# Steganographic Exfiltration Tooling

- **Severity:** Medium
- **Signature ID:** `b7f3c1d4-9a6e-4f2b-8c15-3d7e0a4b92f6`
- **MITRE ATLAS:** AML.T0025 (Exfiltration via Cyber Means)
- **OWASP:** LLM02 (Sensitive Information Disclosure)

## Summary

This detects an AI agent running a single command that hides data inside a picture or audio file, or pulls hidden data back out. Attackers use this trick — called steganography — to sneak sensitive information past filters that only look for obvious file transfers, or to smuggle instructions into a file that looks harmless.

## How the attack works

An agent-controlled process runs a command that either embeds a payload into a media file or extracts one from it. This can look like a dedicated steganography tool (embed/extract mode), exiftool writing a long opaque string or the contents of a data file into an image's metadata field, a file-carving tool run against a media file to pull hidden content out, or a plain shell command appending extra bytes onto an image or audio file so it silently grows in size. The rule looks for an actual embed/extract action, not just a tool name mentioned in passing, and ignores help text or install commands.

## Why it matters

An organization could lose sensitive data smuggled out inside what looks like an ordinary image or audio file, evading exfiltration controls that only inspect file type or obvious transfer patterns. It can also indicate a file has been booby-trapped with hidden payloads for later extraction.

## What you can do

- Review any flagged command to see what data or file was embedded or extracted, and where the resulting file went.
- Check whether the activity matches known research, forensic, or malware-analysis work before treating it as suspicious.
- Restrict which tools and file types agents can invoke commands against, especially exiftool and steganography/carving utilities.
- Monitor outbound transfers of image and audio files for unexpected size changes or unfamiliar destinations.

## Known benign look-alikes

- Security research, CTF solving or DFIR work performed intentionally by the operator — binwalk/foremost/scalpel/zsteg against a media sample is normal forensic triage and will match sel_carve_carrier.
- Malware-analysis workflows that carve embedded objects out of a malicious PDF or image sample.
- Photography or asset pipelines that legitimately write long generated tokens (license IDs, signed provenance/C2PA-style strings) into EXIF UserComment or ImageDescription via exiftool.
- Build scripts that append a trailing blob to a media file for legitimate reasons, e.g. self-extracting archives or appended sprite/atlas data.
- Developers writing unit tests or demos for a steganography library (stegano, stego_lsb, stepic) inside source files rather than markdown — the documentation filter only covers doc-extension writes.
- Rare naming collisions with the bare tool-name list (for example an unrelated internal script named deepsound or jsteg).

## References

- https://attack.mitre.org/techniques/T1027/003/
- https://attack.mitre.org/techniques/T1001/002/
- https://attack.mitre.org/techniques/T1074/001/

---
Source: https://www.netzilo.com/threats/steganographic-exfiltration