\n### Step 4: Analyze Audio and Video Steganography\n\n```bash\n# Spectral analysis of audio files\npython3 \u003C\u003C 'PYEOF'\nimport wave\nimport numpy as np\n\n# Analyze WAV file for audio steganography\nwith wave.open('\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_audio.wav', 'r') as wav:\n    frames = wav.readframes(wav.getnframes())\n    samples = np.frombuffer(frames, dtype=np.int16)\n\n    # LSB analysis of audio samples\n    lsb = samples & 1\n    zeros = np.sum(lsb == 0)\n    ones = np.sum(lsb == 1)\n    total = len(lsb)\n\n    print(f\"Audio LSB Analysis:\")\n    print(f\"  Samples: {total}\")\n    print(f\"  LSB 0s: {zeros} ({zeros\u002Ftotal*100:.1f}%)\")\n    print(f\"  LSB 1s: {ones} ({ones\u002Ftotal*100:.1f}%)\")\n\n    # Extract LSB data\n    lsb_bytes = np.packbits(lsb)\n    with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faudio_lsb.bin', 'wb') as f:\n        f.write(lsb_bytes.tobytes())\n\n    # Chi-square test for randomness\n    from scipy import stats\n    chi2, p_value = stats.chisquare([zeros, ones])\n    print(f\"  Chi-square: {chi2:.4f}, p-value: {p_value:.4f}\")\n    if p_value \u003C 0.05:\n        print(f\"  ANOMALY: LSB distribution is not random (potential stego)\")\nPYEOF\n\n# Use steghide on audio files\nsteghide info \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_audio.wav\n\n# Analyze with sonic-visualiser or audacity for spectral anomalies\n# (Check spectrogram for hidden images encoded in frequency domain)\n```\n\n### Step 5: Generate Steganalysis Report\n\n```bash\n# Compile findings\npython3 \u003C\u003C 'PYEOF'\nimport os, json\n\nreport = {\n    \"case\": \"2024-001\",\n    \"files_analyzed\": [],\n    \"findings\": []\n}\n\nanalysis_dir = '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F'\nfor f in os.listdir(analysis_dir):\n    if f.endswith('.txt'):\n        with open(os.path.join(analysis_dir, f)) as fh:\n            content = fh.read()\n            if 'DETECTED' in content or 'SUCCESS' in content or 'WARNING' in content:\n                report[\"findings\"].append({\n                    \"source\": f,\n                    \"content\": content[:500]\n                })\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteg_report.json', 'w') as f:\n    json.dump(report, f, indent=2)\n\nprint(\"Steganalysis report generated\")\nprint(f\"Total findings: {len(report['findings'])}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LSB (Least Significant Bit) | Embedding data in the lowest-order bits of pixel or sample values |\n| DCT steganography | Hiding data in JPEG discrete cosine transform coefficients |\n| Spread spectrum | Distributing hidden data across the entire carrier signal |\n| Steganalysis | The science of detecting the presence of hidden information |\n| Chi-square attack | Statistical test detecting non-random LSB distributions |\n| Cover medium | The original file used to carry hidden data (image, audio, video) |\n| Stego medium | The resulting file after hidden data has been embedded |\n| Capacity | Maximum amount of data that can be hidden without visible distortion |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| steghide | Embed\u002Fextract data in JPEG, BMP, WAV, AU files |\n| zsteg | Detect LSB steganography in PNG and BMP files |\n| binwalk | Detect embedded files and data within binary files |\n| stegoveritas | Comprehensive steganalysis tool with multiple detection methods |\n| StegSolve | Java GUI tool for image bit plane and filter analysis |\n| OpenStego | Open-source steganography and watermarking tool |\n| ExifTool | Metadata extraction and analysis for media files |\n| stegseek | Fast steghide password cracker for JPEG stego extraction |\n\n## Common Scenarios\n\n**Scenario 1: Covert Communication Investigation**\nExamine images exchanged between suspects via messaging platforms, run stegoveritas and zsteg on all PNG\u002FBMP files, attempt steghide extraction with known passwords on JPEG files, analyze LSB distributions for statistical anomalies, extract and decode any hidden messages.\n\n**Scenario 2: Data Exfiltration via Image Upload**\nMonitor images uploaded to cloud services for unusual file sizes, compare image metadata with expected camera\u002Fdevice profiles, run binwalk to detect embedded archives, analyze JPEG quantization tables for steghide signatures, extract and examine any hidden payloads.\n\n**Scenario 3: Malware Command and Control**\nAnalyze images downloaded by malware for embedded commands, check for data appended after file end markers, examine DNS query responses for base64-encoded data in TXT records, analyze PNG IDAT chunks for anomalous compressed data sizes.\n\n**Scenario 4: Intellectual Property Theft via Audio Files**\nAnalyze audio files for embedded documents in LSB, check spectrograms for visual patterns hidden in frequency domain, compare audio file sizes with expected sizes for bitrate and duration, extract and analyze any hidden data payloads.\n\n## Output Format\n\n```\nSteganalysis Summary:\n  Files Analyzed: 45 (32 images, 8 audio, 5 video)\n\n  Detection Results:\n    suspect_image_03.png:\n      zsteg: Text detected in R channel LSB\n      Content: \"Meet at location B, Tuesday 1400\"\n      Method: LSB embedding in Red channel\n\n    suspect_photo_17.jpg:\n      steghide: Data extracted with password \"secret123\"\n      Hidden file: confidential_report.pdf (234 KB)\n      Method: DCT coefficient modification\n\n    profile_pic.png:\n      binwalk: ZIP archive embedded at offset 45678\n      Contents: 3 spreadsheet files with financial data\n      Method: Data appended after PNG IEND marker\n\n    recording_05.wav:\n      LSB analysis: Non-random distribution (p \u003C 0.001)\n      Extracted: 12 KB binary payload (further analysis needed)\n      Method: Audio LSB embedding\n\n  Clean Files: 41 (no steganographic indicators)\n  Suspicious Files: 4 (data extracted)\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteg_report.json\n```\n",{"name":5,"tags":52,"author":53,"domain":46,"license":15,"version":54,"nist_csf":55,"subdomain":60,"description":7,"mitre_attack":61},[44,29,37,36,42,43],"mahipal","1.0",[56,57,58,59],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[62,63,64,65,66],"T1005","T1074","T1119","T1070","T1059","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-steganography-detection","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-steganography-detection",{"tool":81,"command":82},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-steganography-detection",{"tool":84,"command":85},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-steganography-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-steganography-detection\u002FSKILL.md",true,[89,94,100],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-steganography-detection\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",2345,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-steganography-detection\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",7233,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-steganography-detection\u002Fscripts\u002Fagent.py",[107,145,154,163,185,210],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":128,"publishedAt":47},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[114,117,120,123],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[109,129,130,131,132,133,134,135,30,136,137,138,139,140,141,142,35,34,143,144],"docx","PDF","pptx","xlsx","documents","csv","ocr","Bash","markdown","convert","read","write","edit","html","youtube","with",{"skillNo":146,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":153,"publishedAt":47},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[149,150,151,152],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},[109,129,130,131,132,133,134,135,30,136,137,138,139,140,141,142,35,34,143,144],{"skillNo":155,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":47},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[158,159,160,161],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},[109,129,130,131,132,133,134,135,30,136,137,138,139,140,141,142,35,34,143,144],{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":47},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[170,171,172,173,174,175,176,177,178,179,180,181,182,183,184],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":47},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[191],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[193,194,195,196,197,198,40,199,200,201,202,139,140,203,204,205,206,207,208,209],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":226,"publishedAt":47},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[216,219,222,223],{"categoryNo":217,"categoryName":218,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":220,"categoryName":221,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":224,"categoryName":225,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000036","内容创作者",[227,228,229,230,231,232,233,234,136,235,139,140,141,236,237,238,239,240,184,241],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]