Anti-Forensics
Account Misuse
Clear Browser Artifacts
Clear Email Artifacts
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Log Deletion
Log Modification
Modify Windows Registry
Network Obfuscation
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Stalling
Steganography
System Shutdown
Timestomping
Tripwires
Uninstalling Software
Virtualization
Windows System Time Modification
- ID: AF008.001
- Created: 10th February 2025
- Updated: 28th November 2025
- Platforms: WindowsLinuxMacOSiOSAndroid
- Contributors: The ITM Team, Matt Barr,
Image Steganography
A subject embeds data within image files to hide sensitive content and exfiltrate it, in a way that conceals both the data and the act of exfiltration. Unlike encryption alone, this attempts to hide the existence of the data.
| Method | Description | Notes |
|---|---|---|
| Least Significant Bit (LSB) | Modifies the least significant bits of pixel values (typically in RGB channels) to store hidden data, with minimal visible change. | High capacity, simple to implement, but fragile. Lossy compression may destroy the data. Detectable via histogram or entropy analysis. |
| Masking / Filtering | Alters luminance or contrast, embedding data in textured or edge-heavy regions. | Used with lossless formats (e.g., PNG, BMP). More robust than LSB, but limited capacity. |
| Transform-Domain Methods | Applies frequency transformations (DCT, DWT, FFT) and embeds data into coefficients. | More resilient to compression and image editing. Lower capacity, higher complexity. |
| Palette / Color-Table Encoding | Modifies color palettes or transparency values in indexed-color images. | Difficult to detect visually, but format-limited. May expose anomalies in color table comparisons. |
| EOF Padding (Appended Data) | Appends hidden content after the image’s End of File (EOF) marker. | Simple and often overlooked. No image modification required, making visual detection difficult. Easily done with basic scripts, file joiners or hex editor. Can be exposed if file size is unexpectedly large or during forensic carving. |
| Edge/Noise-Based Embedding | Selectively hides data in edges, noise, or using adaptive spreading. | Hardest to detect, especially when combined with ML techniques. Capacity is lower, implementation complex. |
Trade-offs
- LSB and EOF: High capacity, low complexity, fragile to inspection
- Transform and Edge-based: Higher stealth, lower capacity, more resilient
- Appended EOF: Minimal technical skill required, common in low-effort exfiltration attempts