Anti-Forensics
Clear Browser Artifacts
Clear Command History
Clear Operating System Logs
Decrease Privileges
Delete User Account
Deletion of Volume Shadow Copy
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Log Tampering
Modify Windows Registry
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Steganography
System Shutdown
Timestomping
Tripwires
Uninstalling Software
Use of a Virtual Machine
- ID: AF008.001
- Created: 10th February 2025
- Updated: 10th February 2025
- Platforms: Windows, Linux, MacOS, iOS, Android,
- Contributor: The ITM Team
Image Steganography
A subject uses image steganography to hide data in an image, to exfiltrate that data and to hide the act of exfiltration.
Image steganography methods can be categorised based on how data is embedded within an image. These methods vary in capacity (amount of data stored), detectability (resistance to steganalysis), and robustness (resistance to compression or modification). Below are the primary techniques used:
Least Significant Bit (LSB) Steganography
- One of the most common and simple methods.
- Modifies the least significant bits (LSBs) of pixel values to encode secret data.
- Minimal visual impact since changes occur in the lowest bit planes.
How it works:
- Each pixel in an image consists of three color channels (Red, Green, and Blue).
- The LSB of each channel is replaced with bits from the hidden message.
Example:
- Original pixel: (10101100, 11011010, 11101101)
- After encoding: (10101101, 11011010, 11101100)
- Only minor changes, making detection difficult.
Advantages:
- High capacity when applied to all three channels.
- Simple and easy to implement.
Disadvantages:
- Highly susceptible to detection and compression (JPEG compression removes LSB changes).
- Easily detected by statistical analysis methods.
Masking and Filtering Steganography
- Works similarly to watermarking by altering the luminance or contrast of an image.
- Best suited for lossless formats like BMP and PNG, not JPEG.
How it works:
- Hidden data is embedded in textured or edge-rich areas to avoid easy detection.
- Modifies pixel intensity slightly, making it harder to detect through simple LSB analysis.
Advantages:
- More robust than LSB against lossy compression and scaling.
- Works well for grayscale and color images.
Disadvantages:
- Lower capacity than LSB.
- More complex to implement.
Transform Domain Steganography
- Instead of modifying pixel values directly, this technique embeds data in frequency components after applying a mathematical transformation.
Types of Transform Domain Methods:
a. Discrete Cosine Transform (DCT) Steganography
- Used in JPEG images, where data is embedded in DCT coefficients instead of pixels.
- Common algorithm: F5 steganography (JSteg is an older, less secure method).
How it works:
- The image is converted to frequency domain using DCT.
- The hidden data is embedded in the mid-frequency DCT coefficients to avoid detection.
- The image is recompressed using JPEG encoding.
Advantages:
- Resistant to LSB steganalysis.
- Works with JPEG, making it more practical.
Disadvantages:
- Lower data capacity than LSB.
- Can be detected by statistical steganalysis.
b. Discrete Wavelet Transform (DWT) Steganography
- Uses wavelet transformation to embed data in high or low-frequency components.
How it works:
- The image is broken into multiple frequency bands using DWT.
- Data is embedded in high-frequency coefficients, ensuring robustness.
- Common in medical image steganography for secure data transmission.
Advantages:
- More robust against compression and noise than DCT.
- Can embed more data than traditional DCT methods.
Disadvantages:
- Requires more complex computation.
- Can be detected by advanced steganalysis tools.
c. Fourier Transform-Based Steganography
- Uses Fast Fourier Transform (FFT) to embed secret data in the frequency spectrum.
- More resistant to image processing operations like scaling and rotation.
Advantages:
- High robustness.
- Harder to detect using common LSB-based analysis.
Disadvantages:
- Requires complex processing.
- Limited in data capacity.
Palette-Based and Color Modification Techniques
a. Palette-Based Steganography (GIF, PNG)
- Modifies indexed color tables instead of pixels.
- Works by shifting palette entries in GIF or PNG images.
Advantages:
- No direct pixel modifications, making it hard to detect visually.
Disadvantages:
- Can be detected by comparing original and modified color palettes.
- Limited to certain file formats.
b. Alpha Channel Manipulation
- Uses transparency layers in images (e.g., PNG with alpha channels) to store hidden data.
Advantages:
- Harder to detect in images with multiple layers.
Disadvantages:
- Only works in formats supporting alpha transparency (PNG, TIFF).
Edge-Based and Texture-Based Steganography
a. Edge Detection Steganography
- Embeds data only in edge regions of an image, avoiding smooth areas.
- Uses Canny edge detection or similar algorithms.
Advantages:
- Harder to detect using basic LSB analysis.
- Can withstand minor modifications.
Disadvantages:
- Requires pre-processing.
- Lower capacity than LSB.
b. Patchwork Algorithm
- Uses redundant patterns to embed data, making detection harder.
- Works well for texture-rich images.
Advantages:
- High resistance to compression and cropping.
Disadvantages:
- Complex encoding and decoding process.
Spread Spectrum and Noise-Based Techniques
a. Spread Spectrum Steganography
- Mimics radio communication techniques, distributing data across the entire image.
- Uses pseudo-random noise patterns to hide data.
Advantages:
- Harder to detect due to randomness.
Disadvantages:
- Lower data capacity.
b. Statistical Steganography
- Alters color distributions or histogram properties to encode data.
- Ensures changes remain within natural variations.
Advantages:
- Very stealthy and hard to detect.
Disadvantages:
- Limited data capacity.
Adaptive and AI-Based Steganography
- Uses machine learning to optimize embedding locations.
- Adaptive algorithms select least noticeable areas dynamically.
Advantages:
- Extremely stealthy and resistant to detection.
Disadvantages:
- Requires computational power.
Comparison Table of Image Steganography Methods
Method | Capacity | Robustness | Detectability | Complexity |
LSB | High | Low | High | Low |
DCT | Medium | High | Medium | Medium |
DWT | Medium | High | Medium | High |
FFT | Low | Very High | Low | Very High |
Edge-Based | Low | Medium | Low | Medium |
Spread Spectrum | Low | Very High | Low | High |
Prevention
ID | Name | Description |
---|---|---|
PV015 | Application Whitelisting | By only allowing pre-approved software to be installed and run on corporate devices, the subject is unable to install software themselves. |
PV008 | Enforce File Permissions | File servers and collaboration platforms such as SharePoint, Confluence, and OneDrive should have configured permissions to restrict unauthorized access to directories or specific files. |
PV002 | Restrict Access to Administrative Privileges | The Principle of Least Privilege should be enforced, and period reviews of permissions conducted to ensure that accounts have the minimum level of access required to complete duties as per their role. |
Detection
ID | Name | Description |
---|---|---|
DT045 | Agent Capable of User Activity Monitoring | An agent capable of User Activity Monitoring (UAM) is a software agent installed on organization endpoints (such as laptops); typically, User Activity Monitoring agents are only deployed on endpoints where a human user Is expected to conduct the activity.
The User Activity Monitoring agent will typically record Operating System, application, and network activity occurring on an endpoint, with a focus on activity that is or can be conducted by a human user. The purpose of this monitoring is to identify undesirable and/or malicious activity being conducted by a human user (in this context, an Insider Threat).
Typical User Activity Monitoring platforms operate in an agent/server model where activity logs are sent to a server for automatic correlation against a rule set. This rule set is used to surface activity that may represent Insider Threat related activity such as capturing screenshots, copying data, compressing files or installing risky software.
Other platforms providing related functionality are frequently referred to as User Behaviour Analytics (UBA) platforms. |
DT047 | Agent Capable of User Behaviour Analytics | An agent capable of User Behaviour Analytics (UBA) is a software agent installed on organizational endpoints (such as laptops). Typically, User Activity Monitoring agents are only deployed on endpoints where a human user is expected to conduct the activity.
The User Behaviour Analytics agent will typically record Operating System, application, and network activity occurring on an endpoint, focusing on activity that is or can be conducted by a human user. Typically, User Behaviour Analytics platforms operate in an agent/server model where activity logs are sent to a server for automatic analysis. In the case of User Behaviour Analytics, this analysis will typically be conducted against a baseline that has previously been established.
A User Behaviour Analytic platform will typically conduct a period of ‘baselining’ when the platform is first installed. This baselining period establishes the normal behavior parameters for an organization’s users, which are used to train a Machine Learning (ML) model. This ML model can then be later used to automatically identify activity that is predicted to be an anomaly, which is hoped to surface user behavior that is undesirable, risky, or malicious.
Other platforms providing related functionality are frequently referred to as User Activity Monitoring (UAM) platforms. |
DT029 | File EXIF Data | EXIF stands for Exchangeable Image File Format and is a standard that governs the formats for images, sound, and ancillary tags used by digital cameras, including those in smartphones and other systems. The essential feature of EXIF is that it embeds the metadata into the image files. It can provide detailed information about an image, including the date and time, camera settings, camera specifications, thumbnails, geographical location information, and orientation. |
DT028 | File Metadata | Metadata can provide rich information about a file and its content. This can include modified, accessed, and created timestamps, file type, file size, and more. |