[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FAD5T0THYAPX6XFM10Q3B":3,"skill-same:01M71FAD5T0THYAPX6XFM10Q3B":96},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M71FAD5T0THYAPX6XFM10Q3B","technique-steganography-detect",null,"Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Ftechnique\u002Fsteganography\u002Fdetect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"steganography","detect","technique steganography detect","Tools","digital-forensics","data","read","image-analysis","de","uncover","communication","covert-channels","analysis","Bash","image","cybersecurity","files","Audio","Media","images","2026-11-10 10:12:30",false,"---\nname: technique-steganography-detect\ndescription: Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- steganography\n- steganalysis\n- hidden-data\n- covert-channels\n- image-analysis\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1027.003\n- T1041\n- T1059\ncapec: []\n---\n\n# Performing Steganography Detection\n\n## When to Use\n- When suspecting covert data hiding in images, audio, or video files\n- During investigations involving suspected data exfiltration via media files\n- For analyzing files in espionage or insider threat investigations\n- When standard file analysis reveals anomalies in media file properties\n- For detecting communication channels using steganographic techniques\n\n## Prerequisites\n- StegDetect, zsteg, stegsolve, binwalk for analysis\n- steghide, OpenStego for extraction attempts\n- ExifTool for metadata analysis\n- Python with Pillow, numpy for custom analysis\n- Understanding of common steganographic techniques (LSB, DCT, spread spectrum)\n- Sample files for comparison and statistical analysis\n\n## Workflow\n\n### Step 1: Initial File Assessment and Metadata Analysis\n\n```bash\n# Install steganography detection tools\nsudo apt-get install steghide stegsnow\npip install zsteg\npip install stegoveritas\ngem install zsteg  # Ruby-based tool for PNG\u002FBMP\n\n# Examine file metadata for anomalies\nexiftool \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmetadata.txt\n\n# Check for unusual file size (larger than expected for resolution\u002Fformat)\nidentify -verbose \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | head -30\n\n# Verify file type matches extension\nfile \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg\n# Confirm JPEG signature vs actual content\n\n# Check for appended data after file footer\npython3 \u003C\u003C 'PYEOF'\nimport os\n\nfilepath = '\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg'\nfilesize = os.path.getsize(filepath)\n\nwith open(filepath, 'rb') as f:\n    data = f.read()\n\n# JPEG files end with FF D9\njpeg_end = data.rfind(b'\\xff\\xd9')\nif jpeg_end > 0:\n    trailing_bytes = filesize - jpeg_end - 2\n    if trailing_bytes > 0:\n        print(f\"WARNING: {trailing_bytes} bytes of data after JPEG end marker!\")\n        print(f\"  File size: {filesize} bytes\")\n        print(f\"  JPEG data: {jpeg_end + 2} bytes\")\n        print(f\"  Hidden data: {trailing_bytes} bytes\")\n        # Extract trailing data\n        with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ftrailing_data.bin', 'wb') as out:\n            out.write(data[jpeg_end + 2:])\n    else:\n        print(\"No trailing data detected after JPEG end marker\")\n\n# Check for embedded ZIP\u002FRAR archives\nzip_offset = data.find(b'PK\\x03\\x04')\nrar_offset = data.find(b'Rar!\\x1a\\x07')\nif zip_offset > 0:\n    print(f\"ZIP archive found at offset {zip_offset}\")\nif rar_offset > 0:\n    print(f\"RAR archive found at offset {rar_offset}\")\nPYEOF\n```\n\n### Step 2: Run Automated Steganalysis Tools\n\n```bash\n# Use binwalk to detect embedded files and data\nbinwalk \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbinwalk_scan.txt\n\n# Extract embedded files\nbinwalk --extract --directory \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbinwalk_extracted\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg\n\n# Use zsteg for PNG and BMP analysis (LSB detection)\nzsteg \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fzsteg_results.txt\n\n# zsteg with all checks\nzsteg -a \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png\n\n# Use stegoveritas for comprehensive analysis\nstegoveritas \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg \\\n   -out \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstegoveritas\u002F\n\n# Stegoveritas performs:\n# - Metadata extraction\n# - LSB analysis (multiple bit planes)\n# - Color map analysis\n# - Trailing data detection\n# - Embedded file extraction\n# - Image transformation analysis\n\n# Use steghide for JPEG\u002FBMP\u002FWAV\u002FAU extraction attempts\n# Try with empty password\nsteghide extract -sf \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg -p \"\" \\\n   -xf \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteghide_extract.bin 2>&1\n\n# Try with common passwords\nfor pwd in password secret hidden stego test 123456 admin; do\n    result=$(steghide extract -sf \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg \\\n       -p \"$pwd\" -xf \"\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteghide_$pwd.bin\" 2>&1)\n    if echo \"$result\" | grep -q \"extracted\"; then\n        echo \"SUCCESS with password: $pwd\"\n    fi\ndone\n```\n\n### Step 3: Perform LSB (Least Significant Bit) Analysis\n\n```bash\n# Custom LSB analysis with Python\npython3 \u003C\u003C 'PYEOF'\nfrom PIL import Image\nimport numpy as np\n\nimg = Image.open('\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png')\npixels = np.array(img)\n\n# Extract LSB from each color channel\nfor channel, name in enumerate(['Red', 'Green', 'Blue']):\n    if channel >= pixels.shape[2]:\n        break\n\n    lsb_data = pixels[:, :, channel] & 1\n\n    # Count distribution (should be ~50\u002F50 for natural images)\n    zeros = np.sum(lsb_data == 0)\n    ones = np.sum(lsb_data == 1)\n    total = zeros + ones\n    ratio = ones \u002F total\n\n    print(f\"{name} channel LSB: 0s={zeros} ({zeros\u002Ftotal*100:.1f}%), 1s={ones} ({ones\u002Ftotal*100:.1f}%)\")\n    if abs(ratio - 0.5) \u003C 0.01:\n        print(f\"  NEUTRAL - Close to random (could be stego or natural)\")\n    elif ratio > 0.55 or ratio \u003C 0.45:\n        print(f\"  ANOMALY - Significant deviation from expected distribution\")\n\n# Extract LSB data as bytes\nlsb_bits = (pixels[:, :, 0] & 1).flatten()\nlsb_bytes = np.packbits(lsb_bits)\n\n# Check if extracted data has structure\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsb_extracted.bin', 'wb') as f:\n    f.write(lsb_bytes.tobytes())\n\n# Check for known file signatures in extracted data\nimport struct\nheader = bytes(lsb_bytes[:16])\nprint(f\"\\nLSB extracted header (hex): {header.hex()}\")\nif header[:4] == b'PK\\x03\\x04':\n    print(\"  DETECTED: ZIP archive in LSB data!\")\nelif header[:3] == b'GIF':\n    print(\"  DETECTED: GIF image in LSB data!\")\nelif header[:4] == b'\\x89PNG':\n    print(\"  DETECTED: PNG image in LSB data!\")\nelif header[:2] == b'\\xff\\xd8':\n    print(\"  DETECTED: JPEG image in LSB data!\")\n\n# Generate LSB visualization\nlsb_img = Image.fromarray((lsb_data * 255).astype(np.uint8))\nlsb_img.save('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsb_visualization.png')\nprint(\"\\nLSB visualization saved to lsb_visualization.png\")\nPYEOF\n```\n\n### Step 4: Analyze Audio and Video Steganography\n\n```bash\n# Spectral analysis of audio files\npython3 \u003C\u003C 'PYEOF'\nimport wave\nimport numpy as np\n\n# Analyze WAV file for audio steganography\nwith wave.open('\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_audio.wav', 'r') as wav:\n    frames = wav.readframes(wav.getnframes())\n    samples = np.frombuffer(frames, dtype=np.int16)\n\n    # LSB analysis of audio samples\n    lsb = samples & 1\n    zeros = np.sum(lsb == 0)\n    ones = np.sum(lsb == 1)\n    total = len(lsb)\n\n    print(f\"Audio LSB Analysis:\")\n    print(f\"  Samples: {total}\")\n    print(f\"  LSB 0s: {zeros} ({zeros\u002Ftotal*100:.1f}%)\")\n    print(f\"  LSB 1s: {ones} ({ones\u002Ftotal*100:.1f}%)\")\n\n    # Extract LSB data\n    lsb_bytes = np.packbits(lsb)\n    with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faudio_lsb.bin', 'wb') as f:\n        f.write(lsb_bytes.tobytes())\n\n    # Chi-square test for randomness\n    from scipy import stats\n    chi2, p_value = stats.chisquare([zeros, ones])\n    print(f\"  Chi-square: {chi2:.4f}, p-value: {p_value:.4f}\")\n    if p_value \u003C 0.05:\n        print(f\"  ANOMALY: LSB distribution is not random (potential stego)\")\nPYEOF\n\n# Use steghide on audio files\nsteghide info \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_audio.wav\n\n# Analyze with sonic-visualiser or audacity for spectral anomalies\n# (Check spectrogram for hidden images encoded in frequency domain)\n```\n\n### Step 5: Generate Steganalysis Report\n\n```bash\n# Compile findings\npython3 \u003C\u003C 'PYEOF'\nimport os, json\n\nreport = {\n    \"case\": \"2024-001\",\n    \"files_analyzed\": [],\n    \"findings\": []\n}\n\nanalysis_dir = '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F'\nfor f in os.listdir(analysis_dir):\n    if f.endswith('.txt'):\n        with open(os.path.join(analysis_dir, f)) as fh:\n            content = fh.read()\n            if 'DETECTED' in content or 'SUCCESS' in content or 'WARNING' in content:\n                report[\"findings\"].append({\n                    \"source\": f,\n                    \"content\": content[:500]\n                })\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteg_report.json', 'w') as f:\n    json.dump(report, f, indent=2)\n\nprint(\"Steganalysis report generated\")\nprint(f\"Total findings: {len(report['findings'])}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LSB (Least Significant Bit) | Embedding data in the lowest-order bits of pixel or sample values |\n| DCT steganography | Hiding data in JPEG discrete cosine transform coefficients |\n| Spread spectrum | Distributing hidden data across the entire carrier signal |\n| Steganalysis | The science of detecting the presence of hidden information |\n| Chi-square attack | Statistical test detecting non-random LSB distributions |\n| Cover medium | The original file used to carry hidden data (image, audio, video) |\n| Stego medium | The resulting file after hidden data has been embedded |\n| Capacity | Maximum amount of data that can be hidden without visible distortion |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| steghide | Embed\u002Fextract data in JPEG, BMP, WAV, AU files |\n| zsteg | Detect LSB steganography in PNG and BMP files |\n| binwalk | Detect embedded files and data within binary files |\n| stegoveritas | Comprehensive steganalysis tool with multiple detection methods |\n| StegSolve | Java GUI tool for image bit plane and filter analysis |\n| OpenStego | Open-source steganography and watermarking tool |\n| ExifTool | Metadata extraction and analysis for media files |\n| stegseek | Fast steghide password cracker for JPEG stego extraction |\n\n## Common Scenarios\n\n**Scenario 1: Covert Communication Investigation**\nExamine images exchanged between suspects via messaging platforms, run stegoveritas and zsteg on all PNG\u002FBMP files, attempt steghide extraction with known passwords on JPEG files, analyze LSB distributions for statistical anomalies, extract and decode any hidden messages.\n\n**Scenario 2: Data Exfiltration via Image Upload**\nMonitor images uploaded to cloud services for unusual file sizes, compare image metadata with expected camera\u002Fdevice profiles, run binwalk to detect embedded archives, analyze JPEG quantization tables for steghide signatures, extract and examine any hidden payloads.\n\n**Scenario 3: Malware Command and Control**\nAnalyze images downloaded by malware for embedded commands, check for data appended after file end markers, examine DNS query responses for base64-encoded data in TXT records, analyze PNG IDAT chunks for anomalous compressed data sizes.\n\n**Scenario 4: Intellectual Property Theft via Audio Files**\nAnalyze audio files for embedded documents in LSB, check spectrograms for visual patterns hidden in frequency domain, compare audio file sizes with expected sizes for bitrate and duration, extract and analyze any hidden data payloads.\n\n## Output Format\n\n```\nSteganalysis Summary:\n  Files Analyzed: 45 (32 images, 8 audio, 5 video)\n\n  Detection Results:\n    suspect_image_03.png:\n      zsteg: Text detected in R channel LSB\n      Content: \"Meet at location B, Tuesday 1400\"\n      Method: LSB embedding in Red channel\n\n    suspect_photo_17.jpg:\n      steghide: Data extracted with password \"secret123\"\n      Hidden file: confidential_report.pdf (234 KB)\n      Method: DCT coefficient modification\n\n    profile_pic.png:\n      binwalk: ZIP archive embedded at offset 45678\n      Contents: 3 spreadsheet files with financial data\n      Method: Data appended after PNG IEND marker\n\n    recording_05.wav:\n      LSB analysis: Non-random distribution (p \u003C 0.001)\n      Extracted: 12 KB binary payload (further analysis needed)\n      Method: Audio LSB embedding\n\n  Clean Files: 41 (no steganographic indicators)\n  Suspicious Files: 4 (data extracted)\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteg_report.json\n```\n","# Performing Steganography Detection\n\n## When to Use\n- When suspecting covert data hiding in images, audio, or video files\n- During investigations involving suspected data exfiltration via media files\n- For analyzing files in espionage or insider threat investigations\n- When standard file analysis reveals anomalies in media file properties\n- For detecting communication channels using steganographic techniques\n\n## Prerequisites\n- StegDetect, zsteg, stegsolve, binwalk for analysis\n- steghide, OpenStego for extraction attempts\n- ExifTool for metadata analysis\n- Python with Pillow, numpy for custom analysis\n- Understanding of common steganographic techniques (LSB, DCT, spread spectrum)\n- Sample files for comparison and statistical analysis\n\n## Workflow\n\n### Step 1: Initial File Assessment and Metadata Analysis\n\n```bash\n# Install steganography detection tools\nsudo apt-get install steghide stegsnow\npip install zsteg\npip install stegoveritas\ngem install zsteg  # Ruby-based tool for PNG\u002FBMP\n\n# Examine file metadata for anomalies\nexiftool \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmetadata.txt\n\n# Check for unusual file size (larger than expected for resolution\u002Fformat)\nidentify -verbose \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | head -30\n\n# Verify file type matches extension\nfile \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg\n# Confirm JPEG signature vs actual content\n\n# Check for appended data after file footer\npython3 \u003C\u003C 'PYEOF'\nimport os\n\nfilepath = '\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg'\nfilesize = os.path.getsize(filepath)\n\nwith open(filepath, 'rb') as f:\n    data = f.read()\n\n# JPEG files end with FF D9\njpeg_end = data.rfind(b'\\xff\\xd9')\nif jpeg_end > 0:\n    trailing_bytes = filesize - jpeg_end - 2\n    if trailing_bytes > 0:\n        print(f\"WARNING: {trailing_bytes} bytes of data after JPEG end marker!\")\n        print(f\"  File size: {filesize} bytes\")\n        print(f\"  JPEG data: {jpeg_end + 2} bytes\")\n        print(f\"  Hidden data: {trailing_bytes} bytes\")\n        # Extract trailing data\n        with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Ftrailing_data.bin', 'wb') as out:\n            out.write(data[jpeg_end + 2:])\n    else:\n        print(\"No trailing data detected after JPEG end marker\")\n\n# Check for embedded ZIP\u002FRAR archives\nzip_offset = data.find(b'PK\\x03\\x04')\nrar_offset = data.find(b'Rar!\\x1a\\x07')\nif zip_offset > 0:\n    print(f\"ZIP archive found at offset {zip_offset}\")\nif rar_offset > 0:\n    print(f\"RAR archive found at offset {rar_offset}\")\nPYEOF\n```\n\n### Step 2: Run Automated Steganalysis Tools\n\n```bash\n# Use binwalk to detect embedded files and data\nbinwalk \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbinwalk_scan.txt\n\n# Extract embedded files\nbinwalk --extract --directory \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fbinwalk_extracted\u002F \\\n   \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg\n\n# Use zsteg for PNG and BMP analysis (LSB detection)\nzsteg \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fzsteg_results.txt\n\n# zsteg with all checks\nzsteg -a \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png\n\n# Use stegoveritas for comprehensive analysis\nstegoveritas \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg \\\n   -out \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstegoveritas\u002F\n\n# Stegoveritas performs:\n# - Metadata extraction\n# - LSB analysis (multiple bit planes)\n# - Color map analysis\n# - Trailing data detection\n# - Embedded file extraction\n# - Image transformation analysis\n\n# Use steghide for JPEG\u002FBMP\u002FWAV\u002FAU extraction attempts\n# Try with empty password\nsteghide extract -sf \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg -p \"\" \\\n   -xf \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteghide_extract.bin 2>&1\n\n# Try with common passwords\nfor pwd in password secret hidden stego test 123456 admin; do\n    result=$(steghide extract -sf \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.jpg \\\n       -p \"$pwd\" -xf \"\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteghide_$pwd.bin\" 2>&1)\n    if echo \"$result\" | grep -q \"extracted\"; then\n        echo \"SUCCESS with password: $pwd\"\n    fi\ndone\n```\n\n### Step 3: Perform LSB (Least Significant Bit) Analysis\n\n```bash\n# Custom LSB analysis with Python\npython3 \u003C\u003C 'PYEOF'\nfrom PIL import Image\nimport numpy as np\n\nimg = Image.open('\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_image.png')\npixels = np.array(img)\n\n# Extract LSB from each color channel\nfor channel, name in enumerate(['Red', 'Green', 'Blue']):\n    if channel >= pixels.shape[2]:\n        break\n\n    lsb_data = pixels[:, :, channel] & 1\n\n    # Count distribution (should be ~50\u002F50 for natural images)\n    zeros = np.sum(lsb_data == 0)\n    ones = np.sum(lsb_data == 1)\n    total = zeros + ones\n    ratio = ones \u002F total\n\n    print(f\"{name} channel LSB: 0s={zeros} ({zeros\u002Ftotal*100:.1f}%), 1s={ones} ({ones\u002Ftotal*100:.1f}%)\")\n    if abs(ratio - 0.5) \u003C 0.01:\n        print(f\"  NEUTRAL - Close to random (could be stego or natural)\")\n    elif ratio > 0.55 or ratio \u003C 0.45:\n        print(f\"  ANOMALY - Significant deviation from expected distribution\")\n\n# Extract LSB data as bytes\nlsb_bits = (pixels[:, :, 0] & 1).flatten()\nlsb_bytes = np.packbits(lsb_bits)\n\n# Check if extracted data has structure\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsb_extracted.bin', 'wb') as f:\n    f.write(lsb_bytes.tobytes())\n\n# Check for known file signatures in extracted data\nimport struct\nheader = bytes(lsb_bytes[:16])\nprint(f\"\\nLSB extracted header (hex): {header.hex()}\")\nif header[:4] == b'PK\\x03\\x04':\n    print(\"  DETECTED: ZIP archive in LSB data!\")\nelif header[:3] == b'GIF':\n    print(\"  DETECTED: GIF image in LSB data!\")\nelif header[:4] == b'\\x89PNG':\n    print(\"  DETECTED: PNG image in LSB data!\")\nelif header[:2] == b'\\xff\\xd8':\n    print(\"  DETECTED: JPEG image in LSB data!\")\n\n# Generate LSB visualization\nlsb_img = Image.fromarray((lsb_data * 255).astype(np.uint8))\nlsb_img.save('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flsb_visualization.png')\nprint(\"\\nLSB visualization saved to lsb_visualization.png\")\nPYEOF\n```\n\n### Step 4: Analyze Audio and Video Steganography\n\n```bash\n# Spectral analysis of audio files\npython3 \u003C\u003C 'PYEOF'\nimport wave\nimport numpy as np\n\n# Analyze WAV file for audio steganography\nwith wave.open('\u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_audio.wav', 'r') as wav:\n    frames = wav.readframes(wav.getnframes())\n    samples = np.frombuffer(frames, dtype=np.int16)\n\n    # LSB analysis of audio samples\n    lsb = samples & 1\n    zeros = np.sum(lsb == 0)\n    ones = np.sum(lsb == 1)\n    total = len(lsb)\n\n    print(f\"Audio LSB Analysis:\")\n    print(f\"  Samples: {total}\")\n    print(f\"  LSB 0s: {zeros} ({zeros\u002Ftotal*100:.1f}%)\")\n    print(f\"  LSB 1s: {ones} ({ones\u002Ftotal*100:.1f}%)\")\n\n    # Extract LSB data\n    lsb_bytes = np.packbits(lsb)\n    with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faudio_lsb.bin', 'wb') as f:\n        f.write(lsb_bytes.tobytes())\n\n    # Chi-square test for randomness\n    from scipy import stats\n    chi2, p_value = stats.chisquare([zeros, ones])\n    print(f\"  Chi-square: {chi2:.4f}, p-value: {p_value:.4f}\")\n    if p_value \u003C 0.05:\n        print(f\"  ANOMALY: LSB distribution is not random (potential stego)\")\nPYEOF\n\n# Use steghide on audio files\nsteghide info \u002Fcases\u002Fcase-2024-001\u002Fmedia\u002Fsuspect_audio.wav\n\n# Analyze with sonic-visualiser or audacity for spectral anomalies\n# (Check spectrogram for hidden images encoded in frequency domain)\n```\n\n### Step 5: Generate Steganalysis Report\n\n```bash\n# Compile findings\npython3 \u003C\u003C 'PYEOF'\nimport os, json\n\nreport = {\n    \"case\": \"2024-001\",\n    \"files_analyzed\": [],\n    \"findings\": []\n}\n\nanalysis_dir = '\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002F'\nfor f in os.listdir(analysis_dir):\n    if f.endswith('.txt'):\n        with open(os.path.join(analysis_dir, f)) as fh:\n            content = fh.read()\n            if 'DETECTED' in content or 'SUCCESS' in content or 'WARNING' in content:\n                report[\"findings\"].append({\n                    \"source\": f,\n                    \"content\": content[:500]\n                })\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteg_report.json', 'w') as f:\n    json.dump(report, f, indent=2)\n\nprint(\"Steganalysis report generated\")\nprint(f\"Total findings: {len(report['findings'])}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LSB (Least Significant Bit) | Embedding data in the lowest-order bits of pixel or sample values |\n| DCT steganography | Hiding data in JPEG discrete cosine transform coefficients |\n| Spread spectrum | Distributing hidden data across the entire carrier signal |\n| Steganalysis | The science of detecting the presence of hidden information |\n| Chi-square attack | Statistical test detecting non-random LSB distributions |\n| Cover medium | The original file used to carry hidden data (image, audio, video) |\n| Stego medium | The resulting file after hidden data has been embedded |\n| Capacity | Maximum amount of data that can be hidden without visible distortion |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| steghide | Embed\u002Fextract data in JPEG, BMP, WAV, AU files |\n| zsteg | Detect LSB steganography in PNG and BMP files |\n| binwalk | Detect embedded files and data within binary files |\n| stegoveritas | Comprehensive steganalysis tool with multiple detection methods |\n| StegSolve | Java GUI tool for image bit plane and filter analysis |\n| OpenStego | Open-source steganography and watermarking tool |\n| ExifTool | Metadata extraction and analysis for media files |\n| stegseek | Fast steghide password cracker for JPEG stego extraction |\n\n## Common Scenarios\n\n**Scenario 1: Covert Communication Investigation**\nExamine images exchanged between suspects via messaging platforms, run stegoveritas and zsteg on all PNG\u002FBMP files, attempt steghide extraction with known passwords on JPEG files, analyze LSB distributions for statistical anomalies, extract and decode any hidden messages.\n\n**Scenario 2: Data Exfiltration via Image Upload**\nMonitor images uploaded to cloud services for unusual file sizes, compare image metadata with expected camera\u002Fdevice profiles, run binwalk to detect embedded archives, analyze JPEG quantization tables for steghide signatures, extract and examine any hidden payloads.\n\n**Scenario 3: Malware Command and Control**\nAnalyze images downloaded by malware for embedded commands, check for data appended after file end markers, examine DNS query responses for base64-encoded data in TXT records, analyze PNG IDAT chunks for anomalous compressed data sizes.\n\n**Scenario 4: Intellectual Property Theft via Audio Files**\nAnalyze audio files for embedded documents in LSB, check spectrograms for visual patterns hidden in frequency domain, compare audio file sizes with expected sizes for bitrate and duration, extract and analyze any hidden data payloads.\n\n## Output Format\n\n```\nSteganalysis Summary:\n  Files Analyzed: 45 (32 images, 8 audio, 5 video)\n\n  Detection Results:\n    suspect_image_03.png:\n      zsteg: Text detected in R channel LSB\n      Content: \"Meet at location B, Tuesday 1400\"\n      Method: LSB embedding in Red channel\n\n    suspect_photo_17.jpg:\n      steghide: Data extracted with password \"secret123\"\n      Hidden file: confidential_report.pdf (234 KB)\n      Method: DCT coefficient modification\n\n    profile_pic.png:\n      binwalk: ZIP archive embedded at offset 45678\n      Contents: 3 spreadsheet files with financial data\n      Method: Data appended after PNG IEND marker\n\n    recording_05.wav:\n      LSB analysis: Non-random distribution (p \u003C 0.001)\n      Extracted: 12 KB binary payload (further analysis needed)\n      Method: Audio LSB embedding\n\n  Clean Files: 41 (no steganographic indicators)\n  Suspicious Files: 4 (data extracted)\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fsteg_report.json\n```\n",{"name":5,"tags":49,"capec":53,"model":54,"tools":55,"domain":39,"maxTurns":59,"nist_csf":60,"subdomain":28,"description":7,"mitre_attack":65},[50,24,51,52,35,31],"forensics","steganalysis","hidden-data",[],"sonnet",[56,37,57,58],"Read","Glob","Grep",20,[61,62,63,64],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01",[66,67,68],"T1027.003","T1041","T1059","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Ftechnique\u002Fsteganography\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill technique-steganography-detect",{"tool":82,"command":83},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill technique-steganography-detect",{"tool":85,"command":86},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill technique-steganography-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Ftechnique\u002Fsteganography\u002Fdetect\u002FSKILL.md",true,[90],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"index.json","REFERENCE","参考文档",651,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Ftechnique\u002Fsteganography\u002Fdetect\u002Findex.json",[97,119,139,158,180,196],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[104,25,105,106,107,32,108,109,110,111,112,113,114,115,116,117,50,39,118],"services","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","process-forensics",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[126,104,127,106,128,129,130,39,37,36,131,132,133,134,32,135,136,30,137,138],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[146,147,148,149,150,151,39,37,152,36,153,33,32,30,154,155,28,156,157,54],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","software","activity","windows-registry","regripper",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[25,165,166,167,168,169,170,108,171,39,118,172,173,174,175,176,177,178,179,32],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[187,188,25,189,167,169,190,108,191,171,39,118,36,192,193,194,195,179,32,109],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[203,25,167,204,190,108,205,206,39,118,207,208,38,209,210,211,32,109,212,213],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","pe-header","in memory","with","mismatched","headers"]