<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-steganography-artifacts
description: >-
  Steganography detection and analysis covering LSB embedding detection,
  statistical steganalysis, image/audio/video payload extraction, and
  covert channel identification. Uses steghide, zsteg, stegsolve,
  binwalk, and Python-based chi-square analysis for forensic
  investigation of hidden data in media files.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - steganography
  - steganalysis
  - lsb-detection
  - steghide
  - zsteg
  - stegsolve
  - covert-channels
  - image-forensics
  - audio-steganography
  - data-hiding
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1027", "T1001.002"]
  nist-csf: ["RS.AN-1", "DE.AE-3"]
  frameworks: ["NIST SP 800-86", "SANS FOR572"]
---

# Analyzing Steganography Artifacts

## Overview

Steganography hides data within ordinary-looking media files (images,
audio, video). Forensic steganalysis detects and extracts hidden payloads
using statistical analysis, visual inspection, and tool-specific extraction.
This skill covers detection techniques for LSB embedding, DCT coefficient
manipulation, appended data, and metadata-based hiding.

## Prerequisites

- `steghide`, `zsteg`, `stegseek`, `stegcracker`
- `exiftool`, `binwalk`, `strings`, `xxd`
- `stegsolve` (Java), `Sonic Visualiser` (audio)
- Python 3.10+ with `Pillow`, `numpy`, `scipy`

```bash
sudo apt install steghide
gem install zsteg
pip install Pillow numpy scipy stegcracker
```

## Key Concepts

### Steganography Techniques

| Technique | Medium | Method | Detection |
|-----------|--------|--------|-----------|
| LSB Embedding | PNG, BMP | Modify least significant bits | Chi-square, visual |
| DCT Manipulation | JPEG | Modify DCT coefficients | Histogram analysis |
| Appended Data | Any | Data after EOF marker | binwalk, file size |
| Metadata Hiding | JPEG, PNG | EXIF/comment fields | exiftool inspection |
| Audio LSB | WAV, FLAC | Modify audio sample LSBs | Spectral analysis |
| Whitespace | Text | Spaces/tabs encode bits | Character frequency |

### Detection Indicators

| Indicator | Significance |
|-----------|-------------|
| File larger than expected for content | Possible embedded payload |
| Unusual LSB distribution (chi-square) | LSB embedding detected |
| Data after EOF marker (JPEG FFD9, PNG IEND) | Appended hidden data |
| Abnormal EXIF/comment field sizes | Metadata hiding |
| Statistical anomalies in histogram | DCT coefficient manipulation |

## Workflow

### Step 1: Initial Triage

```bash
# File type verification
file suspect_image.*
exiftool suspect_image.jpg | head -30

# Check file size vs expected (compare to similar images)
ls -la suspect_image.jpg
identify suspect_image.jpg  # ImageMagick — dimensions and depth

# Look for appended data after EOF
binwalk suspect_image.jpg
# If binwalk finds data after the image end marker, extraction likely

# Strings analysis for hidden text
strings -n 8 suspect_image.jpg | tail -50
strings -e l suspect_image.jpg  # Little-endian Unicode

# Hex dump of file tail (look for data after EOF)
xxd suspect_image.jpg | tail -30
# JPEG ends with FF D9, PNG ends with IEND chunk
```

### Step 2: zsteg — PNG/BMP LSB Analysis

```bash
# Comprehensive LSB scan (PNG and BMP only)
zsteg suspect_image.png

# Specific bit planes
zsteg -b 1 suspect_image.png      # LSB only
zsteg -b 1,2 suspect_image.png    # First 2 bits

# All channels and bit orders
zsteg -a suspect_image.png

# Extract specific payload
zsteg -E "b1,rgb,lsb" suspect_image.png > extracted_payload.bin
```

### Step 3: steghide — JPEG/WAV/BMP/AU Extraction

```bash
# Attempt extraction with empty passphrase
steghide extract -sf suspect_image.jpg -f
# Prompted for passphrase — try empty first

# Extract with known passphrase
steghide extract -sf suspect_image.jpg -p "password" -xf extracted.bin

# Get embedded file info
steghide info suspect_image.jpg

# Brute-force passphrase with stegseek (fast)
stegseek suspect_image.jpg /usr/share/wordlists/rockyou.txt

# Alternative: stegcracker
stegcracker suspect_image.jpg /usr/share/wordlists/rockyou.txt
```

### Step 4: Statistical Steganalysis

```python
#!/usr/bin/env python3
"""Chi-square analysis for LSB steganography detection."""
import numpy as np
from PIL import Image
from scipy import stats

img = Image.open("suspect_image.png")
pixels = np.array(img).flatten()

# Chi-square test on LSB distribution
# Even/odd value pair frequencies should be roughly equal
# in natural images but diverge with LSB embedding
pairs = pixels.reshape(-1, 2)
even_counts = np.sum(pairs[:, 0] % 2 == 0)
odd_counts = np.sum(pairs[:, 0] % 2 == 1)

chi2, p_value = stats.chisquare([even_counts, odd_counts])
print(f"Chi-square: {chi2:.4f}")
print(f"P-value: {p_value:.6f}")

if p_value > 0.95:
    print("ALERT: High probability of LSB steganography")
elif p_value > 0.5:
    print("WARNING: Possible LSB steganography")
else:
    print("OK: No LSB steganography detected")
```

### Step 5: Audio Steganography Detection

```bash
# Spectral analysis with SoX
sox suspect_audio.wav -n spectrogram -o spectrogram.png
# Visual inspection for hidden images in spectrogram

# LSB analysis of WAV samples
python3 -c "
import wave, struct
with wave.open('suspect_audio.wav', 'rb') as w:
    frames = w.readframes(w.getnframes())
    samples = struct.unpack(f'<{len(frames)//2}h', frames)
    lsb_bits = [s & 1 for s in samples[:1000]]
    # Convert LSBs to bytes
    byte_str = bytes(
        int(''.join(str(b) for b in lsb_bits[i:i+8]), 2)
        for i in range(0, len(lsb_bits) - 7, 8)
    )
    print('LSB extracted bytes:', byte_str[:100])
"

# steghide on WAV
steghide extract -sf suspect_audio.wav -f
```

### Step 6: Bulk Steganalysis

```bash
# Scan directory of images for steganography indicators
for img in /evidence/images/*.png; do
  echo "=== $img ==="
  zsteg "$img" 2>/dev/null | head -5
done

for img in /evidence/images/*.jpg; do
  echo "=== $img ==="
  steghide info "$img" 2>&1 | head -3
  binwalk "$img" | grep -v "^$" | tail -5
done
```

## Detection

```yaml
title: Steganography Artifacts Detection
id: edbbf637-c90d-4e86-ab68-ca6cc052d421
status: experimental
description: Detects suspicious activity related to analyzing steganography artifacts techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*steganography*"
  condition: selection
level: medium
tags:
  - attack.t1027
  - attack.t1001.002
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] File type and integrity verified
- [ ] EOF analysis completed (appended data check)
- [ ] LSB statistical analysis performed
- [ ] Tool-based extraction attempted (steghide, zsteg)
- [ ] Passphrase brute-force attempted with common wordlists
- [ ] Audio spectral analysis completed (if applicable)
- [ ] All extracted payloads hashed and documented
- [ ] False positive assessment documented

## References

- [steghide](https://steghide.sourceforge.net/)
- [zsteg — PNG/BMP LSB Steganography](https://github.com/zed-0xff/zsteg)
- [stegseek — Fast Steghide Cracker](https://github.com/RickdeJager/stegseek)
- [StegSolve — Image Analysis](https://github.com/Giotino/stegsolve)
- [SANS — Steganography Detection](https://www.sans.org/)
- [Chi-Square Steganalysis — Westfeld & Pfitzmann](https://doi.org/10.1007/3-540-36415-3_1)
