Chris Sanders 🔎 🧠

Investigation Scenario 🔎

You’ve been given the hard drive of an IT employee suspected of using their computer to leak company secrets on public forums.

What do you look for to investigate whether an incident occurred?

For this scenario, I want you to be specific about the evidence sources you’ll examine to find your desired artifacts.

#InvestigationPath #DFIR #SOC

Jun 11, 2024 at 2:00pmWeb
Show threadChris Sanders 🔎 🧠Jun 14, 2024

A unique facet of this investigation that I want to focus on is the capabilities of the potential malicious actor. They're certainly more capable than a typical inside user and likely more motivated to cover tracks than an external attacker. With that in mind, you have to consider the potential for deleted files, cleared logs, hidden entities, and more. Since we're concerned about visits to public forums, that might mean expected browser artifacts aren't available. The good thing is that there are often multiple places to find artifacts of visited URLs, even when you only have the disk to work with. For example, registry keys like TypedPaths.

Some evidence sources can prove an event occurred, but they can’t prove it did not. That's why we examine multiple sources, particularly in cases such as this one.

Speaking of covering tracks, what do you suppose are the most common techniques insiders might use to cover tracks on systems they're using for malicious activity? Where would you find artifacts of their occurrence?

That’s something to think about… 🚀 #InvPath #DFIR #SOC

Show threadChris Sanders 🔎 🧠Jun 14, 2024
My response of the week goes to Harsh (LI). A thoughtful approach that covers a lot of ground and references specific evidence sources.
Show threadGrimmoJun 11, 2024
@chrissanders88 I'd start by enumerating the installed browsers and fuzzy matching the public forum urls with browser histories. If browser history is empty I'd check if it can be forensically recovered.
I'd check for suspicious stuff like encryption software, encrypted partitions which don't appear to be company compliant. I'd also check for virtual disk image files, or recently deleted large sparse files. Do the os system logs confirm that it's been used at the time the files were accessed or published on the forums? Check if there are traces of the email address used to register on the forum where the leaks happened. Check if the leaked material is still on the disk and when it's been accessed last time
Show threadThomas PatzkeJun 11, 2024

@chrissanders88 I would check if the forum domain names appear somewhere in the browser history or perhaps even concrete URLs is know. Furthermore, if there are valid credentials in browser credential storage or session cookies for the forums.

If known, I would check if the file names that were used for leaking in the forum exist(ed) on the system by searching for them in the file systems as well as recently opened files.

Generally, I would check for existence of large archives if files were leaked this way and for existence of the leaked data itself on the system.