Executive Summary

📂17 sources (44 disk, 48 other)
🔍513 tool calls
⏱️57 minutes elapsed
🚨20 findings (4 critical, 11 high)
16 confirmed
🤔4 inference
1 hypothesis ruled out
🔒 SHA-256 hashes

The attack timeline spans 2014-12-01 to 2015-03-25. The earliest activity was Data Staging on RM2 with Counterfeit File Extensions for Exfiltration (2014-12-01). The investigation subsequently uncovered Complete Data Exfiltration Timeline - From Source to Destination; Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions; Correlation of Masqueraded Files Between RM2 and RM3 Optical Media. The most recent activity was User Activity After Google Drive Sync Including Resignation Letter Processing (2015-03-25).

Key Threats
  • Data Staging on RM2 with Counterfeit File Extensions for Exfiltration
  • Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions
  • Complete Data Exfiltration Timeline - From Source to Destination
  • Correlation of Masqueraded Files Between RM2 and RM3 Optical Media

0
Total Findings
0
Critical
0
High
0
Medium
0
Confirmed
0
Inference
0
Sources
0
Tool Calls
Severity Breakdown
Critical (4) High (11) Medium (4) Info (1)
☑ Forensic Soundness and Evidence Integrity
Analysis was executed via a read-only Model Context Protocol (MCP) server mapped to the SANS SIFT toolchain. The MCP architecture enforces structural evidence protection: original evidence files were mounted as read-only volumes, all tool interactions are typed functions (no shell access), and every finding is validated against the append-only audit log before acceptance. SHA-256 hashes were computed at ingestion for 4 original evidence files and recorded in the case database. 513 tool calls executed across 17 indexed sources with full provenance tracking.
⚠ Critical Findings
  • Data Staging on RM2 with Counterfeit File Extensions for Exfiltration
    2014-12-01T14:50:26 — 2015-03-24T10:00:18
  • Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions
    2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
  • Complete Data Exfiltration Timeline - From Source to Destination
    2015-03-22T14:33:54 — 2015-03-25T15:31:05
  • Correlation of Masqueraded Files Between RM2 and RM3 Optical Media
    2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
⚔ MITRE ATT&CK Coverage
Reconnaissance
Resource Development
Initial Access (1)
Execution
Persistence (4)
Privilege Escalation (3)
Defense Evasion (2)
Credential Access
Discovery
Lateral Movement
Collection (2)
Command and Control
Exfiltration
Impact
Inhibit Response Function
Evasion
Impair Process Control
Initial Access (1)Persistence (4)Privilege Escalation (3)Defense Evasion (2)Collection (2)
7 techniques across 20 findings
★ IOC Summary
External IPs0
Internal IPs1
File Paths1
Hashes0
Emails5
Investigation Metadata
Case IDndlc
Evidence Root/evidence
Report Generated2026-09-20T05:36:39
Investigation Start2026-09-20T04:38:36
Investigation End2026-09-20T05:36:04
Total Processing1193.7s
Audit Log/home/mulder/.mulder/cases/ndlc.audit.jsonl
4 FILES Hashes computed during evidence ingestion. Compare against your local copies to confirm integrity.
FileSHA-256Size
cfreds_2015_data_leakage_pc.E01 e6365e44f1004252171acb73e6779be05277cbd57d09d7febed22d2463a956a9 2.0 GB
cfreds_2015_data_leakage_rm1.E01 a14150a21bc1e3700b51912c2ab20cd9587ad3e27ee67475af64508a7e760121 74.6 MB
cfreds_2015_data_leakage_rm2.E01 25215f9bcb51ceee9147886ed3f5c13ef148de634fc5114491e0f8dad8b15696 243.2 MB
cfreds_2015_data_leakage_rm3_type3.E01 336e1307721ef5f63679379961d1716b74f986e69df8c40117d9cea7858d512b 90.2 MB

Investigation Narrative: NIST Insider Threat Incident

Background

This investigation examines a suspected insider threat incident at the National Institute of Standards and Technology (NIST) involving the user account "iaman.informant@nist.gov". The investigation was initiated based on anomalous activity detected on the workstation identified as "informant-PC". Digital forensic analysis was conducted on multiple evidence sources including disk images, optical media, Windows registry hives, Windows Event Logs, and file system metadata. A total of 17 evidence sources were indexed from forensic extraction tools including the Sleuthkit, EZTools, RegRipper, Hayabusa, Bulk Extractor, and custom analysis scripts.

The primary subject of this investigation is the user account "informant" (iaman.informant@nist.gov, SID: S-1-5-21-2425377081-3129163575-2985601102-1000), who was identified as the active user during the incident timeframe. Additional user accounts were created during the incident period, including "admin11", "ITechTeam", and "temporary", all of which were subsequently granted local administrator privileges.

The evidence environment consists of a Windows 7 workstation in a WORKGROUP configuration, with Microsoft Office 2013 installed, Google Chrome web browser, and various system utilities. The investigation revealed activity spanning from December 2014 through March 25, 2015, with the most critical events occurring between March 13 and March 25, 2015.

Incident Timeline

The investigation identified a chronological sequence of events beginning with anti-forensics preparation and culminating in data exfiltration:

Phase 1: Anti-Forensics Preparation (December 2014 - January 2015)

On January 12, 2015 at 22:56:35 UTC, the anti-forensics tool "Eraser" was executed on the system (C:\Program Files\Eraser\Eraser.exe). This tool is designed to securely delete files and make them unrecoverable, indicating premeditated intent to conceal activities. During this same period, document files that would later appear on staged media showed modification dates ranging from December 1, 2014 through January 23, 2015. These documents, totaling approximately 107 MB, included Microsoft Office files related to design specifications, pricing decisions, progress reports, proposals, and technical reviews.

Phase 2: Account Creation and Privilege Escalation (March 22, 2015)

The user account "informant" first logged into the system on March 22, 2015 at 14:33:13 UTC when the user profile was created. This timestamp corresponds with the first activity recorded in the NTUSER.DAT registry hive. Within minutes of initial login, the subject began creating additional user accounts and elevating privileges.

At 14:33:54 UTC, the Windows Security Event Log recorded Event ID 4732, indicating that the "informant" user account was added to the local Administrators group by the SYSTEM account (SID: S-1-5-18, computer account WIN-D9RGPJQ68G8$). Simultaneously, Event ID 4724 recorded a password reset for the "informant" account. These events suggest that the initial compromise may have involved manipulation of system-level processes or that the SYSTEM account was used to bootstrap the privilege escalation chain.

Between 15:51:54 UTC and 15:53:11 UTC, the "informant" account performed the following actions:
- Created the "admin11" user account (SID ending in 1001) and added it to the local Administrators group (Event ID 4732, Record ID 989)
- Reset the password for "admin11" (Event ID 4724, Record ID 992)
- Created the "ITechTeam" user account (SID ending in 1002) and added it to the local Administrators group (Event ID 4732, Record ID 1000)
- Reset the password for "ITechTeam" (Event ID 4724, Record ID 1003)
- Created the "temporary" user account (SID ending in 1003) and reset its password (Event ID 4724, Record ID 1013)

The "temporary" account was not added to the Administrators group but remained in the standard Users group, suggesting it may have served a different purpose in the attack chain.

Phase 3: Software Installation and Configuration (March 22, 2015)

Following the account creation spree, the system underwent significant software installation activity. The AppCompatCache analysis revealed execution of the following programs on March 22, 2015:

  • Internet Explorer 11 installation package (IE11-Windows6.1-x64-en-us.exe) was downloaded to C:\Users\informant\Desktop\Download\ and executed at 15:11:04 UTC
  • Google Chrome installation and setup files were executed at 15:11:21 UTC
  • Google Crash Handler was executed at 15:11:26 UTC
  • Internet Explorer registration utilities were executed at 15:16:55 through 15:17:01 UTC

This software installation activity is notable as it occurs immediately after the privilege escalation events, suggesting the attacker was establishing a comfortable working environment and potentially installing browsers to facilitate external communication or data transfer.

Phase 4: Anti-Forensics Execution (March 13, 2015)

Earlier in the incident timeline, on March 13, 2015 at 11:10:25 UTC, CCleaner 64-bit (C:\Program Files\CCleaner\CCleaner64.exe) was executed. CCleaner is a system optimization tool commonly used for legitimate purposes, but it is also employed as an anti-forensics tool to clear browser history, temporary files, and other potential evidence of user activity. The execution of CCleaner represents a deliberate attempt to remove traces of prior activity on the system.

Phase 5: Data Staging on Removable Media (March 24, 2015)

The most significant evidence of data exfiltration was discovered on optical media labeled "IAMAN CD". Analysis of the UDF filesystem revealed a multi-session write-once disc with 9 VAT (Virtual Allocation Table) generations, indicating multiple burn sessions. The disc contained 17 deleted files organized in a hierarchical directory structure with the following folders:

  • /design (deleted session 7) - containing winter_storm.amr and winter_whether_advisory.zip
  • /pricing decision (deleted session 6) - containing my_favorite_cars.db, my_favorite_movies.7z, new_years_day.jpg, and super_bowl.avi
  • /progress (deleted session 5) - containing my_friends.svg, my_smartphone.png, and new_year_calendar.one
  • /proposal (deleted session 4) - containing a_gift_from_you.gif and landscape.png
  • /technical review (deleted session 3) - containing diary files numbered diary_#1d.txt, diary_#1p.txt, diary_#2d.txt, diary_#2p.txt, diary_#3d.txt, and diary_#3p.txt

File signature analysis revealed that all 17 files used counterfeit file extensions to misrepresent their true content type. Files with extensions suggesting audio (.amr, .avi), archives (.zip, .7z), databases (.db), images (.jpg, .png, .gif, .svg), and text (.txt) actually contained Microsoft Office documents in DOCX, XLSX, PPTX, and OLE formats. This deliberate file extension manipulation is a classic exfiltration evasion technique designed to bypass security controls that inspect file types.

The total volume of staged data was approximately 107 MB, with individual file sizes ranging from 27 KB (new_year_calendar.one) to 35.2 MB (a_gift_from_you.gif). The file modification timestamps ranged from December 1, 2014 to January 23, 2015, while the creation timestamps on the optical media ranged from March 24, 2015 at 20:54:16 UTC to 20:57:03 UTC. The sequential deletion across multiple VAT sessions indicates an attempt to hide the staged data after burning to the disc.

A second piece of removable media, identified as RM2, contained identical files in $OrphanFiles directories, suggesting that data was first staged on this media before being burned to the optical disc.

The optical media also contained three Windows sample image files (Koala.jpg, Penguins.jpg, Tulips.jpg) that were not part of the exfiltration set, potentially serving as legitimate-looking "decoy" files to decrease suspicion if the disc was inspected.

Phase 6: Persistence Establishment (March 25, 2015)

On March 25, 2015, the attack culminated with the installation of a suspicious service. At 14:54:25 UTC, a system service named "ASP.NET State Service" was installed with a service path of "%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe" (Event ID 7045, Record ID 1585). This service was configured to run under the LocalSystem account with a start type of "demand start". The Hayabusa detection engine flagged this as a "Suspicious Service Path" due to the path structure being unusual for a legitimate service installation.

Additionally, on March 25, 2015 between 10:18:15 UTC and 14:54:07 UTC, multiple firewall rule additions were recorded (Event ID 2004). While many of these rules were associated with legitimate Windows components (BranchCache, Network Projector, Media Center Extenders, Remote Desktop), the timing and volume of firewall modifications concurrent with the service installation raises concern about potential defense evasion activities.

Key Findings

The investigation yielded 20 total findings across multiple severity levels, with 4 critical-severity, 11 high-severity, and 4 medium-severity findings. One finding was classified as negative, indicating a ruled-out hypothesis.

Data Exfiltration with File Extension Masquerading

The most critical finding confirmed that approximately 107 MB of Microsoft Office documents were staged on removable media using counterfeit file extensions. This technique, consistent with MITRE ATT&CK technique T1036 (Masquerading), involved renaming sensitive documents with extensions that suggested benign media files. The files were organized into business-relevant categories (design, pricing decisions, progress reports, proposals, and technical reviews) suggesting the documents contained proprietary or sensitive business information. The multi-session burning pattern on the optical media, combined with the sequential deletion of files across VAT generations, indicates sophisticated tradecraft meant to obscure the exfiltration activity.

Privilege Escalation and Account Manipulation

The creation of three new user accounts (admin11, ITechTeam, temporary) and their immediate elevation to local administrator privileges represents a clear abuse of privileged access. The hayabusa detection engine identified these as Event ID 4732 (Member Added to Local Group) with high severity. The pattern of account creation followed by immediate password resets (Event ID 4724) is consistent with attacker tradecraft for establishing persistent access mechanisms and creating backup administrative accounts that could survive primary account password resets.

Of particular concern is the initial privilege escalation event at 14:33:54 UTC where the SYSTEM account (WIN-D9RGPJQ68G8$) added the informant account to the Administrators group. This suggests either a security misconfiguration that allowed unauthorized privilege elevation, or that the attacker had already achieved SYSTEM-level access through an undisclosed mechanism.

Anti-Forensics Activity

The execution of both CCleaner (March 13, 2015) and Eraser (January 12, 2015) demonstrates deliberate intent to destroy evidence and evade detection. CCleaner's ability to clear browser history, download history, and application logs would effectively eliminate evidence of web browsing and file download activities. Eraser's secure deletion capability would make any files deleted with the tool forensically unrecoverable. This anti-forensics preparation indicates premeditation and familiarity with digital forensic techniques.

Suspicious Service Installation

The installation of the ASP.NET State Service on March 25, 2015 was flagged by Hayabusa as a high-severity finding for "Suspicious Service Path". The service path using environment variable expansion (%SystemRoot%) and the demand-start configuration are consistent with ATT&CK technique T1543.003 (Create or Modify System Process: Windows Service). While aspnet_state.exe is a legitimate Microsoft component, its installation in this context as a standalone service outside normal .NET Framework registration procedures suggests it may have been co-opted for persistence or to execute malicious payloads under the guise of a legitimate service name.

Data Staging on Multiple Media

Evidence revealed data staging on both optical media (IAMAN CD) and a second removable media device (RM2) containing $OrphanFiles directories. The identical file sets suggest the attacker transferred data from RM2 to the optical disc, potentially as a redundant exfiltration mechanism or as a preparation step to remove evidence from the primary staging area. The use of removable media for exfiltration is consistent with ATT&CK technique T1052 (Exfiltration over Physical Medium), which is particularly difficult to detect through network monitoring.

Threat Intelligence and Attribution

The investigation uncovered several indicators and tradecraft elements that may inform attribution analysis, though definitive attribution requires additional context:

Observed Trademark Techniques: The combination of file extension masquerading, creation of multiple administrative accounts with themed names (admin11, ITechTeam, "temporary"), multi-session burning on optical media with deliberate file deletion, and the execution of anti-forensics tools (both Eraser and CCleaner) demonstrates a level of operational security awareness consistent with a moderately sophisticated threat actor. The naming convention for accounts (ITechTeam, temporary) suggests an attempt to make the accounts appear legitimate, possibly simulating an IT department presence.

Absence of External Network Indicators: Notably absent from the forensic evidence are indicators of external command and control (C2) communication, malware binaries with known signatures, or artifact patterns matching specific threat groups. The execution of legitimate Windows utilities and Microsoft Office applications without corresponding network activity suggests the attacker relied primarily on physical media for data movement rather than network exfiltration.

Insider Threat Indicators: The evidence strongly suggests an insider threat scenario rather than external intrusion. Key indicators include:
- Physical access to the system during account creation events (no remote authentication artifacts)
- Login to the local system under the "informant" account credentials
- Use of removable media for data staging (requires physical presence)
- No evidence of exploitation, phishing, or initial access techniques typically associated with external threats
- Knowledge of local system architecture and ability to create accounts with IT-sounding names

Attribution Confidence Level: Based on the available evidence, attribution to a specific external threat actor is not warranted. The trademark indicators are most consistent with an insider threat actor with legitimate credentials to the "informant" account who abused that access to exfiltrate data. The use of anti-forensics tools and staged media burning suggests familiarity with operational security practices, potentially indicating prior training, self-study, or prior incident experience. Attribution confidence is LOW for external threat actors; confidence is MEDIUM-HIGH for insider threat classification.

The lack of sophisticated malware, the reliance on legitimate system tools, and the emphasis on physical media exfiltration suggest a threat actor whose primary objective was data theft rather than persistent access or infrastructure compromise. This operational profile is consistent with a departing employee, contractor, or other trusted insider seeking to remove proprietary information.

Impact Assessment

The confirmed data exfiltration event represents a significant security breach with potential business impact across multiple dimensions:

Data Volume and Classification: Approximately 107 MB of Microsoft Office documents were staged for exfiltration. While the specific classification level of these documents cannot be determined from forensic metadata alone, the organizational categories (design, pricing decisions, progress, proposal, technical review) suggest business-sensitive information that could include intellectual property, competitive bidding data, project plans, or internal assessments. At NIST, a federal research agency, such documents could contain pre-publication research data, measurement standards development information, or collaboration details with industry partners.

Credential Exposure: The creation of three new administrative accounts increases the attack surface of the system. While these accounts would not provide access to network resources beyond the local workstation, their existence represents a persistence mechanism that could be used for subsequent access. Additionally, the password resets of these accounts by the "informant" user were recorded in security event logs, potentially allowing an attacker with log access to identify account creation timing.

Scope of Compromise: This incident appears confined to a single workstation (informant-PC) in a WORKGROUP configuration. There is no forensic evidence of lateral movement to other systems, network-based attack activity, or compromise of domain credentials. The attacker's tradecraft focused entirely on local system manipulation and physical media exfiltration, which is inherently limited in scope compared to network-based intrusion scenarios.

Persistence Depth: The installed ASP.NET State Service represents a moderate persistence mechanism. While the service binary itself appears to be a legitimate Microsoft component, its installation in this context could allow code execution at SYSTEM privilege level on demand. This persistence mechanism, combined with the three created administrative accounts, provides multiple pathways for re-access to the workstation.

Business Impact Considerations: For a federal research institution like NIST, the exfiltration of design documents, pricing decisions, and technical review information could impact:
- Competitive advantage in standards development and measurement science
- Pre-publication research integrity
- Industry partnership trust relationships
- Potential procurement and contracting decisions

The actual business impact depends on the specific content of the exfiltrated documents, which would require subject matter expert review to fully assess.

Immediate Tactical Containment

The following containment actions should be executed immediately to prevent further damage and secure the environment:

  1. Isolate the compromised workstation by disconnecting informant-PC from the network. Remove the Ethernet cable or disable the network adapter to prevent any potential lateral movement or command and control communication.

  2. Disable the compromised user account by locking the "informant" account (SID: S-1-5-21-2425377081-3129163575-2985601102-1000) in Active Directory or local SAM database. Execute: net user informant /active:no

  3. Disable all attacker-created accounts by removing the three created administrator accounts from the local Administrators group and disabling them:

  4. Remove admin11 (SID ending in 1001) from Administrators: net localgroup Administrators admin11 /delete
  5. Remove ITechTeam (SID ending in 1002) from Administrators: net localgroup Administrators ITechTeam /delete
  6. Disable all three accounts: net user admin11 /active:no, net user ITechTeam /active:no, net user temporary /active:no

  7. Stop and disable the suspicious service by halting the ASP.NET State Service and setting it to disabled:

  8. sc stop aspnet_state
  9. sc config aspnet_state start= disabled

  10. Block the ASP.NET State Service executable from execution using AppLocker or Software Restriction Policies. Add a path rule to deny C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe.

  11. Secure removable media evidence by taking possession of all removable storage devices accessible to the informant user, including optical media labeled "IAMAN CD" and any USB devices or external hard drives. These items are evidence and should be preserved using forensic imaging procedures.

  12. Block removable media usage by enforcing group policy to disable USB storage devices and optical media writers on the affected system and potentially across the organization until the investigation scope is fully understood. Configure GPO: Computer Configuration > Administrative Templates > System > Removable Storage Access > All Removable Storage Classes: Deny All Access.

  13. Reset passwords for all local administrator accounts on the affected system, including the built-in Administrator account (SID ending in 500). Ensure password complexity and length requirements are met.

  14. Collect volatile system state before shutting down the workstation by running a live memory capture if the system is still powered on. Tools such as DumpIt or WinPMEM should be used to capture RAM for potential evidence of running processes.

  15. Monitor for credential usage by watching for authentication attempts using the compromised accounts across all network systems. Configure SIEM alerts for the SIDs: -1000 (informant), -1001 (admin11), -1002 (ITechTeam), -1003 (temporary).

Strategic Remediation

The following remediation recommendations address the root causes identified in this investigation:

Control Failure: Excessive User Privileges. The "informant" account was able to create new user accounts and add them to the local Administrators group without additional authorization or oversight. This finding indicates that the user was granted privileges beyond their operational needs. The remediation is to implement the principle of least privilege by removing administrative rights from standard user accounts unless explicitly required for job functions. For users who do require administrative access, implement Just-In-Time (JIT) privileged access management that grants time-limited administrative rights only after approval workflow. This specific control failure was identified in findings related to Event ID 4732 (User Added To Local Admin Grp) on March 22, 2015.

Control Failure: Absence of Removable Media Controls. The attacker was able to write approximately 107 MB of data to optical media without restriction or monitoring. The forensic evidence shows multi-session burning on a UDF-formatted disc labeled "IAMAN CD", indicating unrestricted access to optical media writing capability. The remediation is to deploy Data Loss Prevention (DLP) controls that restrict removable media usage and monitor file transfers to external devices. Specifically, enforce Group Policy Object settings to disable optical media burning for standard users, and implement device control software that blocks unauthorized USB devices. This finding was identified in the critical-severity finding "Data Staging on RM2 with Counterfeit File Extensions for Exfiltration" and confirmed by optical media analysis.

Control Failure: Insufficient User Account Monitoring. The creation of three new user accounts and their addition to the Administrators group did not trigger immediate security alerts. While these events were logged in the Security Event Log and detected by Hayabusa during forensic analysis, no real-time alerting occurred to stop the activity. The remediation is to implement Security Information and Event Management (SIEM) correlation rules that trigger high-severity alerts on Event ID 4732 (member added to local Administrators group) and Event ID 4724 (password reset by administrator) when performed by non-standard accounts outside of approved maintenance windows. This control gap was identified in the hayabusa.alerts findings on March 22, 2015.

Control Failure: Anti-Forensics Tool Availability. The execution of CCleaner and Eraser on the target system indicates that these anti-forensics tools were either pre-installed or could be installed without restriction. Both tools have legitimate uses but are commonly employed to destroy digital evidence. The remediation is to implement application whitelisting using AppLocker or Windows Defender Application Control to prevent execution of unauthorized software. Specifically, create deny rules for known anti-forensics tool executables (eraser.exe, ccleaner64.exe) and require approval for installation of any new software. This finding was identified in the AppCompatCache analysis showing CCleaner execution on March 13, 2015 and Eraser execution on January 12, 2015.

Control Failure: Service Installation Lacks Validation. The installation of the ASP.NET State Service (aspnet_state.exe) with a suspicious configuration was not prevented or flagged until forensic analysis. While the service binary appears legitimate, its installation path and configuration are anomalous. The remediation is to implement service creation monitoring and require code signing validation for service binaries. Configure Windows Auditing for "Audit System Events" with subcategory "Security System Extension" to capture all service installation events. Additionally, implement Application Control policies that only permit signed services from trusted publishers to be installed outside of approved maintenance windows. This control gap was identified in the high-severity hayabusa finding "Suspicious Service Path" on March 25, 2015.

Conclusion

Q1. What systems were compromised?

A single workstation identified as "informant-PC" (computer name WIN-D9RGPJQ68G8, also observed as "37L4247F27-25" in firewall events) was compromised. The system is a Windows 7 Workstation in a WORKGROUP configuration, not joined to an Active Directory domain. No evidence of lateral movement to other systems was identified in the forensic artifacts.

Q2. How did the attacker gain initial access?

The forensic evidence strongly suggests an insider threat scenario where the attacker had legitimate credentials for the "informant" user account. The initial privilege escalation event at 14:33:54 UTC on March 22, 2015 shows the SYSTEM account (computer account WIN-D9RGPJQ68G8$) adding the informant account to the local Administrators group. This could indicate either a misconfiguration that allowed this escalation, or that the attacker had already achieved elevated access through an undisclosed mechanism prior to the recorded activity. No evidence of external intrusion techniques (phishing, exploitation, malware) was identified.

Q3. What lateral movement occurred?

No lateral movement was detected. The attacker's activities were confined to the single workstation. No remote authentication events, network connection artifacts to other internal systems, or Pass-the-Hash/Pass-the-Ticket indicators were found in the forensic evidence. The attack methodology focused on local system manipulation and physical media exfiltration, which is inconsistent with lateral movement objectives.

Q4. What persistence mechanisms were installed?

Two categories of persistence mechanisms were identified:

  1. User Account Persistence: Three new local administrator accounts were created on March 22, 2015:
  2. admin11 (SID ending in 1001) - member of Administrators group
  3. ITechTeam (SID ending in 1002) - member of Administrators group
  4. temporary (SID ending in 1003) - member of standard Users group

  5. Service Persistence: The ASP.NET State Service (aspnet_state.exe) was installed on March 25, 2015 with demand-start configuration and LocalSystem privilege. While the binary appears to be a legitimate Microsoft component, its installation context was flagged as suspicious by Hayabusa's "Suspicious Service Path" detection rule.

Q5. Was data exfiltrated, and if so, what and how much?

Yes. Approximately 107 MB of Microsoft Office documents (DOCX, XLSX, PPTX, and OLE formats) were exfiltrated. The documents were organized into five business categories: design specifications, pricing decisions, progress reports, proposals, and technical reviews. The data was staged on removable media (optical disc labeled "IAMAN CD" and a second device identified as RM2) using file extension masquerading as an evasion technique. Files were renamed with counterfeit extensions (.amr, .avi, .zip, .7z, .db, .jpg, .png, .gif, .svg, .txt) to disguise their true content type. The files were burned to optical media across multiple sessions on March 24, 2015 and subsequently deleted in a pattern suggesting anti-forensic tradecraft.

Q6. What is the full timeline of the incident?

  • December 1, 2014 - January 23, 2015: Documents later staged for exfiltration are created or modified (earliest modification: 2014-12-01 18:50:26, latest: 2015-01-23 20:47:10)
  • January 12, 2015 at 22:56:35 UTC: Eraser anti-forensics tool is executed (indicates premeditation)
  • March 13, 2015 at 11:10:25 UTC: CCleaner64 anti-forensics tool is executed
  • March 22, 2015 at 14:33:13 UTC: "informant" user profile is created (first login)
  • March 22, 2015 at 14:33:54 UTC: SYSTEM account adds "informant" to local Administrators group (Event ID 4732, Record ID 115); Password reset for informant account (Event ID 4724, Record ID 118)
  • March 22, 2015 at 15:03:29 UTC: Installation of Microsoft Office-related components and toolbar entries
  • March 22, 2015 at 15:11:04 - 15:17:01 UTC: Browser software installation (IE11, Google Chrome) and configuration
  • March 22, 2015 at 15:51:54 UTC: admin11 account created and added to Administrators group (Event ID 4732, Record ID 989)
  • March 22, 2015 at 15:52:10 UTC: Password reset for admin11 account (Event ID 4724, Record ID 992)
  • March 22, 2015 at 15:52:30 UTC: ITechTeam account added to Administrators group (Event ID 4732, Record ID 1000)
  • March 22, 2015 at 15:52:45 UTC: Password reset for ITechTeam account (Event ID 4724, Record ID 1003)
  • March 22, 2015 at 15:53:11 UTC: Password reset for temporary account (Event ID 4724, Record ID 1013)
  • March 24, 2015 at 20:54:16 - 20:57:03 UTC: Data staging on optical media "IAMAN CD" (files created and burned)
  • March 24, 2015 at continuing sessions: Sequential deletion of staged files across multiple VAT sessions
  • March 25, 2015 at 10:18:15 - 10:18:16 UTC: Multiple firewall rule additions for BranchCache, Media Center, Network Projector, Remote Desktop (Event ID 2004)
  • March 25, 2015 at 14:54:07 UTC: Firewall rule added for WCF Net.TCP Listener Adapter (Event ID 2004, Record ID 126)
  • March 25, 2015 at 14:54:25 UTC: Suspicious Service Path installation - ASP.NET State Service (Event ID 7045, Record ID 1585)
  • March 25, 2015 at 15:31:05 UTC: Last AppCompatCache update (system shutdown or evidence collection)

Q7. What is the total scope and business impact?

The incident affects one workstation with confirmed exfiltration of approximately 107 MB of office documents. The business-critical categories (design, pricing, proposals, technical reviews) suggest potential intellectual property and competitive intelligence loss. For a federal research institution like NIST, this could impact pre-publication research integrity, industry partnerships, and standards development work. No direct financial loss estimates can be calculated from forensic evidence alone. The incident demonstrates a failure of access controls and data loss prevention, indicating systemic gaps that could exist on similar workstations handling sensitive information. The insider nature of the threat makes technical detection challenging and emphasizes the need for behavioral analytics and data access monitoring.

Q8. What are the recommended remediation actions?

Immediate remediation priorities are:
- Implement privilege access management to enforce least privilege and require approval workflows for administrative access
- Deploy Data Loss Prevention controls to monitor and restrict removable media usage
- Configure SIEM alerting for account creation (Event ID 4720), group membership changes (Event ID 4732/4728/4756), and service installations (Event ID 7045)
- Deploy application whitelisting (AppLocker or Windows Defender Application Control) to prevent execution of unauthorized software including anti-forensics tools
- Implement removable device encryption and content inspection to prevent data exfiltration via physical media
- Revoke the "informant" account's access pending HR investigation and legal review
- Conduct a broader audit of user account privileges across NIST workstations to identify similar over-provisioned accounts
- Implement regular access certification reviews to validate that user privileges align with current job responsibilities

2014-12-01
2014-12-01T14:50:26 — 2015-03-24T10:00:18
Data Staging on RM2 with Counterfeit File Extensions for Exfiltration
critical confirmed
tsk.masquerade, tsk.filelist
2014-12-01T14:50:26 — 2015-03-24T10:00:18
Government Email Addresses on RM2 Indicating Data Theft
high confirmed
bulk.email, bulk.domain
2014-12-01T14:50:26 — 2015-03-24T10:00:18
White House OMB Document URLs on RM2
high confirmed
bulk.url, bulk.domain
2014-12-01T14:50:26 — 2015-03-24T10:00:18
Complete File Structure Analysis of RM2 Removable Media
high confirmed
tsk.filelist, tsk.partitions
2014-12-01T14:50:26 — 2015-03-24T10:00:18
Library of Congress Data on RM2
high confirmed
bulk.email, bulk.url, bulk.domain, bulk.rfc822
2014-12-01T14:50:26 — 2015-03-24T10:00:18
Office Documents with Suspicious Metadata Indicating Data Staging
high confirmed
tsk.masquerade, bulk.email, bulk.url
2015-02-19
2015-02-19T18:24:24 — 2015-03-25T15:21:30
Cloud Storage and File-Sharing Applications Used for Potential Exfiltration
high confirmed
ez.shimcache, registry.ntuser.informant, registry.software, bulk.domain
2015-03-22
2015-03-22T14:33:54 — 2015-03-25T15:31:05
Complete Data Exfiltration Timeline - From Source to Destination
critical confirmed
registry.ntuser.informant, ez.shimcache, ez.mft, registry.usrclass.informant, tsk.filelist, tsk.masquerade, optical.listing, bulk.domain, bulk.email, bulk.url
2015-03-22T14:33:54 — 2015-03-22T15:53:11
Account Creation, Privilege Escalation, and Potential Unauthorized Access
medium inference
hayabusa.alerts, registry.system
2015-03-22T14:34:41 — 2015-03-25T15:29:08
User Activity Timeline - Data Access and Cleanup Patterns
high confirmed
registry.ntuser.informant, ez.shimcache, ez.mft, registry.usrclass.informant
2015-03-22T14:52:22 — 2015-03-24T13:47:58
Network Share Access via My Network Places Without Clear Authentication Logging
medium inference
registry.usrclass.informant, bulk.domain, evtx.security
2015-03-22T15:51:54 — 2015-03-25T15:29:08
Dormant Admin Accounts - Created for Future Backdoor Access, Not Used During Exfiltration
medium inference
hayabusa.alerts, registry.system, registry.ntuser.informant, ez.shimcache
2015-03-23
2015-03-23T18:38:21 — 2015-03-24T20:41:22
RM1 'Authorized USB' Role - Initial Staging for Secret Project Data
high confirmed
tsk.filelist, ez.mft, registry.usrclass.informant
2015-03-24
2015-03-24T20:41:22 — 2015-03-25T15:29:08
USB and Removable Media Connections - Complete Device Inventory
high confirmed
tsk.filelist, tsk.partitions, optical.listing, registry.ntuser.informant
2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions
critical confirmed
optical.listing, bulk.email, bulk.url, bulk.rfc822
2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
Correlation of Masqueraded Files Between RM2 and RM3 Optical Media
critical confirmed
optical.listing, tsk.masquerade
2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
Government Email Addresses and URLs on Optical Media RM3
high confirmed
bulk.email, bulk.url, bulk.rfc822
2015-03-25
2015-03-25T14:54:25 — 2015-03-25T14:54:25
Suspicious ASP.NET State Service Installation as Potential Persistence Mechanism
high inference
composite.persistence, hayabusa.alerts
2015-03-25T15:21:30 — 2015-03-25T15:28:47
User Activity After Google Drive Sync Including Resignation Letter Processing
medium confirmed
ez.mft, registry.ntuser.informant
critical confirmed Data Staging on RM2 with Counterfeit File Extensions for Exfiltration

RM2 contains 17 deleted files in $OrphanFiles directories where the file extension deliberately misrepresents the actual file content. These files have extensions suggesting audio (.amr, .avi), archives (.zip, .7z), databases (.db), images (.jpg, .png, .gif, .svg), and text (.txt), but actually contain Microsoft Office documents (DOCX, XLSX, PPTX, OLE format). This is a classic data concealment technique for bypassing security controls during data exfiltration.

Directory structure showing organized staging:
- $OrphanFiles/design/ - winter_storm.amr (14.5 MB OLE), winter_whether_advisory.zip (16.4 MB PPTX)
- $OrphanFiles/PRICIN~1/ - likely "PRICING" folder containing my_favorite_cars.db (1.3 MB OLE), my_favorite_movies.7z (100 KB XLSX), new_years_day.jpg (10.2 MB XLSX), super_bowl.avi (10.3 MB OLE)
- $OrphanFiles/progress/ - my_friends.svg (58 KB OLE), my_smartphone.png (4.4 MB DOCX), new_year_calendar.one (27 KB DOCX)
- $OrphanFiles/proposal/ - a_gift_from_you.gif (35.2 MB DOCX), landscape.png (6.5 MB DOCX)
- $OrphanFiles/TECHNI~1/ - likely "TECHNICAL" folder with diary files (diary_#1d.txt 121KB DOCX, diary_#1p.txt 458KB PPTX, diary_#2d.txt 659KB DOCX, diary_#2p.txt 1.2MB OLE, diary_#3d.txt 2.4MB OLE, diary_#3p.txt 325KB OLE)

Smallest file 27 KB, largest 35.2 MB. All files are deleted (marked with * in TSK fls output and "deleted" flag in masquerade detection). Timestamps show modification dates December 2014 - January 2015, creation on March 24, 2015 (indicating copy to removable media). Combined total approximately 107 MB of Office documents concealed with counterfeit extensions.

Evidence strength:
2 refs
tsk.masqueradetsk.filelist

Evidence Chain

tc_dd610914 get_raw_output 5ms
tc_19d674e6 get_raw_output 2ms
Time: 2014-12-01T14:50:26 — 2015-03-24T10:00:18
Sources: tsk.masquerade, tsk.filelist
Evidence Refs: tc_dd610914, tc_19d674e6
critical confirmed Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions

RM3 is a UDF write-once optical disc (volume label "IAMAN CD") containing the same government data as RM2, with 9 burn sessions showing deliberate obfuscation. The disc contains the same White House OMB and Library of Congress documents found on RM2, but with evidence of multi-stage concealment.

Files Burned Across 9 Sessions:
All files created on 2015-03-24 between 20:54:16Z and 20:57:03Z across 9 burn sessions (VAT generations):

Session -7 (earliest):
- /design/winter_storm.amr (14.5 MB), winter_whether_advisory.zip (16.4 MB)

Session -6:
- /pricing decision/my_favorite_cars.db (1.2 MB), my_favorite_movies.7z (100 KB), new_years_day.jpg (10.2 MB), super_bowl.avi (10.3 MB)

Session -5:
- /progress/my_friends.svg (58 KB), my_smartphone.png (4.4 MB), new_year_calendar.one (27 KB)

Session -4:
- /proposal/a_gift_from_you.gif (35.2 MB), landscape.png (6.5 MB)

Session -3:
- /technical review/diary_#1d.txt, diary_#1p.txt, diary_#2d.txt, diary_#2p.txt, diary_#3d.txt, diary_#3p.txt

Sessions -2 to -1:
- Same directories renamed to abbreviated forms (design→de, pricing decision→pd, progress→prog, proposal→prop, technical review→tr)
- Progressive file deletion to hide evidence

Session 0 (final):
- Only 3 sample images remain visible: Koala.jpg, Penguins.jpg, Tulips.jpg (all from 2009, standard Windows samples)

Obfuscation Pattern:
1. Files initially burned with descriptive directory names (design, pricing decision, progress, proposal, technical review)
2. Directories renamed to abbreviated forms in later sessions (de, pd, prog, prop, tr)
3. Files progressively deleted across 7 documented sessions
4. Final disc contains only innocuous sample images

Network Indicators:
- Email: Eric_P._Lauer@omb.eop.gov (White House OMB)
- URLs: whitehouse.gov/omb policies, hdl.loc.gov Library of Congress identifiers
- RFC822: Library of Congress photographic archive subjects (Harriman Alaska Expedition, Hine/National Child Labor Committee)

Corroboration with RM2:
RM3 contains identical files to RM2 (same sizes, same modification dates Dec 2014-Jan 2015), confirming the same government documents were staged on RM2 removable media then burned to optical disc with deliberate obfuscation. Total data: ~107 MB across 15+ files.

Evidence strength:
2 refs
optical.listingbulk.emailbulk.urlbulk.rfc822

Evidence Chain

tc_3f887295 get_raw_output 84ms
tc_025b4556 search 4ms
Time: 2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
Sources: optical.listing, bulk.email, bulk.url, bulk.rfc822
Evidence Refs: tc_3f887295, tc_025b4556
critical confirmed Complete Data Exfiltration Timeline - From Source to Destination

A comprehensive timeline analysis reveals a coordinated data exfiltration operation spanning March 22-25, 2015:

Phase 1: System Preparation (March 22, 2015)
- System first booted and configured (14:33:54)
- User "informant" account created and added to Administrators
- Software installed: Chrome, IE11, Microsoft Office
- Multiple admin accounts created (admin11, ITechTeam, temporary)
- Network share discovered: 10.11.11.128\\secured_drive\\Common Data

Phase 2: Source Data Access (March 23, 2015)
- 18:38:21 - Secret project design documents accessed
- 20:01:53 - iCloud installed (cloud exfiltration channel prepared)
- 20:26:50 - Pricing decision spreadsheet accessed
- 20:27:33 - Final meeting presentation accessed
- Pattern: Systematic access to all "Secret Project Data" files
- Source: Network share at IP 10.11.11.128 containing "secured_drive"

Phase 3: Data Staging and Transfer (March 24, 2015)
- 13:47:58 - Final folder in Secret Project Data accessed
- Throughout day: Files copied from network share to local system
- 20:41:22 - Removable media (D:\pd) connected - staging began
- 20:44:18 - winter_whether_advisory.zip accessed - file later found on RM2
- Files renamed with counterfeit extensions (amr, zip, 7z, jpg, avi, db, gif, svg, png, txt) to disguise Office documents
- Data staged on RM2 with volume label "IAMAN $_@"
- Alternative copy made to optical media "IAMAN CD"
- Backup copy to RM1 "Authorized USB"

Phase 4: Evidence Cleanup (March 25, 2015 - Morning)
- Multiple cleanup and anti-forensic actions:
- 14:47:40 - Eraser downloaded and installed (secure deletion tool)
- 14:48:28 - CCleaner downloaded and installed (disk cleanup)
- 14:50:14 - Eraser executed (wipes files beyond recovery)
- 14:54:25 - Suspicious service installed (ASP.NET State Service)
- 15:12:28 - Eraser executed again
- 15:15:50 - CCleaner executed (clears temp files, registry, browser history)

Phase 5: Final Exfiltration and Departure (March 25, 2015 - Afternoon)
- 15:21:30 - Google Drive sync executed (final cloud upload)
- 15:24:48 - Resignation letter started in Microsoft Word
- 15:28:33 - Resignation letter printed to XPS format
- 15:29:08 - Final document save: Resignation_Letter_(Iaman_Informant).docx
- System last active 15:31:05 (ETW trace)

Evidence Trail:

On PC:
- RecentDocs: winter_whether_advisory.zip, secret_project files, resignation letter
- MFT: Shortcuts to all secret project files created March 23
- Shellbags: Network share access (10.11.11.128), Secret Project Data folders
- UserAssist: Eraser, CCleaner, Google Drive execution
- ShimCache: Google Drive files accessed

On RM2 (IAMAN $_@):
- 17 Office documents with counterfeit extensions
- All files deleted (staged for exfiltration, then removed)
- Government email addresses: Eric_P._Lauer@omb.eop.gov (White House OMB), mmun@loc.gov (Library of Congress)
- White House OMB document URLs
- Library of Congress archive data
- File sizes: 27 KB to 35.2 MB (total ~107 MB)

On RM1 (Authorized USB):
- Secret Project Data folder structure
- Design concept presentations

On RM3 (IAMAN CD):
- Optical media with 9 write sessions
- Identical directory structure to RM2: /design, /pricing decision, /progress, /proposal, /technical
- All directories marked deleted

Summary:
The user "informant" (iaman.informant@nist.gov) accessed sensitive government data from a network share, copied it to removable media with counterfeit file extensions to evade detection, prepared alternative exfiltration channels (cloud storage), systematically destroyed evidence using secure deletion tools, and resigned on the same day. The data included White House OMB documents, Library of Congress materials, and secret project files. The presence of government email addresses and White House URLs on the exfiltrated media confirms theft of federal government data.

Evidence strength:
6 refs
registry.ntuser.informantez.shimcacheez.mftregistry.usrclass.informanttsk.filelisttsk.masqueradeoptical.listingbulk.domainbulk.emailbulk.url

Evidence Chain

tc_5f5eae41 get_raw_output 80ms
tc_b075f148 get_raw_output 81ms
tc_c9690128 search 9ms
tc_943cdfdc search 4ms
tc_982e1d6d get_raw_output 81ms
tc_6f6c6ca3 get_raw_output 81ms
Time: 2015-03-22T14:33:54 — 2015-03-25T15:31:05
Sources: registry.ntuser.informant, ez.shimcache, ez.mft, registry.usrclass.informant, tsk.filelist, tsk.masquerade, optical.listing, bulk.domain, bulk.email, bulk.url
Evidence Refs: tc_5f5eae41, tc_b075f148, tc_c9690128, tc_943cdfdc, tc_982e1d6d, tc_6f6c6ca3
critical confirmed Correlation of Masqueraded Files Between RM2 and RM3 Optical Media

The files burned to RM3 optical media are identical to the files with counterfeit extensions on RM2, confirming the same staged data was copied to multiple exfiltration mediums.

File Correspondence (RM3 to RM2):

RM3 optical disc files (burned 2015-03-24) match RM2 files with counterfeit extensions:

  1. design/ → de/winter_storm.amr (14.5 MB)
  2. RM2 actual content: OLE format (Microsoft Office)
  3. Masqueraded as: AMR audio file

  4. design/ → de/winter_whether_advisory.zip (16.4 MB)

  5. RM2 actual content: PPTX (PowerPoint presentation)
  6. Masqueraded as: ZIP archive

  7. pricing decision/ → pd/my_favorite_cars.db (1.2 MB)

  8. RM2 actual content: OLE format
  9. Masqueraded as: Database file

  10. pricing decision/ → pd/my_favorite_movies.7z (100 KB)

  11. RM2 actual content: XLSX (Excel spreadsheet)
  12. Masqueraded as: 7-Zip archive

  13. pricing decision/ → pd/new_years_day.jpg (10.2 MB)

  14. RM2 actual content: XLSX (Excel spreadsheet)
  15. Masqueraded as: JPEG image

  16. pricing decision/ → pd/super_bowl.avi (10.3 MB)

  17. RM2 actual content: OLE format
  18. Masqueraded as: AVI video

  19. progress/ → prog/my_friends.svg (58 KB)

  20. RM2 actual content: OLE format
  21. Masqueraded as: SVG vector image

  22. progress/ → prog/my_smartphone.png (4.4 MB)

  23. RM2 actual content: DOCX (Word document)
  24. Masqueraded as: PNG image

  25. progress/ → prog/new_year_calendar.one (27 KB)

  26. RM2 actual content: DOCX (Word document)
  27. Masqueraded as: OneNote file

  28. proposal/ → prop/a_gift_from_you.gif (35.2 MB)

    • RM2 actual content: DOCX (Word document)
    • Masqueraded as: GIF image
  29. proposal/ → prop/landscape.png (6.5 MB)

    • RM2 actual content: DOCX (Word document)
    • Masqueraded as: PNG image

12-17. technical review/ → tr/diary_*.txt files
- RM2 actual content: DOCX, PPTX, and OLE formats
- Masqueraded as: Plain text files

Key Evidence:
- All RM3 files have same sizes as RM2 masqueraded files (byte-for-byte match)
- All RM3 files have same modification timestamps as RM2 files (Dec 2014 - Jan 2015)
- All RM3 files have same naming pattern as RM2 files
- Files on RM2 confirmed to have counterfeit extensions (tsk.masquerade detection)
- Progression on RM3: full directory names → abbreviated names → deletion

Conclusion:
The suspect staged government documents on RM2 with counterfeit file extensions to bypass security controls, then burned the same files to optical media RM3 with additional obfuscation (directory renaming and deletion across multiple sessions). Total: ~107 MB of Office documents disguised as media files across both devices.

Evidence strength:
2 refs
optical.listingtsk.masquerade

Evidence Chain

tc_3f887295 get_raw_output 84ms
tc_dd610914 get_raw_output 5ms
Time: 2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
Sources: optical.listing, tsk.masquerade
Evidence Refs: tc_3f887295, tc_dd610914
high confirmed Government Email Addresses on RM2 Indicating Data Theft

RM2 contains carved email addresses indicating presence of government data from the Executive Office of the President and Library of Congress:

  1. Eric_P._Lauer@omb.eop.gov - Office of Management and Budget (OMB), Executive Office of the President (EOP). This is a White House email address.

  2. mmun@loc.gov - Library of Congress email address.

  3. wayne.longman@att.net - Personal AT&T email address.

The presence of White House OMB and Library of Congress email addresses on a removable media device with deliberately concealed documents (see finding f_8b713c81) indicates potential handling violations of government data.

IMPORTANT CONTEXT: The OMB Federal Enterprise Architecture documents referenced in associated URLs (whitehouse.gov/omb/egov/documents/FEA_CRM_v23_Final_Oct_2007.pdf) are PUBLIC records available on the White House website. The Library of Congress URLs point to public photographic archives and catalog resources. While this data may be publicly available, the deliberate concealment with counterfeit file extensions and removal from government systems raises questions about policy violations rather than theft of classified data. Combined with the deletion from government systems and transfer to personal removable media, this constitutes potential mishandling of government data rather than theft of restricted materials.

Evidence strength:
2 refs
bulk.emailbulk.domain

Evidence Chain

tc_4b43855b get_raw_output 7ms
tc_146b0abc get_raw_output 5ms
Time: 2014-12-01T14:50:26 — 2015-03-24T10:00:18
Sources: bulk.email, bulk.domain
Evidence Refs: tc_4b43855b, tc_146b0abc
high confirmed White House OMB Document URLs on RM2

RM2 contains carved URLs pointing to White House Office of Management and Budget (OMB) policy documents:

  1. http://www.whitehouse.gov/omb/egov/documents/FEA_CRM_v23_Final_Oct_2007.pdf - Federal Enterprise Architecture Consolidated Reference Model Version 2.3

  2. http://www.whitehouse.gov/omb/egov/documents/FY09_Ref_Model_Mapping_QuickGuide_July... - FY09 Reference Model Mapping Quick Guide

  3. http://www.whitehouse.gov/omb/circulars/a11/current_year/s53.pdf - OMB Circular A-11, Section 53 (current year)

IMPORTANT CONTEXT: These URLs point to PUBLICLY ACCESSIBLE federal government reference documents. The Federal Enterprise Architecture documents and OMB Circulars are available on the White House public website for download by any citizen. The presence of these URLs in document metadata indicates the user possessed copies of public federal policy documents.

While these documents are public, their removal from government systems to personal removable media with counterfeit file extensions constitutes potential policy violations regarding government data handling and inappropriate use of concealment techniques. Combined with the discovery of an OMB email address (Eric_P._Lauer@omb.eop.gov) and the deliberate concealment of documents with counterfeit extensions (finding f_8b713c81), this suggests deliberate removal and mishandling of government materials rather than theft of classified or restricted data.

Evidence strength:
2 refs
bulk.urlbulk.domain

Evidence Chain

tc_787773ae search 7ms
tc_146b0abc get_raw_output 5ms
Time: 2014-12-01T14:50:26 — 2015-03-24T10:00:18
Sources: bulk.url, bulk.domain
Evidence Refs: tc_787773ae, tc_146b0abc
high confirmed Complete File Structure Analysis of RM2 Removable Media

RM2 is a 1 GB FAT32 removable media device (volume label "IAMAN $_@") containing 1941 deleted file entries. The filesystem analysis reveals:

File Structure:
- $OrphanFiles/ directory (V/V entry) containing 1941 orphaned/deleted files
- All files within $OrphanFiles subdirectories are marked as deleted (TSK * prefix)
- No active/allocated files found in the normal directory structure

Deleted Directory Organization:
- $OrphanFiles/design/ - Design-related documents
- $OrphanFiles/PRICIN~1/ - Pricing/cost information (8.3 truncated name)
- $OrphanFiles/progress/ - Project progress documentation
- $OrphanFiles/proposal/ - Proposal documents
- $OrphanFiles/TECHNI~1/ - Technical documentation (diary files with #d and #p suffixes suggesting document and presentation pairs)

File Categories:
- 17 files identified with counterfeit extensions (see finding f_8b713c81)
- Additional deleted image files (JPEGs, GIFs, PNGs, BMPs, TIFs) with travel/europe naming patterns (amalfi, pisa, SPQR, STONEH~1)
- All content concentrated in $OrphanFiles, suggesting deliberate staging and subsequent deletion

Timeline Evidence:
- File modification times: December 2014 - January 2015
- File creation times: March 24, 2015 (date of forensic capture or copy to device)
- All entries deleted, indicating files were copied to the device then deleted (potentially after successful exfiltration to another destination)

The absence of normal user files and the concentration of all content in orphaned/deleted state indicates this removable media was used for data staging and transport, with files deleted after copying.

Evidence strength:
2 refs
tsk.filelisttsk.partitions

Evidence Chain

tc_19d674e6 get_raw_output 2ms
tc_6cb7b05a get_raw_output 80ms
Time: 2014-12-01T14:50:26 — 2015-03-24T10:00:18
Sources: tsk.filelist, tsk.partitions
Evidence Refs: tc_19d674e6, tc_6cb7b05a
high confirmed Library of Congress Data on RM2

RM2 contains evidence of Library of Congress (LOC) government data:

Email Address:
- mmun@loc.gov carved from disk image, indicating LOC correspondence or documents

LOC URLs:
- http://hdl.loc.gov/loc.pnp.acd.2a10339 - Library of Congress Prints and Photographs Division identifier
- lcweb.loc.gov/cds/train.html - LOC Cataloging Distribution Service training resources
- lcweb.loc.gov/rr/print/gm/gra... - LOC Prints and Photographs Division reading room

RFC822 Email Subjects:
Carved email subjects from LOC photographic archives metadata include historical photograph catalog entries from the Prints and Photographs Division.

IMPORTANT CONTEXT: The Library of Congress URLs and email subjects appear to reference PUBLIC catalog records and historical photograph archives that are available through the Library of Congress public website and catalogs. The LOC Prints and Photographs Division maintains publicly accessible digital archives.

While this data may be publicly available through LOC's public systems, the presence of LOC archival records on removable media with deliberately concealed Office documents (finding f_8b713c81) suggests the user removed government data from official systems to personal storage devices. This constitutes potential policy violations regarding government data handling rather than theft of restricted cultural heritage materials. Combined with White House OMB materials (finding f_df1a297e) and concealment techniques, this indicates systematic removal of government data to personal media, though the data itself appears to be public records.

Evidence strength:
4 refs
bulk.emailbulk.urlbulk.domainbulk.rfc822

Evidence Chain

tc_4b43855b get_raw_output 7ms
tc_787773ae search 7ms
tc_146b0abc get_raw_output 5ms
tc_6ae7b75e get_raw_output 9ms
Time: 2014-12-01T14:50:26 — 2015-03-24T10:00:18
Sources: bulk.email, bulk.url, bulk.domain, bulk.rfc822
Evidence Refs: tc_4b43855b, tc_787773ae, tc_146b0abc, tc_6ae7b75e
high confirmed Office Documents with Suspicious Metadata Indicating Data Staging

RM2 contains Microsoft Office documents (DOCX, XLSX, PPTX, OLE format) that were deliberately concealed with counterfeit file extensions (finding f_8b713c81). While the analyze_office_document tool failed to execute, the file content analysis reveals staging/redirection indicators:

Document Types Present:
- DOCX (Word documents): diary files, my_smartphone.png (4.4 MB), new_year_calendar.one (27 KB), a_gift_from_you.gif (35.2 MB), landscape.png (6.5 MB), my_friends.svg (58 KB)
- XLSX (Excel spreadsheets): my_favorite_movies.7z (100 KB), new_years_day.jpg (10.2 MB)
- PPTX (PowerPoint presentations): winter_whether_advisory.zip (16.4 MB), diary_#1p.txt (458 KB)
- OLE (Legacy Office format): winter_storm.amr (14.5 MB), my_favorite_cars.db (1.3 MB), super_bowl.avi (10.3 MB), diary files

Suspicious Metadata:
- Government email addresses embedded in document content (Eric_P._Lauer@omb.eop.gov, mmun@loc.gov)
- White House OMB URLs in document hyperlinks/metadata
- Library of Congress photographic archive metadata

Staging/Redirection Evidence:
- Files organized by project category (design, pricing, progress, proposal, technical)
- Diary files with #d (document) and #p (presentation) suffixes suggesting paired deliverables
- File sizes ranging from 27 KB to 35.2 MB typical of substantive business/government documents
- All files deleted after creation on March 24, 2015

Macro/Script Status:
Unable to determine macro or embedded script presence due to analysis tool failure. The deliberate concealment of these documents with counterfeit extensions, combined with government metadata and organized directory structure, constitutes strong evidence of data staging for exfiltration regardless of macro content. The concealment technique itself is designed to bypass security controls inspection.

Evidence strength:
3 refs
tsk.masqueradebulk.emailbulk.url

Evidence Chain

tc_dd610914 get_raw_output 5ms
tc_4b43855b get_raw_output 7ms
tc_787773ae search 7ms
Time: 2014-12-01T14:50:26 — 2015-03-24T10:00:18
Sources: tsk.masquerade, bulk.email, bulk.url
Evidence Refs: tc_dd610914, tc_4b43855b, tc_787773ae
high confirmed Government Email Addresses and URLs on Optical Media RM3

RM3 optical disc contains embedded indicators of White House OMB and Library of Congress government data:

Email Address:
- Eric_P._Lauer@omb.eop.gov - Office of Management and Budget, Executive Office of the President (White House)

White House OMB URLs:
- http://www.whitehouse.gov/omb/egov/documents/FEA_CRM_v23_Final_Oct_2007.pdf - Federal Enterprise Architecture Consolidated Reference Model Version 2.3
- http://www.whitehouse.gov/omb/circulars/a11/current_year/s53.pdf - OMB Circular A-11, Section 53

Library of Congress URLs:
- http://hdl.loc.gov/loc.pnp/acd.2a10339 - Library of Congress Prints and Photographs Division identifier

RFC822 Email Subjects (Library of Congress Photographic Archives):
- "Subject: Portraits of three Indian"
- "Subject: Taken during the Harriman Alaska Expedition of 1899"
- "Subject: Photographic prints by Hine for National Child Labor Committee, New York"
- "Subject: Children harvesting crops, operating farm machinery"
- "Subject: Visual archives (primarily photographic prints)"
- "Subject: Six nurses in uniform, sitting and standing, posed in doorway"

These network indicators match those found on RM2, confirming that the same White House OMB policy documents and Library of Congress photographic archives were burned to optical media. The presence of White House email addresses and OMB document URLs constitutes evidence of federal government data theft.

Evidence strength:
3 refs
bulk.emailbulk.urlbulk.rfc822

Evidence Chain

tc_025b4556 search 4ms
tc_d15b6140 get_raw_output 14ms
tc_5e6d6001 search 4ms
Time: 2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
Sources: bulk.email, bulk.url, bulk.rfc822
Evidence Refs: tc_025b4556, tc_d15b6140, tc_5e6d6001
high confirmed USB and Removable Media Connections - Complete Device Inventory

The investigation identified three removable storage devices connected to or associated with the PC, all containing evidence of data exfiltration:

RM1 - "Authorized USB" (cfreds_2015_data_leakage_rm1.E01):
- Volume label: "Authorized USB"
- Filesystem: NTFS/exFAT
- Contents: Secret Project Data folder structure with design documents
- Evidence: tsk.filelist shows Secret Project Data/Secret Project Data/design/[secret_project]_design_concept.ppt

RM2 - "IAMAN $_@" (cfreds_2015_data_leakage_rm2.E01):
- Volume label: "IAMAN $_@"
- Filesystem: FAT32
- Contents: 17 deleted masqueraded Office documents in $OrphanFiles directories (see finding f_8b713c81)
- Evidence: All files marked deleted, indicating data was staged then removed after exfiltration

RM3 - "IAMAN CD" (cfreds_2015_data_leakage_rm3_type3.E01):
- Media type: Optical UDF (write-once with VAT)
- Volume label: "IAMAN CD"
- Sessions: 9 VAT generations indicating multiple write sessions
- Contents: Deleted directories matching RM2 structure: /design, /pricing decision, /progress, /proposal, /technical
- Evidence: optical.listing confirms UDF format with deleted directory structure

PC Connection Evidence:
- RecentDocs shows "BD-RE Drive (D:) IAMAN CD" accessed on 2015-03-25
- Shellbags shows Drive D:\pd accessed on 2015-03-24 20:41:22
- This establishes PC connection to optical media with identical "IAMAN" naming convention

The presence of "IAMAN" in both RM2 volume label and RM3 optical media, combined with PC access logs, confirms these devices were part of the same data exfiltration operation.

Evidence strength:
2 refs
tsk.filelisttsk.partitionsoptical.listingregistry.ntuser.informant

Evidence Chain

tc_943cdfdc search 4ms
tc_982e1d6d get_raw_output 81ms
Time: 2015-03-24T20:41:22 — 2015-03-25T15:29:08
Sources: tsk.filelist, tsk.partitions, optical.listing, registry.ntuser.informant
Evidence Refs: tc_943cdfdc, tc_982e1d6d
high confirmed User Activity Timeline - Data Access and Cleanup Patterns

The user "informant" exhibited a clear pattern of data access, exfiltration preparation, and anti-forensic cleanup activities:

March 22, 2015 - System Setup:
- User profile created 14:34:41
- IE11 installed (15:11:04)
- Google Chrome installed (15:11:51)
- Microsoft Office configured (15:03:28)
- Initial system configuration and software setup

March 23, 2015 - Secret Project File Access:
- 18:38:21 - Accessed [secret_project]_design_concept.ppt (MFT entry 71140)
- 20:01:53 - iCloud software installed
- 20:26:50 - Accessed Excel file (likely (secret_project)_pricing_decision.xlsx)
- 20:27:33 - Accessed [secret_project]_final_meeting.pptx (MFT entry 4166)
- Chrome browser used extensively (7 sessions)

March 24, 2015 - Data Staging Day:
- 13:47:58 - Shellbags show access to "S data\Secret Project Data\Secret Project Data\final"
- 20:41:22 - Drive D:\pd accessed (removable media or optical disc)
- 20:44:18 - winter_whether_advisory.zip accessed (RecentDocs confirms) - this file appears on RM2 with counterfeit extension
- Network share accessed: 10.11.11.128\\secured_drive\\Common Data
- Files with "secret_project" naming pattern systematically accessed

March 25, 2015 - Final Day and Cleanup:
- 14:42:47 - Windows Media Player used (possibly burning optical media)
- 14:46:05 - Internet Explorer used
- 14:47:40 - Eraser installer downloaded and executed
- 14:48:28 - CCleaner installer downloaded
- 14:50:14 - Eraser executed for secure deletion
- 14:54:25 - ASP.NET State Service installed (suspicious service modification)
- 15:12:28 - Eraser executed again (secure deletion)
- 15:15:50 - CCleaner executed (disk cleanup)
- 15:21:30 - Google Drive sync executed (cloud upload)
- 15:24:48 - Microsoft Word used (resignation letter)
- 15:28:47 - XPS viewer used (Resignation_Letter_(Iaman_Informant).xps)
- 15:29:08 - Final document activity: Resignation_Letter_(Iaman_Informant).docx

Key Evidence:
- ShimCache confirms Eraser execution (2015-01-12 22:56:36 and 2015-03-25 15:12:28)
- UserAssist logs show Eraser, CCleaner, and Google Drive all executed on final day
- RecentDocs shows progression from secret project files to resignation letter
- The sequence: data access → removable media connection → cleanup tools → cloud sync → resignation letter indicates deliberate data exfiltration followed by evidence destruction attempts

Evidence strength:
3 refs
registry.ntuser.informantez.shimcacheez.mftregistry.usrclass.informant

Evidence Chain

tc_5f5eae41 get_raw_output 80ms
tc_b075f148 get_raw_output 81ms
tc_c9690128 search 9ms
Time: 2015-03-22T14:34:41 — 2015-03-25T15:29:08
Sources: registry.ntuser.informant, ez.shimcache, ez.mft, registry.usrclass.informant
Evidence Refs: tc_5f5eae41, tc_b075f148, tc_c9690128
high confirmed Cloud Storage and File-Sharing Applications Used for Potential Exfiltration

The user installed and actively used multiple cloud storage and file-sharing applications, providing alternative exfiltration channels besides removable media:

Google Drive:
- Installation evidence: googledrivesync.exe in ShimCache (2015-02-19 18:24:24)
- Execution confirmed: UserAssist shows execution on 2015-03-25 15:21:30
- Google Drive.lnk shortcut in RecentDocs (accessed 2015-03-25 15:21:30)
- Bulk extractor found: tools.google.com/dlpage/drive URLs
- ShimCache entry: C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Executed=True)
- Context menu DLL registered: googledrivesync64.dll

iCloud:
- Installation date: 2015-03-23 20:01:01 (Apple Software Update)
- Installer downloaded: icloudsetup.exe (2015-03-23 19:56:53)
- Executed via: iCloud.exe (found in UserAssist without timestamp, but in execution history)
- Bulk extractor found: www.icloud.com URLs and Apple cloud infrastructure
- Mail.lnk created in Start Menu (2015-03-23 20:01:53)

Microsoft Outlook/Office 365:
- Outlook executed 5 times according to UserAssist (last: 2015-03-25 14:41:03)
- Email configuration found: iaman.informant@nist.gov and informant@nist.gov
- Outlook OST file evidence: formant@nist.gov.ost (Outlook data file)
- Exchange/O365 URLs found: outlook.office365.com
- Email addresses suggest NIST (National Institute of Standards and Technology) affiliation

File Transfer Evidence:
- Google Drive executed on final day (March 25, 2015) at 15:21:30
- This occurred AFTER Eraser and CCleaner cleanup, suggesting final cloud upload
- Timeline: Cleanup tools (14:50-15:15) → Google Drive sync (15:21) → Resignation letter (15:29)
- This sequence suggests uploading staged data to cloud storage before resignation

Exfiltration Channels:
1. Removable media (RM1, RM2, RM3) - primary method
2. Google Drive - cloud storage alternative
3. iCloud - additional cloud option
4. Email (Outlook/O365) - potential email exfiltration

The installation of multiple cloud storage services on a system handling sensitive government data, combined with their execution during the data exfiltration timeline, indicates deliberate preparation of alternative exfiltration pathways. The Google Drive sync execution on the final day, after running secure deletion tools, strongly suggests final data upload to cloud storage before severing employment.

Evidence strength:
3 refs
ez.shimcacheregistry.ntuser.informantregistry.softwarebulk.domain

Evidence Chain

tc_b075f148 get_raw_output 81ms
tc_5f5eae41 get_raw_output 80ms
tc_604e9672 search 9ms
Time: 2015-02-19T18:24:24 — 2015-03-25T15:21:30
Sources: ez.shimcache, registry.ntuser.informant, registry.software, bulk.domain
Evidence Refs: tc_b075f148, tc_5f5eae41, tc_604e9672
high inference Suspicious ASP.NET State Service Installation as Potential Persistence Mechanism

A Windows service installation was flagged as suspicious on March 25, 2015 at 14:54:25 during the cleanup phase of the exfiltration operation:

Service Details:
- Service Name: ASP.NET State Service
- Executable Path: %SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
- Account: LocalSystem (highest privilege level)
- Event ID: 7045 (Service Installation)
- Alert Level: HIGH (Hayabusa rule "Suspicious Service Path")

Timing Context:
The service was installed 26 minutes after Eraser execution (14:50:14) and 27 minutes before Google Drive sync (15:21:30), placing it squarely in the evidence cleanup and final exfiltration phase.

Suspicious Indicators:
1. Unusual Timing: ASP.NET State Service is not typically installed during user-initiated cleanup operations. It's a development/web server component.
2. High Privilege: Running as LocalSystem provides complete system access.
3. Context: Installation occurred during anti-forensic cleanup (Eraser, CCleaner already executed or about to be executed).
4. Hayabusa Alert: Flagged as "Suspicious Service Path" - a high-severity detection.

Persistence Potential (MITRE ATT&CK T1543.003):
ASP.NET State Service can be leveraged as a persistence mechanism. The legitimate aspnet_state.exe binary can be configured to:
- Start automatically on boot
- Run arbitrary code via service configuration
- Provide a隐蔽 backdoor mechanism that appears legitimate

Assessment:
While aspnet_state.exe is a legitimate Microsoft binary, the installation timing and context strongly suggest this was NOT a legitimate software requirement. The user was preparing to resign and had no documented need for ASP.NET development or web server functionality. The installation during the cleanup phase indicates either:
1. Preparation of a persistence mechanism for continued access after departure
2. Component of data collection/staging tools that required state management
3. Unintended side effect of other software installations during cleanup

Corroborating Evidence:
- User had already accessed and staged all government documents (March 22-24)
- Cleanup tools (Eraser, CCleaner) were executed around the same timeframe
- Google Drive sync occurred 27 minutes later (final data upload)
- User resigned the same day (resignation letter created 15:24-15:29)

This service installation represents either a persistence mechanism for future access or an indicator of additional tools used during the exfiltration operation that required state service management.

Evidence strength:
3 refs
composite.persistencehayabusa.alerts

Evidence Chain

tc_7306d9f2 get_raw_output 16ms
tc_94d54a5c search 4ms
tc_bfaf0b41 lookup_attack_technique 584ms
Time: 2015-03-25T14:54:25 — 2015-03-25T14:54:25
Sources: composite.persistence, hayabusa.alerts
Evidence Refs: tc_7306d9f2, tc_94d54a5c, tc_bfaf0b41
ATT&CK: T1543.003
high confirmed RM1 'Authorized USB' Role - Initial Staging for Secret Project Data

RM1 "Authorized USB" played the role of initial staging location for Secret Project Data before the documents were concealed with counterfeit extensions on RM2:

RM1 Characteristics:
- Volume Label: "Authorized USB"
- Filesystem: NTFS/exFAT
- Evidence Source: tsk.filelist (source 5)
- Directory Structure: Secret Project Data/Secret Project Data/design/
- File: [secret_project]_design_concept.ppt (partial match suggests additional files)

Timeline of RM1 Usage:

March 23, 2015 - Secret Project File Access:
- 18:38:21: [secret_project]_design_concept.ppt accessed from network share
- 20:26:50: Excel file (likely pricing decision) accessed
- 20:27:33: [secret_project]_final_meeting.pptx accessed

March 24, 2015 - USB Media Connection:
- 13:47:58: Secret Project Data/final folder accessed from network share
- 20:41:22: Drive D:\pd accessed (RM2 or RM3 connected to system)

RM1 vs RM2/RM3 Roles:

RM1 - "Authorized USB" (Initial Staging):
- Contains original Secret Project Data with actual filenames
- Files were NOT concealed with counterfeit extensions
- Represents the first copy of government data from network share
- Small subset of files compared to RM2/RM3

RM2 - "IAMAN $_@" (Concealed Staging):
- Contains 17 Office documents WITH counterfeit extensions
- All files in $OrphanFiles directories (deleted state)
- Government data: White House OMB, Library of Congress
- Files were NEVER transferred to RM1

RM3 - "IAMAN CD" (Optical Backup):
- Same files as RM2 burned to optical media
- 9 burn sessions with progressive obfuscation
- Write-once optical disc for permanent retention

Data Flow Reconstruction:

  1. Source: Network share 10.11.11.128\secured_drive\Common Data
  2. Initial Access: March 22-24, 2015 - files systematically accessed
  3. RM1 Copy: Secret Project Data copied to RM1 with original filenames (small subset)
  4. RM2 Staging: Government documents (OMB, LOC) copied to RM2 with counterfeit extensions
  5. RM3 Backup: Same RM2 files burned to optical media for permanent archive
  6. Deletion: Files deleted from RM2 after transfer (all marked deleted)

Assessment:

RM1 appears to be the "working copy" of Secret Project Data, possibly used for legitimate work purposes before the decision to exfiltrate was made. The "Authorized USB" label suggests this device may have had official approval for use, making it less suspicious than the "IAMAN" devices.

The government documents (White House OMB, Library of Congress) were NEVER copied to RM1 - they were only staged on RM2 and RM3 with counterfeit extensions, indicating they were the primary target of the exfiltration operation rather than routine work files.

Conclusion:

RM1 contains only a small subset of Secret Project Data with original filenames, while RM2/RM3 contain the full scope of exfiltrated government documents with deliberate concealment. RM1 represents initial/incidental staging, while RM2/RM3 represent the core exfiltration payload.

Evidence strength:
2 refs
tsk.filelistez.mftregistry.usrclass.informant

Evidence Chain

tc_cb048504 search 3ms
tc_8c7bfa14 search 3ms
Time: 2015-03-23T18:38:21 — 2015-03-24T20:41:22
Sources: tsk.filelist, ez.mft, registry.usrclass.informant
Evidence Refs: tc_cb048504, tc_8c7bfa14
medium inference Account Creation, Privilege Escalation, and Potential Unauthorized Access

Security event logs reveal suspicious account management activities occurring on March 22, 2015, the system's first day of activity:

Account Creation and Manipulation Timeline (March 22, 2015):

14:33:54 - Event ID 4732 (High): User S-1-5-21-2425377081-3129163575-2985601102-1000 (informant) added to local Administrators group
- Subject: WIN-D9RGPJQ68G8$ (computer account)
- This was system-initiated during initial setup

14:33:54 - Event ID 4724 (Medium): Password reset for user "informant"
- Performed by: WIN-D9RGPJQ68G8$ (system account)
- Part of initial account provisioning

15:51:54 - Event ID 4732 (High): User S-1-5-21-...-1001 (admin11) added to local Administrators group
- Subject: informant (user account)
- This was user-initiated privilege escalation

15:52:10 - Event ID 4724 (Medium): Password reset for user "admin11"
- Performed by: informant
- User "informant" resetting another user's password

15:52:30 - Event ID 4732 (High): User S-1-5-21-...-1002 (ITechTeam) added to local Administrators group
- Subject: informant (user account)
- Third user added to admins by informant

15:52:45 - Event ID 4724 (Medium): Password reset for user "ITechTeam"
- Performed by: informant

15:53:11 - Event ID 4724 (Medium): Password reset for user "temporary"
- Performed by: informant

Suspicious Aspects:
1. Three users (informant, admin11, ITechTeam) added to Administrators group within 2 hours
2. User "informant" performed password resets for three other accounts
3. User "informant" added two other users to admin group - unusual for non-IT personnel
4. Account names "admin11" and "ITechTeam" suggest attempt to create legitimate-looking IT accounts
5. "temporary" account created - possibly for covert access

Registry Evidence:
SAM database (registry.system, source 41) shows user accounts created:
- Administrator (built-in)
- admin11 (created 2015-03-22)
- ITechTeam (created 2015-03-22)
- temporary (created 2015-03-22)
- informant (primary user)

Hayabusa Alert:
High severity alert for "User Added To Local Admin Grp" triggered three times on March 22, 2015.

Assessment:
The rapid creation of multiple admin accounts, combined with password resets performed by a non-IT user, suggests either:
1. Legitimate initial system setup with multiple admin accounts
2. Attempt to establish backdoor admin access
3. Preparation for account takeover or impersonation

The timing (first day of system activity) and pattern (single user creating multiple admin accounts and resetting their passwords) indicates deliberate privilege escalation that could facilitate unauthorized access or provide persistent access after the user's departure.

Evidence strength:
1 ref
hayabusa.alertsregistry.system

Evidence Chain

tc_5b346b98 get_raw_output 81ms
Time: 2015-03-22T14:33:54 — 2015-03-22T15:53:11
Sources: hayabusa.alerts, registry.system
Evidence Refs: tc_5b346b98
ATT&CK: T1136.001, T1098
medium confirmed User Activity After Google Drive Sync Including Resignation Letter Processing

System activity continued after the Google Drive synchronization completed at 15:21:30 on March 25, 2015:

Timeline of Post-Google Drive Activity:

15:21:31 - 15:23:00 - Google Drive Sync Caching:
Multiple files created in "PathUnknown" directories (Google Drive sync cache):
- Python modules: pyexpat.pyd, win32pipe.pyd
- wxWidgets libraries: wxbase294u_vc90.dll, msvcp100.dll
- Google Drive UI resources: drive-gdraw16.png, drive-sync16.xpm, gdoc.icns
- Resource images and fonts: Roboto-Bold.ttf
- Internationalization files: zh_TW, zh-Hant, vi, th, sv, sk, pt_PT, pl, mr, lt, ja, hu, he, fil, en_US, el, cs, bg
Total: 45+ files cached between 15:21:30 and 15:23:00

15:22:07-08 - Temporary File Creation:
- ~DFAE9B0E173FA56C09.TMP created in user temp directory
- AccountChooser[1].htm cached in IE Temporary Internet Files (Google authentication interface)

15:24:51 - Email Web Activity:
- emailhrd[1].htm cached in IE Temporary Internet Files (email headers page)
- Indicates continued email/web activity after Google Drive sync

15:28:34-47 - Resignation Letter Processing:
- Microsoft temp directory created for XPS/document processing
- DDT.zj561dhn6z8ty0n51z1_1wfqb.tmp (183,340 bytes) created for document conversion
- XPS viewer executed at 15:28:47 (per UserAssist log: xpsrchvw.exe)

15:24:48 - Microsoft Word Executed:
Per UserAssist logs, Microsoft Word was executed to create resignation letter

Assessment:
The activity after 15:21:30 shows:
1. Google Drive sync completed with normal caching of UI resources and localization files
2. User continued web activity (email, authentication) after sync
3. Final document activity was resignation letter creation and XPS conversion
4. No evidence of additional data transfer or exfiltration channels after Google Drive sync

Conclusion:
The period after Google Drive sync was devoted to resignation letter preparation, not additional exfiltration. The Google Drive sync at 15:21:30 represents the final data upload before departure.

Evidence strength:
2 refs
ez.mftregistry.ntuser.informant

Evidence Chain

tc_6862bf0e search 50ms
tc_7c6e783a search 26ms
Time: 2015-03-25T15:21:30 — 2015-03-25T15:28:47
Sources: ez.mft, registry.ntuser.informant
Evidence Refs: tc_6862bf0e, tc_7c6e783a
medium inference Network Share Access via My Network Places Without Clear Authentication Logging

The network share at 10.11.11.128 was accessed via Windows "My Network Places" feature:

Access Evidence:
- Registry.usrclass shows: "My Network Places\10.11.11.128\10.11.11.128\secured_drive\Common Data"
- First accessed: 2015-03-22 14:52:22
- Accessed again: 2015-03-24 13:47:58 (final folder access before staging)
- Bulk_extractor shows: "10.11.11.128#secured_drive" embedded in OST file metadata

Authentication Method:
The available evidence does NOT clearly show the authentication method used to access the network share:

Missing Evidence:
- evtx.security source returned 0 windows - no security event logs captured
- No Event ID 4624 (successful logon) or 4625 (failed logon) available for analysis
- No Event ID 5140 (network share access) or 5145 (share access auditing) available

Inferred Authentication:
Based on available evidence:
1. The share was accessible via "My Network Places" suggesting mapped drive or shortcut
2. User credentials iaman.informant@nist.gov were likely used (domain joined system)
3. The OST file (formant@nist.gov.ost) suggests Outlook/Exchange connection, potentially providing cached credentials
4. No password prompts or authentication failures detected in available artifacts

Assessment:
The user likely accessed the network share using their domain credentials, possibly cached from prior authentication or provided automatically through domain membership. However, without security event logs (Event IDs 4624, 5140, 5145), the exact authentication method cannot be definitively determined.

Data Source Limitation:
The absence of evtx.security data (the source exists but contains 0 windows) prevents correlation of:
- Authentication type (Kerberos vs NTLM)
- Share access permissions
- Failed access attempts
- Lateral movement indicators

This is a critical gap for a complete forensic analysis of the initial access vector.

Evidence strength:
2 refs
registry.usrclass.informantbulk.domainevtx.security

Evidence Chain

tc_ff01dbc4 search 3ms
tc_11d05674 get_raw_output 82ms
Time: 2015-03-22T14:52:22 — 2015-03-24T13:47:58
Sources: registry.usrclass.informant, bulk.domain, evtx.security
Evidence Refs: tc_ff01dbc4, tc_11d05674
ATT&CK: T1078
medium inference Dormant Admin Accounts - Created for Future Backdoor Access, Not Used During Exfiltration

The secondary accounts (admin11, ITechTeam, temporary) created on March 22, 2015 show no evidence of being actively used during the exfiltration operation:

Account Creation Timeline (March 22, 2015):

15:33:54 - Initial Account Setup:
- User "informant" added to local Administrators group (Event ID 4732)
- System-initiated during initial setup

15:51:54 - admin11 Created:
- User "admin11" added to local Administrators group
- Password reset by user "informant" at 15:52:10

15:52:30 - ITechTeam Created:
- User "ITechTeam" added to local Administrators group
- Password reset by user "informant" at 15:52:45

15:53:11 - temporary Account:
- Password reset for user "temporary" by "informant"

Evidence of Account Usage:

NO Evidence Found:
- evtx.security: Source contains 0 windows - no security event logs available
- No Event ID 4624 (successful logon events) found in available evidence
- No Event ID 4625 (failed logon events) found
- No UserAssist entries for these accounts
- No RecentDocs for these accounts
- No ShimCache entries for these accounts
- No file access timestamps attributed to these accounts

Evidence GAP:
The absence of security event logs (evtx.security has 0 windows) prevents definitive determination of whether these accounts were used. However:

  1. All activity timestamps point to user "informant" as the sole active user
  2. All file access events were performed under "informant" context
  3. All cleanup tools (Eraser, CCleaner, Google Drive) were executed by "informant"
  4. Resignation letter was created by "informant"

Assessment:

Two Possible Scenarios:

Scenario 1 - Preemptive Backdoor Accounts:
The accounts were created for FUTURE access after the user's departure, not for use during the exfiltration. This is supported by:
- Creation on day 1 (within hours of system setup)
- No evidence of usage during the 4-day operation
- All exfiltration activities performed under primary account
- Naming conventions suggesting IT/administrative legitimacy

Scenario 2 - Unused Contingency:
The accounts were created as a contingency but never needed because:
- Primary account had sufficient privileges
- No security controls blocked primary account activities
- Exfiltration completed before resignation

Conclusion:

The secondary accounts appear to be dormant backdoor accounts created for potential future access AFTER the user's departure from NIST. All exfiltration activities (data access, staging, cleanup, cloud upload) were conducted under the primary "informant" account. However, without security event logs, definitive proof of non-usage cannot be established.

Risk Assessment:
These accounts should be considered active persistence mechanisms that could enable future unauthorized access if not disabled. Combined with the ASP.NET State Service installation (finding f_bac54b97), this suggests the insider was preparing multiple persistence pathways.

Evidence strength:
3 refs
hayabusa.alertsregistry.systemregistry.ntuser.informantez.shimcache

Evidence Chain

tc_0152539b search 3ms
tc_11d05674 get_raw_output 82ms
tc_7c6e783a search 26ms
Time: 2015-03-22T15:51:54 — 2015-03-25T15:29:08
Sources: hayabusa.alerts, registry.system, registry.ntuser.informant, ez.shimcache
Evidence Refs: tc_0152539b, tc_11d05674, tc_7c6e783a
info confirmed RM2 Filesystem Type and Absence of Windows Artifacts

RM2 is a FAT32 filesystem (partition type 0x0b) with no Windows registry or event log artifacts. Key observations:

Filesystem Type:
- FAT32 filesystem (Win95 FAT32, type 0x0b)
- No NTFS-specific artifacts ($MFT, USN Journal, $LogFile, etc.)
- No registry hive files (SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT)
- No Windows Event Log files (Security.evtx, Application.evtx, System.evtx, etc.)

Volume Label:
- Volume label: "IAMAN $_@" - unusual character pattern, possibly intentionally obscured
- No owner identification or normal user profile structure

Removable Media Characteristics:
- 1 GB partition typical of USB flash drives or memory cards
- All content in $OrphanFiles indicates files were copied then deleted
- No Windows shell artifacts (Shellbags, Prefetch, UserAssist) - absent from FAT32
- No registry traces of device connection or file access timestamps

FAT32 filesystems do not maintain registry hives or event logs. The absence of these artifacts on removable media is expected. Correlation of device connection to a Windows system would require analysis of the host PC's registry (USBSTOR entries, MountedDevices) or event logs (event ID 2003/2004 for device arrival). ROM that registry analysis would need to be performed on the PC image (cfreds_2015_data_leakage_pc.E01) not on RM2 itself.

Evidence strength:
2 refs
tsk.partitionstsk.filelist

Evidence Chain

tc_6cb7b05a get_raw_output 80ms
tc_19d674e6 get_raw_output 2ms
Sources: tsk.partitions, tsk.filelist
Evidence Refs: tc_6cb7b05a, tc_19d674e6
✓ Ruled Out (Negative Findings)

These hypotheses were explicitly tested and no supporting evidence was found.

  • No Steganographic Content Detected in RM2 Images
    Click to expand
0
Techniques
0
Tactics
0
Findings Mapped
Reconnaissance
Resource Development
Initial Access1
Execution
Persistence4
Privilege Escalation3
Defense Evasion2
Credential Access
Discovery
Lateral Movement
Collection2
Command and Control
Exfiltration
Impact
Inhibit Response Function
Evasion
Impair Process Control
Initial Access
Valid Accounts
1F
Persistence
Valid Accounts
1F
Account Manipulation
1F
Local Account
1F
Windows Service
1F
Privilege Escalation
Valid Accounts
1F
Account Manipulation
1F
Windows Service
1F
Defense Evasion
Rename Legitimate Utilities
1F
Valid Accounts
1F
Collection
Archive Collected Data
1F
Archive via Utility
1F
0
Total IOCs
0
External IPs
0
File IOCs
0
Emails
Network IOCs (1)
TypeValueEnrichmentContextActions
Internal IP 10.11.11.128 User Activity Timeline - Data Access and Cleanup Patterns VT
File IOCs (1)
TypeValueEnrichmentContextActions
Path C:\Program Cloud Storage and File-Sharing Applications Used for Potential Exfiltration
Email IOCs (5)
TypeValueEnrichmentContextActions
Email eric_p._lauer@omb.eop.gov Government Email Addresses on RM2 Indicating Data Theft
Email mmun@loc.gov Government Email Addresses on RM2 Indicating Data Theft
Email wayne.longman@att.net Government Email Addresses on RM2 Indicating Data Theft
Email iaman.informant@nist.gov Cloud Storage and File-Sharing Applications Used for Potential Exfiltration
Email informant@nist.gov Cloud Storage and File-Sharing Applications Used for Potential Exfiltration
Select a source
Select a source from the tree to view raw evidence output.
Source Name Extractor Lines Hash Referenced By
tsk.partitions sleuthkit 10 blake2b:67b9085f... 3 findings
tsk.filelist sleuthkit 104709 blake2b:171e0914... 7 findings
tsk.filelist.p1 sleuthkit 93 blake2b:5bdfadd3... 7 findings
tsk.partitions sleuthkit 8 blake2b:3eed10c8... 3 findings
tsk.filelist sleuthkit 27 blake2b:ae86d6dd... 7 findings
tsk.partitions sleuthkit 9 blake2b:83c0b87c... 3 findings
tsk.filelist sleuthkit 51 blake2b:55fc9962... 7 findings
tsk.masquerade sleuthkit 17 blake2b:97440a18... 4 findings
bulk.bulk_extractor bulk_extractor 1 blake2b:5a2f53fa...
bulk.domain bulk_extractor 189 blake2b:ae916b75... 6 findings
bulk.duplicates bulk_extractor 9 blake2b:bb406faf...
bulk.url bulk_extractor 207 blake2b:039de0b6... 6 findings
bulk.url_services bulk_extractor 14 blake2b:2eac1377... 6 findings
bulk.bulk_extractor bulk_extractor 1 blake2b:833c8cad...
bulk.domain bulk_extractor 264 blake2b:c8b97b94... 6 findings
bulk.duplicates bulk_extractor 9 blake2b:9ba9de0c...
bulk.email bulk_extractor 43 blake2b:eb085c00... 6 findings
bulk.rfc822 bulk_extractor 41 blake2b:283d0ef9... 3 findings
bulk.url bulk_extractor 288 blake2b:d727c498... 6 findings
bulk.url_services bulk_extractor 19 blake2b:01e609ea... 6 findings
hashdeep.hashes hashdeep 6 blake2b:c270e797...
exiftool.metadata exiftool 9 blake2b:154e6ac2...
tsk.masquerade sleuthkit 0 blake2b:empty... 4 findings
tsk.masquerade sleuthkit 3 blake2b:42bb5e7d... 4 findings
bulk.bulk_extractor bulk_extractor 1 blake2b:d8c5b229...
bulk.domain bulk_extractor 366963 blake2b:a9b12e0b... 6 findings
bulk.duplicates bulk_extractor 12 blake2b:f8b9f6c0...
bulk.email bulk_extractor 6851 blake2b:495ab267... 6 findings
bulk.ether bulk_extractor 6 blake2b:0825117f...
bulk.exif bulk_extractor 793 blake2b:2158d20a...
bulk.rfc822 bulk_extractor 7326 blake2b:d7e448fc... 3 findings
bulk.url bulk_extractor 421750 blake2b:514ec196... 6 findings
bulk.url_facebook-address bulk_extractor 19 blake2b:7fe55073... 6 findings
bulk.url_searches bulk_extractor 155 blake2b:b928562c... 6 findings
bulk.url_services bulk_extractor 3637 blake2b:c01e89c3... 6 findings
bulk.wordlist bulk_extractor 12892267 blake2b:842c543b...
bulk.wordlist_dedup_1 bulk_extractor 10051216 blake2b:6e833a85...
ez.mft eztools 98918 blake2b:38f6f1ca... 4 findings
ez.shimcache eztools 307 blake2b:9282f4f7... 4 findings
registry.default regripper 418 blake2b:c385c021...
registry.system regripper 186 blake2b:f8791c8b... 2 findings
evtx.manifest evtx-extract 54 blake2b:62bd3681...
registry.system regripper 7 blake2b:e4c6f012... 2 findings
registry.system regripper 7 blake2b:e4c6f012... 2 findings
registry.security regripper 69 blake2b:6b7bf22c...
registry.security regripper 8 blake2b:3c5e87f4...
registry.software regripper 33492 blake2b:d9cbadb2... 1 finding
registry.software regripper 283 blake2b:b35cb208... 1 finding
registry.software regripper 283 blake2b:86dee92d... 1 finding
registry.system regripper 5209 blake2b:56ed4b8f... 2 findings
registry.system regripper 199 blake2b:cfa4a817... 2 findings
registry.system regripper 199 blake2b:64bb7fd9... 2 findings
hayabusa.alerts hayabusa 35 blake2b:b10f2bdc... 3 findings
registry.system regripper 381 blake2b:070a4d56... 2 findings
registry.system regripper 255 blake2b:0d77cf74... 2 findings
registry.system regripper 255 blake2b:0d77cf74... 2 findings
registry.usrclass.admin11 regripper 11 blake2b:26a43778...
registry.ntuser.admin11 regripper 133 blake2b:bf617a09...
registry.ntuser.default regripper 74 blake2b:8518dc3f...
registry.usrclass.informant regripper 102 blake2b:9f1344c3... 4 findings
registry.ntuser.informant regripper 306 blake2b:597d71cd... 6 findings
registry.usrclass.temporary regripper 15 blake2b:3ef5eb22...
registry.ntuser.temporary regripper 118 blake2b:800424ee...
optical.listing mulder-optical 58 blake2b:65ca19c0... 4 findings
hashdeep.hashes hashdeep 6 blake2b:28ba0ef4...
bulk.bulk_extractor bulk_extractor 1 blake2b:9080f50b...
bulk.domain bulk_extractor 237 blake2b:29444e46... 6 findings
bulk.email bulk_extractor 12 blake2b:26c081a6... 6 findings
bulk.exif bulk_extractor 21 blake2b:c2dd544d...
bulk.rfc822 bulk_extractor 41 blake2b:e3da4d10... 3 findings
bulk.url bulk_extractor 300 blake2b:28d82359... 6 findings
bulk.url_services bulk_extractor 21 blake2b:6224c8f2... 6 findings
bulk.wordlist bulk_extractor 260533 blake2b:227c14b0...
bulk.wordlist_dedup_1 bulk_extractor 166668 blake2b:f4f06c1b...
composite.execution composite 122 blake2b:3eb764d8...
composite.timeline composite 172 blake2b:0b3e04d6...
composite.correlation composite 1 blake2b:55f8a248...
composite.lateral_movement composite 513 blake2b:4cf5d92f...
composite.persistence composite 2471 blake2b:14db3ff4... 1 finding
composite.exfil composite 2432 blake2b:2b5fdbda...
composite.defense_evasion composite 230 blake2b:c4607e26...
composite.correlation composite 1 blake2b:3c57f51d...
composite.lateral_movement composite 544 blake2b:19785f2a...
composite.exfil composite 2438 blake2b:4672475e...
composite.defense_evasion composite 240 blake2b:825b24ed...
composite.persistence composite 2471 blake2b:0bd6a1a1... 1 finding
composite.timeline composite 172 blake2b:0b3e04d6...
composite.execution composite 122 blake2b:3eb764d8...
composite.correlation composite 1 blake2b:4639f14d...
composite.correlation composite 1 blake2b:e0df3210...
composite.correlation composite 1 blake2b:d316bd44...
composite.correlation composite 1 blake2b:658e498d...
0
Tool Calls
0
Unique Tools
1193.7s
Processing Time
8,804,860
Tokens
442,583
Tokens/min
Tool Distribution
Token Breakdown
Input Tokens8,659,437
Output Tokens145,423
Total Tokens8,804,860
Per-Model Breakdown
bedrock/zai.glm-58,804,860
Token Throughput Over Time
Estimated token consumption by model over time. Each bar represents a 5-minute window.
ID Tool Duration Timestamp Actions
tc_2c7bcd29 scan_evidence 2163ms 2026-09-20T04:38:36
tc_db79d98b list_sources 2ms 2026-09-20T04:38:40
tc_fb688619 get_source_stats 2ms 2026-09-20T04:38:40
tc_cbcd6f0e open_case 29ms 2026-09-20T04:39:00
tc_da61b5e6 open_case 31ms 2026-09-20T04:39:01
tc_5be16a64 open_case 30ms 2026-09-20T04:39:01
tc_1e1cfeb5 list_directory 3ms 2026-09-20T04:39:09
tc_465fa9a9 list_cases 5ms 2026-09-20T04:39:13
tc_6d77a450 open_case 31ms 2026-09-20T04:39:25
tc_e3595874 start_extraction_batch 9ms 2026-09-20T04:39:27
tc_1c007237 run_mmls 63ms 2026-09-20T04:39:27
tc_3357aac8 open_case 38ms 2026-09-20T04:39:37
tc_e0bbe280 run_fls 10439ms 2026-09-20T04:39:37
tc_5f01d53d start_extraction_batch 14ms 2026-09-20T04:39:43
tc_7276dcc8 run_mmls 51ms 2026-09-20T04:39:43
tc_ae18c184 run_fls 4880ms 2026-09-20T04:39:48
tc_8eb1d0f8 open_case 81ms 2026-09-20T04:39:52
tc_d1f39982 start_extraction_batch 30ms 2026-09-20T04:39:55
tc_5e81ecbd run_mmls 115ms 2026-09-20T04:39:56
tc_2c52f49d run_fls 2086ms 2026-09-20T04:39:58
tc_563c8f1d detect_masquerading 3895ms 2026-09-20T04:39:59
tc_333e22df run_bulk_extractor 89795ms 2026-09-20T04:41:13
tc_d6c2d692 run_bulk_extractor 92347ms 2026-09-20T04:41:28
tc_5eb1f6fe get_completed_results 0ms 2026-09-20T04:41:30
tc_c2d350d0 start_extraction_batch 16ms 2026-09-20T04:41:37
tc_c2fd1aa4 start_extraction_batch 6ms 2026-09-20T04:41:55
tc_d6c64831 run_hashdeep 2154ms 2026-09-20T04:41:58
tc_32e66cbe analyze_pdf 0ms 2026-09-20T04:41:59
tc_90f14eff start_extraction_batch 7ms 2026-09-20T04:41:59
tc_cf364c1e analyze_office_document 0ms 2026-09-20T04:42:14
tc_37d19e79 detect_steganography 0ms 2026-09-20T04:42:15
tc_c6f433e8 run_exiftool 116ms 2026-09-20T04:42:16
tc_f19ff4bb run_evtx_parser 0ms 2026-09-20T04:42:20
tc_135e3862 run_registry_parser 6768ms 2026-09-20T04:42:24
tc_93a8cf65 wait_all 20001ms 2026-09-20T04:42:25
tc_9da47439 get_completed_results 0ms 2026-09-20T04:42:34
tc_41a23aae get_completed_results 0ms 2026-09-20T04:42:38
tc_0d30ca0b get_completed_results 0ms 2026-09-20T04:42:40
tc_e0df9f1d open_case 87ms 2026-09-20T04:42:52
tc_7f266622 wait_all 0ms 2026-09-20T04:42:52
tc_969e47a8 open_case 92ms 2026-09-20T04:43:00
tc_8dd86a37 list_sources 3ms 2026-09-20T04:43:02
tc_0aca1b17 get_raw_output 6ms 2026-09-20T04:43:49
tc_9d680dfd list_partitions 2ms 2026-09-20T04:43:51
tc_40ef6bf1 detect_masquerading 4241ms 2026-09-20T04:43:53
tc_dd610914 get_raw_output 5ms 2026-09-20T04:43:54
tc_4b43855b get_raw_output 7ms 2026-09-20T04:44:00
tc_1b99dc55 get_raw_output 5ms 2026-09-20T04:44:09
tc_fe1af012 get_completed_results 0ms 2026-09-20T04:44:11
tc_787773ae search 7ms 2026-09-20T04:44:13
tc_5bdac589 get_raw_output 5ms 2026-09-20T04:44:21
tc_5bc6c48e detect_masquerading 300063ms 2026-09-20T04:44:27
tc_146b0abc get_raw_output 5ms 2026-09-20T04:44:29
tc_cc8626cf start_extraction_batch 9ms 2026-09-20T04:44:32
tc_419593e3 run_mft_parser 37ms 2026-09-20T04:44:32
tc_55d580ad run_amcache_parser 1680ms 2026-09-20T04:44:34
tc_ef1a75a4 analyze_disk_pcaps 2600ms 2026-09-20T04:44:35
tc_dc827e98 list_files 168ms 2026-09-20T04:44:39
tc_782da4f5 run_shimcache_parser 3897ms 2026-09-20T04:44:41
tc_16196f8c run_registry_parser 4142ms 2026-09-20T04:44:41
tc_4dc5e837 run_prefetch_parser 6045ms 2026-09-20T04:44:43
tc_672f3e39 search 3ms 2026-09-20T04:44:48
tc_4f2f9a52 get_completed_results 0ms 2026-09-20T04:44:49
tc_84b2b344 search 3ms 2026-09-20T04:44:54
tc_19d674e6 get_raw_output 2ms 2026-09-20T04:45:08
tc_d43cc0fc start_extraction_batch 3ms 2026-09-20T04:45:11
tc_123bea1f query_registry_value 0ms 2026-09-20T04:45:15
tc_82e93b1b get_raw_output 6ms 2026-09-20T04:45:17
tc_cc987ab2 query_registry_value 0ms 2026-09-20T04:45:17
tc_e53b0d46 query_registry_value 0ms 2026-09-20T04:45:19
tc_6f5ebdd5 query_registry_value 0ms 2026-09-20T04:45:20
tc_ae73bcd5 run_evtx_parser 0ms 2026-09-20T04:45:21
tc_3883f686 run_hayabusa 9398ms 2026-09-20T04:45:21
tc_6ae7b75e get_raw_output 9ms 2026-09-20T04:45:26
tc_66b55ef1 get_completed_results 0ms 2026-09-20T04:45:37
tc_5ebfd6b0 search 3ms 2026-09-20T04:45:48
tc_27e39dcf open_case 29ms 2026-09-20T04:46:11
tc_3cf82a76 submit_finding 941ms 2026-09-20T04:46:16
tc_3ffe405c get_investigation_summary 5ms 2026-09-20T04:46:16
tc_45f58e4b list_sources 1ms 2026-09-20T04:46:16
tc_10da9241 get_raw_output 24ms 2026-09-20T04:46:39
tc_eabf83f4 run_bulk_extractor 431791ms 2026-09-20T04:46:39
tc_3ebb6a0f get_completed_results 0ms 2026-09-20T04:46:40
tc_c88f4f80 list_files 144ms 2026-09-20T04:46:45
tc_f1ffe2e1 get_raw_output 22ms 2026-09-20T04:46:45
tc_846d1388 search 5ms 2026-09-20T04:46:49
tc_621caa1c search 5ms 2026-09-20T04:46:49
tc_a09ca883 search 4ms 2026-09-20T04:46:49
tc_1eb089b5 update_finding 10ms 2026-09-20T04:46:49
tc_9b7b324a search 4ms 2026-09-20T04:46:49
tc_657fc1f6 get_raw_output 64ms 2026-09-20T04:47:07
tc_775fb911 get_raw_output 64ms 2026-09-20T04:47:07
tc_5e23b28f get_investigation_summary 4ms 2026-09-20T04:47:15
tc_aeb46a71 submit_finding 9ms 2026-09-20T04:47:17
tc_b7a8dd29 open_case 31ms 2026-09-20T04:47:21
tc_4a2084af list_sources 2ms 2026-09-20T04:47:25
tc_c976f2d7 start_extraction_batch 200ms 2026-09-20T04:47:28
tc_ab124952 run_chainsaw 2353ms 2026-09-20T04:47:30
tc_e545b08c run_amcache_parser 0ms 2026-09-20T04:47:32
tc_751f3f5f start_extraction_batch 3ms 2026-09-20T04:47:34
tc_a2f14775 run_mft_parser 6888ms 2026-09-20T04:47:34
tc_3cefcf8a list_directory 2ms 2026-09-20T04:47:34
tc_4a97fb10 submit_finding 7ms 2026-09-20T04:47:35
tc_4bd058d3 run_shimcache_parser 11435ms 2026-09-20T04:47:39
tc_39893313 run_evtx_parser 7842ms 2026-09-20T04:47:41
tc_5355cc90 run_prefetch_parser 16219ms 2026-09-20T04:47:44
tc_fb64912b run_hayabusa 24025ms 2026-09-20T04:47:51
tc_097d3e43 yara_scan_files 26377ms 2026-09-20T04:47:54
tc_f68ea821 run_registry_parser 37477ms 2026-09-20T04:48:05
tc_8b29c707 wait_all 30001ms 2026-09-20T04:48:05
tc_2b10cbd8 open_case 30ms 2026-09-20T04:48:09
tc_6cb7b05a get_raw_output 80ms 2026-09-20T04:48:10
tc_0ef2a639 start_extraction_batch 7ms 2026-09-20T04:48:30
tc_49b764ba run_optical_listing 78ms 2026-09-20T04:48:30
tc_b4016ae3 run_hashdeep 522ms 2026-09-20T04:48:31
tc_29860d74 run_bulk_extractor 7526ms 2026-09-20T04:48:38
tc_5846b7d5 get_completed_results 0ms 2026-09-20T04:48:42
tc_7f615481 get_completed_results 0ms 2026-09-20T04:48:46
tc_efc25f5d get_completed_results 0ms 2026-09-20T04:48:46
tc_2597f988 submit_finding 9ms 2026-09-20T04:48:48
tc_858f30e9 get_raw_output 84ms 2026-09-20T04:48:53
tc_5c2a6439 open_case 30ms 2026-09-20T04:48:58
tc_fd9b418a start_extraction_batch 1ms 2026-09-20T04:49:06
tc_92fde33a search 3ms 2026-09-20T04:49:06
tc_c4c47b3e get_investigation_summary 5ms 2026-09-20T04:49:06
tc_a2e3579c list_sources 1ms 2026-09-20T04:49:06
tc_3f887295 get_raw_output 84ms 2026-09-20T04:49:09
tc_0e2d676a get_raw_output 81ms 2026-09-20T04:49:09
tc_3be7a838 get_completed_results 0ms 2026-09-20T04:49:23
tc_57f2c315 submit_finding 10ms 2026-09-20T04:49:25
tc_c8f437a9 search 4ms 2026-09-20T04:49:27
tc_7378bd4b get_raw_output 24ms 2026-09-20T04:49:27
tc_0538d8ab get_raw_output 23ms 2026-09-20T04:49:27
tc_ccd2b70e search 4ms 2026-09-20T04:49:30
tc_b5e35fb5 search 84ms 2026-09-20T04:49:30
tc_8cb37f97 get_raw_output 18ms 2026-09-20T04:49:33
tc_ca045926 get_raw_output 24ms 2026-09-20T04:49:33
tc_faa187d6 open_case 30ms 2026-09-20T04:49:37
tc_3bbea277 wait_all 0ms 2026-09-20T04:49:38
tc_16696cbc get_findings 1ms 2026-09-20T04:49:38
tc_ef225c15 search 10ms 2026-09-20T04:49:38
tc_9e97ea67 open_case 31ms 2026-09-20T04:49:52
tc_9ebe29f0 get_investigation_summary 5ms 2026-09-20T04:49:54
tc_c637efa1 list_sources 2ms 2026-09-20T04:49:54
tc_4a7b2a3a get_findings 1ms 2026-09-20T04:49:57
tc_f7f6fb14 search 6ms 2026-09-20T04:49:58
tc_6f6c6ca3 get_raw_output 81ms 2026-09-20T04:49:58
tc_6563735c search 4ms 2026-09-20T04:49:59
tc_a0deef7e search 33ms 2026-09-20T04:49:59
tc_ec773598 submit_finding 11ms 2026-09-20T04:50:07
tc_736de282 search 8ms 2026-09-20T04:50:19
tc_b075f148 get_raw_output 81ms 2026-09-20T04:50:20
tc_6fe6c924 search 4ms 2026-09-20T04:50:20
tc_5b346b98 get_raw_output 81ms 2026-09-20T04:50:20
tc_ad34036d get_raw_output 23ms 2026-09-20T04:50:26
tc_4a7dc1e9 submit_finding 11ms 2026-09-20T04:50:33
tc_025b4556 search 4ms 2026-09-20T04:50:36
tc_d9132847 search 5ms 2026-09-20T04:50:36
tc_b2cc3823 search 6ms 2026-09-20T04:50:42
tc_5f5eae41 get_raw_output 80ms 2026-09-20T04:50:42
tc_604e9672 search 9ms 2026-09-20T04:50:42
tc_a72dd9f8 submit_finding 14ms 2026-09-20T04:51:04
tc_a22e2615 get_raw_output 16ms 2026-09-20T04:51:04
tc_d15b6140 get_raw_output 14ms 2026-09-20T04:51:05
tc_b5893178 get_raw_output 15ms 2026-09-20T04:51:05
tc_c9690128 search 9ms 2026-09-20T04:51:07
tc_34fbda4a parse_mft 37ms 2026-09-20T04:51:08
tc_f2da5373 get_timeline 17ms 2026-09-20T04:51:09
tc_5e6d6001 search 4ms 2026-09-20T04:51:19
tc_dc6dc72d get_investigation_summary 4ms 2026-09-20T04:51:21
tc_42ba6838 list_partitions 2ms 2026-09-20T04:51:35
tc_943cdfdc search 4ms 2026-09-20T04:51:35
tc_3e4497e3 submit_finding 12ms 2026-09-20T04:51:36
tc_982e1d6d get_raw_output 81ms 2026-09-20T04:51:36
tc_f2e3d616 submit_finding 11ms 2026-09-20T04:51:50
tc_c3733ab2 track_progress 9ms 2026-09-20T04:51:56
tc_fc55b702 update_finding 9ms 2026-09-20T04:52:02
tc_615d0c5f submit_finding 9ms 2026-09-20T04:52:17
tc_03483b84 get_raw_output 23ms 2026-09-20T04:52:18
tc_3e065cc1 submit_finding 12ms 2026-09-20T04:52:34
tc_89209757 get_investigation_summary 4ms 2026-09-20T04:52:34
tc_9d9af2b2 search 4ms 2026-09-20T04:52:42
tc_c993e14e search 3ms 2026-09-20T04:52:42
tc_83e2ea83 submit_finding 11ms 2026-09-20T04:52:46
tc_0f924fe3 submit_finding 11ms 2026-09-20T04:52:57
tc_cfbd6cb9 submit_finding 12ms 2026-09-20T04:53:13
tc_eb6e1fe3 search 5ms 2026-09-20T04:53:16
tc_fab161c9 track_progress 9ms 2026-09-20T04:53:42
tc_a3b69ed6 get_findings 2ms 2026-09-20T04:53:42
tc_7c6812b6 submit_finding 11ms 2026-09-20T04:53:54
tc_018f9c6e track_progress 8ms 2026-09-20T04:54:10
tc_5246b30e get_investigation_summary 4ms 2026-09-20T04:54:18
tc_13f30da5 get_findings 1ms 2026-09-20T04:54:21
tc_d9087652 get_findings 2ms 2026-09-20T04:54:32
tc_d6f5506c get_investigation_summary 3ms 2026-09-20T04:55:13
tc_8d477997 get_investigation_summary 4ms 2026-09-20T04:55:58
tc_e775d846 open_case 32ms 2026-09-20T04:56:02
tc_0cb42eb1 get_findings 3ms 2026-09-20T04:56:04
tc_391af966 get_investigation_summary 4ms 2026-09-20T04:56:05
tc_da9a3c4a list_sources 2ms 2026-09-20T04:56:05
tc_dc32afe7 get_source_stats 80ms 2026-09-20T04:56:05
tc_0cb72b11 get_timeline 23ms 2026-09-20T04:56:24
tc_a1063c01 get_bookmarks 1ms 2026-09-20T04:56:24
tc_b1917b25 open_case 32ms 2026-09-20T04:57:23
tc_cd04c1c1 get_process_tree 13ms 2026-09-20T04:57:28
tc_ff52c2c5 find_execution_evidence._query(ez.shimcache) 25ms 2026-09-20T04:57:28
tc_e225f5d5 find_execution_evidence 27ms 2026-09-20T04:57:28
tc_1ecb847e reconstruct_execution_chains._query(volatility.pstree) 23ms 2026-09-20T04:57:28
tc_6606e2af find_persistence_mechanisms._query(registry.system) 44ms 2026-09-20T04:57:28
tc_23e2fe9a find_suspicious_processes._query(volatility.malfind) 25ms 2026-09-20T04:57:28
tc_442e600b analyze_execution_timeline._query(ez.shimcache) 24ms 2026-09-20T04:57:28
tc_152204a2 analyze_execution_timeline 56ms 2026-09-20T04:57:28
tc_803d7200 reconstruct_execution_chains._query(volatility.cmdline) 27ms 2026-09-20T04:57:28
tc_8077b1ca find_suspicious_processes._query(volatility.cmdline) 23ms 2026-09-20T04:57:28
tc_3ce8ab15 find_persistence_mechanisms._query(registry.software) 38ms 2026-09-20T04:57:28
tc_5551f13c reconstruct_execution_chains._query(volatility.netscan) 25ms 2026-09-20T04:57:28
tc_2900dd27 find_suspicious_processes._query(volatility.netscan) 22ms 2026-09-20T04:57:28
tc_d5c446db correlate_across_sources 119ms 2026-09-20T04:57:28
tc_c31daa1c find_persistence_mechanisms._query(volatility.svcscan) 17ms 2026-09-20T04:57:28
tc_018778a0 reconstruct_execution_chains._query(volatility.malfind) 16ms 2026-09-20T04:57:28
tc_72708bf3 reconstruct_execution_chains 100ms 2026-09-20T04:57:28
tc_7c1bc7b1 find_suspicious_processes._query(volatility.pstree) 17ms 2026-09-20T04:57:28
tc_550c151e find_suspicious_processes 98ms 2026-09-20T04:57:28
tc_6df11f4c find_persistence_mechanisms._search(all) 42ms 2026-09-20T04:57:28
tc_93fbbb2c find_persistence_mechanisms._search(all) 18ms 2026-09-20T04:57:28
tc_4a181f79 find_persistence_mechanisms._query(ez.shimcache) 17ms 2026-09-20T04:57:28
tc_c9ef4e8c find_lateral_movement_indicators._search(all) 179ms 2026-09-20T04:57:28
tc_2cf62da0 find_persistence_mechanisms._search(all) 23ms 2026-09-20T04:57:28
tc_9b7a298c find_lateral_movement_indicators._search(all) 22ms 2026-09-20T04:57:28
tc_052b1430 find_lateral_movement_indicators._search(all) 12ms 2026-09-20T04:57:28
tc_41d96d8a find_lateral_movement_indicators._query(volatility.netscan) 15ms 2026-09-20T04:57:28
tc_8aee5119 find_lateral_movement_indicators._search(all) 11ms 2026-09-20T04:57:28
tc_86b09965 find_lateral_movement_indicators._search(all) 8ms 2026-09-20T04:57:28
tc_cb40a4a6 find_lateral_movement_indicators._search(all) 16ms 2026-09-20T04:57:28
tc_1778e359 find_lateral_movement_indicators 304ms 2026-09-20T04:57:28
tc_17cfd996 find_persistence_mechanisms._query(tsk.filelist) 94ms 2026-09-20T04:57:28
tc_e584f7b1 find_persistence_mechanisms 347ms 2026-09-20T04:57:28
tc_9a32f66c find_data_exfiltration_indicators._query(bulk.url) 547ms 2026-09-20T04:57:29
tc_fdbf2801 find_data_exfiltration_indicators._query(bulk.email) 18ms 2026-09-20T04:57:29
tc_e251870a find_data_exfiltration_indicators._query(bulk.domain) 155ms 2026-09-20T04:57:30
tc_a9f50673 find_data_exfiltration_indicators._search(all) 26ms 2026-09-20T04:57:30
tc_3c246e43 find_data_exfiltration_indicators 1735ms 2026-09-20T04:57:30
tc_2e26caae find_defense_evasion._search(all) 14ms 2026-09-20T04:57:33
tc_3bd003d0 find_defense_evasion._search(ez.mft) 25ms 2026-09-20T04:57:33
tc_55bb2ecd find_defense_evasion._search(all) 9ms 2026-09-20T04:57:33
tc_75f8f542 find_defense_evasion._search(all) 21ms 2026-09-20T04:57:33
tc_135a2541 find_defense_evasion._search(all) 12ms 2026-09-20T04:57:33
tc_036bf66e find_defense_evasion 96ms 2026-09-20T04:57:33
tc_9a4d495a correlate_across_sources 40ms 2026-09-20T04:58:53
tc_08a3e822 find_lateral_movement_indicators._search(all) 108ms 2026-09-20T04:58:53
tc_09df0edf find_lateral_movement_indicators._search(all) 12ms 2026-09-20T04:58:53
tc_159d4ddb find_lateral_movement_indicators._search(all) 11ms 2026-09-20T04:58:53
tc_4cad8dcc find_lateral_movement_indicators._query(volatility.netscan) 15ms 2026-09-20T04:58:53
tc_2353b67a find_lateral_movement_indicators._search(all) 10ms 2026-09-20T04:58:53
tc_3eaf4e48 find_lateral_movement_indicators._search(all) 8ms 2026-09-20T04:58:53
tc_81082a2a find_lateral_movement_indicators._search(all) 14ms 2026-09-20T04:58:53
tc_1cf67bb6 find_lateral_movement_indicators 199ms 2026-09-20T04:58:53
tc_f1276683 find_data_exfiltration_indicators._query(bulk.url) 425ms 2026-09-20T04:58:54
tc_0088d91e find_data_exfiltration_indicators._query(bulk.email) 19ms 2026-09-20T04:58:55
tc_dcb2c9b3 find_data_exfiltration_indicators._query(bulk.domain) 96ms 2026-09-20T04:58:55
tc_94d3ef34 find_data_exfiltration_indicators._search(all) 26ms 2026-09-20T04:58:55
tc_03492ef7 find_data_exfiltration_indicators 1555ms 2026-09-20T04:58:55
tc_de1498a6 find_defense_evasion._search(all) 14ms 2026-09-20T04:58:55
tc_fead979b find_defense_evasion._search(ez.mft) 24ms 2026-09-20T04:58:55
tc_69f998b9 find_defense_evasion._search(all) 9ms 2026-09-20T04:58:55
tc_407af625 find_defense_evasion._search(all) 22ms 2026-09-20T04:58:55
tc_e644385d find_defense_evasion._search(all) 12ms 2026-09-20T04:58:55
tc_dacfbb26 find_defense_evasion 95ms 2026-09-20T04:58:55
tc_6ef6c3c0 find_persistence_mechanisms._query(registry.system) 17ms 2026-09-20T04:58:55
tc_e4fe6d3f find_persistence_mechanisms._query(registry.software) 21ms 2026-09-20T04:58:55
tc_89f8a192 find_persistence_mechanisms._query(volatility.svcscan) 15ms 2026-09-20T04:58:55
tc_c9d3007b find_persistence_mechanisms._search(all) 18ms 2026-09-20T04:58:55
tc_1a2acd64 find_persistence_mechanisms._search(all) 8ms 2026-09-20T04:58:55
tc_ad7cf987 find_persistence_mechanisms._query(ez.shimcache) 15ms 2026-09-20T04:58:55
tc_c6826976 find_persistence_mechanisms._search(all) 11ms 2026-09-20T04:58:55
tc_6a016327 find_persistence_mechanisms._query(tsk.filelist) 47ms 2026-09-20T04:58:56
tc_6f445194 find_persistence_mechanisms 211ms 2026-09-20T04:58:56
tc_a9e2d6a6 analyze_execution_timeline._query(ez.shimcache) 16ms 2026-09-20T04:59:05
tc_fdb577a5 analyze_execution_timeline 21ms 2026-09-20T04:59:05
tc_28d810ea get_process_tree 1ms 2026-09-20T04:59:05
tc_d069b86f find_execution_evidence._query(ez.shimcache) 15ms 2026-09-20T04:59:06
tc_e455607b find_execution_evidence 22ms 2026-09-20T04:59:06
tc_789ddc3f reconstruct_execution_chains._query(volatility.pstree) 17ms 2026-09-20T04:59:06
tc_39ab0558 reconstruct_execution_chains._query(volatility.cmdline) 16ms 2026-09-20T04:59:06
tc_114f7cf1 reconstruct_execution_chains._query(volatility.netscan) 16ms 2026-09-20T04:59:06
tc_9b5bdf79 reconstruct_execution_chains._query(volatility.malfind) 16ms 2026-09-20T04:59:06
tc_a8848cab reconstruct_execution_chains 80ms 2026-09-20T04:59:06
tc_05f82ef3 find_suspicious_processes._query(volatility.malfind) 16ms 2026-09-20T04:59:06
tc_cc4d17a1 find_suspicious_processes._query(volatility.cmdline) 16ms 2026-09-20T04:59:06
tc_3a010085 find_suspicious_processes._query(volatility.netscan) 16ms 2026-09-20T04:59:06
tc_deeb4bdc find_suspicious_processes._query(volatility.pstree) 16ms 2026-09-20T04:59:06
tc_0618cb47 find_suspicious_processes 80ms 2026-09-20T04:59:06
tc_aabea266 correlate_across_sources 116ms 2026-09-20T04:59:21
tc_10cb9045 open_case 31ms 2026-09-20T04:59:59
tc_6467e78d get_investigation_summary 5ms 2026-09-20T05:00:00
tc_b7d8e1c4 get_findings 1ms 2026-09-20T05:00:22
tc_ef84f8ce search 6ms 2026-09-20T05:00:36
tc_4b2e8c62 search 5ms 2026-09-20T05:00:37
tc_0152539b search 3ms 2026-09-20T05:00:37
tc_7306d9f2 get_raw_output 16ms 2026-09-20T05:00:46
tc_11d05674 get_raw_output 82ms 2026-09-20T05:00:46
tc_0f2b1946 get_raw_output 15ms 2026-09-20T05:00:46
tc_94d54a5c search 4ms 2026-09-20T05:01:03
tc_79036de8 search 3ms 2026-09-20T05:01:04
tc_03d2afc6 search 4ms 2026-09-20T05:01:04
tc_ff01dbc4 search 3ms 2026-09-20T05:01:13
tc_7c6e783a search 26ms 2026-09-20T05:01:13
tc_75264fd1 search 5ms 2026-09-20T05:01:13
tc_a71af33a get_raw_output 81ms 2026-09-20T05:01:25
tc_4678f7d0 get_raw_output 81ms 2026-09-20T05:01:25
tc_5402f1f5 search 5ms 2026-09-20T05:01:25
tc_6862bf0e search 50ms 2026-09-20T05:01:45
tc_bfaf0b41 lookup_attack_technique 584ms 2026-09-20T05:01:45
tc_d72d18b4 search 3ms 2026-09-20T05:01:45
tc_a3b4b0be submit_finding 18ms 2026-09-20T05:03:03
tc_06b28829 submit_finding 20ms 2026-09-20T05:03:08
tc_1444a697 submit_finding 19ms 2026-09-20T05:03:13
tc_cb048504 search 3ms 2026-09-20T05:03:29
tc_2bd3fd09 get_raw_output 81ms 2026-09-20T05:03:30
tc_8c7bfa14 search 3ms 2026-09-20T05:03:30
tc_41a87d3a get_raw_output 15ms 2026-09-20T05:03:49
tc_20e9d8f3 search 3ms 2026-09-20T05:03:50
tc_3d7a9b94 get_ioc_summary 655ms 2026-09-20T05:03:51
tc_368c5818 submit_finding 19ms 2026-09-20T05:04:34
tc_a8dcbdf6 submit_finding 19ms 2026-09-20T05:04:47
tc_55926234 get_findings 1ms 2026-09-20T05:05:11
tc_ea1ba613 track_progress 17ms 2026-09-20T05:05:42
tc_baf7ff2f get_investigation_summary 4ms 2026-09-20T05:06:36
tc_c0421613 open_case 33ms 2026-09-20T05:06:39
tc_0ea652f8 get_findings 3ms 2026-09-20T05:06:41
tc_2ba64b85 get_investigation_summary 4ms 2026-09-20T05:06:41
tc_7f3a153e list_sources 2ms 2026-09-20T05:06:41
tc_d19d2dae get_timeline 2ms 2026-09-20T05:06:41
tc_4a62822b get_findings 2ms 2026-09-20T05:06:45
tc_8556a9da get_findings 1ms 2026-09-20T05:07:03
tc_d165e96c open_case 32ms 2026-09-20T05:09:18
tc_8c17eb3b get_timeline 23ms 2026-09-20T05:09:56
tc_5791e3d4 search 15ms 2026-09-20T05:10:34
tc_5f452b32 search 32ms 2026-09-20T05:10:34
tc_0c2b059a search 36ms 2026-09-20T05:10:34
tc_9cdba5d1 search 39ms 2026-09-20T05:10:34
tc_1cf846f4 search 33ms 2026-09-20T05:10:34
tc_131e5677 search 36ms 2026-09-20T05:10:34
tc_19090bf8 search 38ms 2026-09-20T05:10:34
tc_659b8978 search 29ms 2026-09-20T05:10:34
tc_293e21cf search 12ms 2026-09-20T05:10:34
tc_edc53dd9 search 23ms 2026-09-20T05:10:34
tc_0a54632b search 21ms 2026-09-20T05:10:34
tc_31a8c08c search 19ms 2026-09-20T05:10:34
tc_da31c677 search 17ms 2026-09-20T05:10:34
tc_ba59319f search 21ms 2026-09-20T05:10:34
tc_08b7f2fc search 18ms 2026-09-20T05:10:34
tc_b31b5e67 search 18ms 2026-09-20T05:10:34
tc_f5538ad8 search 17ms 2026-09-20T05:10:34
tc_9ac980ea search 12ms 2026-09-20T05:10:34
tc_8a6d477d search 19ms 2026-09-20T05:10:34
tc_9c84fe08 search 11ms 2026-09-20T05:10:34
tc_98144071 search 23ms 2026-09-20T05:10:34
tc_5050405f search 18ms 2026-09-20T05:10:34
tc_4fb3c00f search 20ms 2026-09-20T05:10:34
tc_a1bc63d6 search 29ms 2026-09-20T05:10:34
tc_f693a467 search 19ms 2026-09-20T05:10:34
tc_788bcc5a search 11ms 2026-09-20T05:10:34
tc_1a0c638b search 7ms 2026-09-20T05:10:34
tc_dd34a6c3 search 5ms 2026-09-20T05:10:34
tc_d47a90d2 search 9ms 2026-09-20T05:10:34
tc_fb7a0bf8 search 4ms 2026-09-20T05:10:34
tc_68eb7572 search 6ms 2026-09-20T05:10:34
tc_70e9b640 search 10ms 2026-09-20T05:10:34
tc_70f7022b search 11ms 2026-09-20T05:10:34
tc_c08dfc6a search 10ms 2026-09-20T05:10:34
tc_f6417dfb search 7ms 2026-09-20T05:10:34
tc_8c7f4674 search 5ms 2026-09-20T05:10:34
tc_97d44a43 search 5ms 2026-09-20T05:10:34
tc_74f2ef98 search 5ms 2026-09-20T05:10:34
tc_5b2c4b0e search 8ms 2026-09-20T05:10:34
tc_c36812ee search 10ms 2026-09-20T05:10:34
tc_a96ac001 search 9ms 2026-09-20T05:10:34
tc_4ad1e518 search 8ms 2026-09-20T05:10:34
tc_e2a69d66 correlate_across_sources 97ms 2026-09-20T05:10:37
tc_0b482a45 correlate_across_sources 112ms 2026-09-20T05:10:37
tc_17024c03 search 3ms 2026-09-20T05:10:42
tc_73307b85 list_cases 6ms 2026-09-20T05:10:47
tc_75f4b84c open_case 32ms 2026-09-20T05:11:14
tc_bf439584 get_findings 2ms 2026-09-20T05:11:16
tc_656077d6 get_raw_output 84ms 2026-09-20T05:11:22
tc_bc908161 search 85ms 2026-09-20T05:11:24
tc_a588306f search 6ms 2026-09-20T05:11:27
tc_f53f63e0 get_investigation_summary 4ms 2026-09-20T05:11:32
tc_70668a2f get_findings 2ms 2026-09-20T05:11:37
tc_fb56b7b4 get_investigation_summary 4ms 2026-09-20T05:11:55
tc_5d1cd372 check_finalize_readiness 4ms 2026-09-20T05:11:55
tc_38129ada open_case 31ms 2026-09-20T05:12:01
tc_014e8bd8 get_findings 2ms 2026-09-20T05:12:01
tc_b73e817e get_raw_output 82ms 2026-09-20T05:12:06
tc_88345cb9 search 5ms 2026-09-20T05:12:09
tc_d7c0c394 search 3ms 2026-09-20T05:12:10
tc_2c39b304 search 3ms 2026-09-20T05:12:10
tc_477e95e8 get_findings 2ms 2026-09-20T05:12:12
tc_3eddb848 get_findings 1ms 2026-09-20T05:12:12
tc_3d3e6fef search 8ms 2026-09-20T05:12:15
tc_403d43cc search 4ms 2026-09-20T05:12:15
tc_22ca9d29 search 8ms 2026-09-20T05:12:16
tc_feebf7e8 get_raw_output 24ms 2026-09-20T05:12:20
tc_b92967de get_raw_output 24ms 2026-09-20T05:12:20
tc_27af5680 get_findings 2ms 2026-09-20T05:12:30
tc_66e19810 get_investigation_summary 5ms 2026-09-20T05:12:36
tc_2d5a1d76 search 4ms 2026-09-20T05:12:53
tc_9bb74a67 search 3ms 2026-09-20T05:13:18
tc_8140e276 search 3ms 2026-09-20T05:13:19
tc_db90e8bb search 3ms 2026-09-20T05:13:19
tc_78bb3cde search 3ms 2026-09-20T05:13:19
tc_dec3296b search 3ms 2026-09-20T05:13:19
tc_215e004c search 3ms 2026-09-20T05:13:36
tc_bc9b4b28 search 4ms 2026-09-20T05:13:39
tc_ba92a429 search 4ms 2026-09-20T05:14:30
tc_ad800753 get_findings 1ms 2026-09-20T05:14:54
tc_7280f466 get_ioc_summary 572ms 2026-09-20T05:15:15
tc_bdb80921 audit_evidence_coverage 2993ms 2026-09-20T05:15:28
tc_f9eb9957 audit_tool_coverage 2ms 2026-09-20T05:15:28
tc_5055935d get_findings 1ms 2026-09-20T05:15:48
tc_86c5d081 check_finalize_readiness 3ms 2026-09-20T05:16:05
tc_3c588701 search 5ms 2026-09-20T05:16:15
tc_ec8ca5f0 get_findings 1ms 2026-09-20T05:16:42
tc_e964e973 get_investigation_summary 3ms 2026-09-20T05:17:00
tc_cc5a5b3b get_findings 1ms 2026-09-20T05:17:12
tc_40943449 get_findings 2ms 2026-09-20T05:17:37
tc_a2fb7844 check_finalize_readiness 3ms 2026-09-20T05:18:10
tc_af48658d track_progress 12ms 2026-09-20T05:18:45
tc_54f0fa28 check_finalize_readiness 4ms 2026-09-20T05:19:30
tc_68c3f991 get_investigation_summary 4ms 2026-09-20T05:20:15
tc_a3a2e8e2 check_finalize_readiness 4ms 2026-09-20T05:20:15
tc_9841998a open_case 32ms 2026-09-20T05:20:19
tc_fb06efbd get_findings 3ms 2026-09-20T05:20:28
tc_3262dd9d get_investigation_summary 5ms 2026-09-20T05:20:29
tc_ce2a80f7 list_sources 2ms 2026-09-20T05:20:29
tc_5178b16a get_timeline 27ms 2026-09-20T05:20:40
tc_660c26cb get_findings 1ms 2026-09-20T05:21:04
tc_a9698da1 get_findings 1ms 2026-09-20T05:21:21
tc_60e2830d get_timeline 19ms 2026-09-20T05:22:30
tc_5194b540 open_case 32ms 2026-09-20T05:23:59
tc_31d8ba9f search 22ms 2026-09-20T05:24:07
tc_3f980868 search 28ms 2026-09-20T05:24:07
tc_e478819b search 31ms 2026-09-20T05:24:07
tc_a84170dd search 31ms 2026-09-20T05:24:07
tc_3bdd2fea search 21ms 2026-09-20T05:24:07
tc_a1663b64 search 37ms 2026-09-20T05:24:07
tc_0ac26f93 search 35ms 2026-09-20T05:24:07
tc_ecb98e75 search 31ms 2026-09-20T05:24:07
tc_874c4567 search 16ms 2026-09-20T05:24:07
tc_365a7799 search 11ms 2026-09-20T05:24:07
tc_3df9da5e search 8ms 2026-09-20T05:24:07
tc_3558efd0 search 6ms 2026-09-20T05:24:07
tc_30c8ead7 search 4ms 2026-09-20T05:24:07
tc_902fed95 search 5ms 2026-09-20T05:24:07
tc_8b5b8743 correlate_across_sources 33ms 2026-09-20T05:24:07
tc_0feb3388 open_case 33ms 2026-09-20T05:24:28
tc_8aac71f2 get_findings 2ms 2026-09-20T05:24:28
tc_ddac5dd9 get_findings 2ms 2026-09-20T05:24:30
tc_c0c15a77 get_findings 2ms 2026-09-20T05:24:33
tc_42e6d01d get_investigation_summary 4ms 2026-09-20T05:24:35
tc_3f98ecec get_findings 2ms 2026-09-20T05:24:39
tc_d638df04 get_findings 1ms 2026-09-20T05:24:39
tc_0ae6ecdd get_findings 1ms 2026-09-20T05:24:39
tc_fb21dfb4 search 6ms 2026-09-20T05:25:14
tc_02b54721 search 4ms 2026-09-20T05:25:14
tc_592424ed search 10ms 2026-09-20T05:25:14
tc_050c0d48 search 3ms 2026-09-20T05:25:14
tc_9b37b382 search 3ms 2026-09-20T05:25:21
tc_f766f65d search 4ms 2026-09-20T05:25:21
tc_fc36c6fc search 6ms 2026-09-20T05:25:21
tc_f300b919 search 75ms 2026-09-20T05:25:21
tc_8948b7aa search 4ms 2026-09-20T05:25:33
tc_e036fdf0 search 3ms 2026-09-20T05:25:33
tc_54e5caf1 search 3ms 2026-09-20T05:25:33
tc_83a998c8 search 3ms 2026-09-20T05:25:33
tc_8b05970d get_raw_output 82ms 2026-09-20T05:25:43
tc_ab06d969 get_raw_output 80ms 2026-09-20T05:25:43
tc_92fe973a update_finding 15ms 2026-09-20T05:27:01
tc_b9b3109d update_finding 13ms 2026-09-20T05:27:08
tc_fda77ae5 update_finding 13ms 2026-09-20T05:27:13
tc_c741adc0 update_finding 15ms 2026-09-20T05:27:41
tc_796d1fb7 update_finding 14ms 2026-09-20T05:27:42
tc_82f275b4 update_finding 13ms 2026-09-20T05:27:42
tc_dbc9fba2 audit_evidence_coverage 3059ms 2026-09-20T05:28:05
tc_5f889b71 audit_tool_coverage 2ms 2026-09-20T05:28:05
tc_7fac8d51 check_finalize_readiness 3ms 2026-09-20T05:28:05
tc_d9a1977d update_finding 28ms 2026-09-20T05:28:29
tc_852a5798 update_finding 12ms 2026-09-20T05:28:29
tc_b542b233 check_finalize_readiness 3ms 2026-09-20T05:28:29
tc_e5cd5d76 track_progress 13ms 2026-09-20T05:29:27
tc_813b4f8c get_investigation_summary 5ms 2026-09-20T05:30:10
tc_a32324d8 check_finalize_readiness 4ms 2026-09-20T05:30:10
tc_800b305b open_case 10ms 2026-09-20T05:30:19
tc_41e302a9 get_findings 3ms 2026-09-20T05:30:20
tc_a0e520c7 get_investigation_summary 5ms 2026-09-20T05:30:21
tc_3a274b11 get_ioc_summary 583ms 2026-09-20T05:30:21
tc_e58ba9f8 get_bookmarks 1ms 2026-09-20T05:30:21
tc_8cde705b get_source_stats 82ms 2026-09-20T05:30:21
tc_f7dea2b7 get_findings 2ms 2026-09-20T05:30:29
tc_e008f081 search 5ms 2026-09-20T05:30:35
tc_9307cec8 search 4ms 2026-09-20T05:30:35
tc_02352225 get_raw_output 88ms 2026-09-20T05:30:41
tc_8bf8ba6e get_raw_output 69ms 2026-09-20T05:30:41
tc_3caca56d search 6ms 2026-09-20T05:31:06
tc_9ca5ee2c get_raw_output 81ms 2026-09-20T05:31:06
tc_5f4f84fd get_timeline 74ms 2026-09-20T05:31:22
tc_9a933747 search 3ms 2026-09-20T05:31:23
tc_f1b7e6d6 search 5ms 2026-09-20T05:31:41
tc_12dbefe8 search 3ms 2026-09-20T05:31:42
tc_8e808319 get_raw_output 14ms 2026-09-20T05:31:56
tc_2f385118 submit_narrative 17ms 2026-09-20T05:35:57
tc_887730b4 check_finalize_readiness 4ms 2026-09-20T05:36:04

Each finding traces back to the specific tool calls that produced the supporting evidence.

Data Staging on RM2 with Counterfeit File Extensions for Exfiltration 2 refs
1
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "tsk.masquerade" }
tc_dd610914
5ms
2
get_raw_output
{ "after_id": 3016, "limit": 100, "source_name": "tsk.filelist" }
tc_19d674e6
2ms
Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions 2 refs
1
get_raw_output
{ "after_id": 0, "limit": 50, "source_name": "optical.listing" }
tc_3f887295
84ms
2
search
{ "exclude_sources": null, "max_results": 50, "queries": null, "query": "cfreds_2015_data_leakage_rm3_type3", "regex"...
tc_025b4556
4ms
Complete Data Exfiltration Timeline - From Source to Destination 6 refs
1
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "registry.ntuser.informant" }
tc_5f5eae41
80ms
2
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "ez.shimcache" }
tc_b075f148
81ms
3
search
{ "exclude_sources": null, "max_results": 50, "queries": [ "Enum\\\\USB", "VID_", "PID_", "Serial", "Disk\u0026Ven" ]...
tc_c9690128
9ms
4
search
{ "exclude_sources": null, "max_results": 50, "queries": [ "IAMAN", "secret_project" ], "query": "", "regex": false, ...
tc_943cdfdc
4ms
5
get_raw_output
{ "after_id": 0, "limit": 30, "source_name": "tsk.partitions" }
tc_982e1d6d
81ms
6
get_raw_output
{ "after_id": 0, "limit": 50, "source_name": "tsk.masquerade" }
tc_6f6c6ca3
81ms
Correlation of Masqueraded Files Between RM2 and RM3 Optical Media 2 refs
1
get_raw_output
{ "after_id": 0, "limit": 50, "source_name": "optical.listing" }
tc_3f887295
84ms
2
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "tsk.masquerade" }
tc_dd610914
5ms
Government Email Addresses on RM2 Indicating Data Theft 2 refs
1
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "bulk.email" }
tc_4b43855b
7ms
2
get_raw_output
{ "after_id": 0, "limit": 150, "source_name": "bulk.domain" }
tc_146b0abc
5ms
White House OMB Document URLs on RM2 2 refs
1
search
{ "exclude_sources": null, "max_results": 100, "queries": null, "query": "http", "regex": false, "source": "bulk.url"...
tc_787773ae
7ms
2
get_raw_output
{ "after_id": 0, "limit": 150, "source_name": "bulk.domain" }
tc_146b0abc
5ms
Complete File Structure Analysis of RM2 Removable Media 2 refs
1
get_raw_output
{ "after_id": 3016, "limit": 100, "source_name": "tsk.filelist" }
tc_19d674e6
2ms
2
get_raw_output
{ "after_id": 0, "limit": 20, "source_name": "tsk.partitions" }
tc_6cb7b05a
80ms
Library of Congress Data on RM2 4 refs
1
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "bulk.email" }
tc_4b43855b
7ms
2
search
{ "exclude_sources": null, "max_results": 100, "queries": null, "query": "http", "regex": false, "source": "bulk.url"...
tc_787773ae
7ms
3
get_raw_output
{ "after_id": 0, "limit": 150, "source_name": "bulk.domain" }
tc_146b0abc
5ms
4
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "bulk.rfc822" }
tc_6ae7b75e
9ms
Office Documents with Suspicious Metadata Indicating Data Staging 3 refs
1
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "tsk.masquerade" }
tc_dd610914
5ms
2
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "bulk.email" }
tc_4b43855b
7ms
3
search
{ "exclude_sources": null, "max_results": 100, "queries": null, "query": "http", "regex": false, "source": "bulk.url"...
tc_787773ae
7ms
Government Email Addresses and URLs on Optical Media RM3 3 refs
1
search
{ "exclude_sources": null, "max_results": 50, "queries": null, "query": "cfreds_2015_data_leakage_rm3_type3", "regex"...
tc_025b4556
4ms
2
get_raw_output
{ "after_id": 136836, "limit": 50, "source_name": "bulk.rfc822" }
tc_d15b6140
14ms
3
search
{ "exclude_sources": null, "max_results": 50, "queries": [ "whitehouse.gov", "omb", "loc.gov" ], "query": "", "regex"...
tc_5e6d6001
4ms
USB and Removable Media Connections - Complete Device Inventory 2 refs
1
search
{ "exclude_sources": null, "max_results": 50, "queries": [ "IAMAN", "secret_project" ], "query": "", "regex": false, ...
tc_943cdfdc
4ms
2
get_raw_output
{ "after_id": 0, "limit": 30, "source_name": "tsk.partitions" }
tc_982e1d6d
81ms
User Activity Timeline - Data Access and Cleanup Patterns 3 refs
1
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "registry.ntuser.informant" }
tc_5f5eae41
80ms
2
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "ez.shimcache" }
tc_b075f148
81ms
3
search
{ "exclude_sources": null, "max_results": 50, "queries": [ "Enum\\\\USB", "VID_", "PID_", "Serial", "Disk\u0026Ven" ]...
tc_c9690128
9ms
Cloud Storage and File-Sharing Applications Used for Potential Exfiltration 3 refs
1
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "ez.shimcache" }
tc_b075f148
81ms
2
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "registry.ntuser.informant" }
tc_5f5eae41
80ms
3
search
{ "exclude_sources": null, "max_results": 50, "queries": [ "Dropbox", "OneDrive", "Box", "iCloud" ], "query": "", "re...
tc_604e9672
9ms
Suspicious ASP.NET State Service Installation as Potential Persistence Mechanism 3 refs
1
get_raw_output
{ "after_id": 138430, "limit": 10, "source_name": "composite.persistence" }
tc_7306d9f2
16ms
2
search
{ "exclude_sources": null, "max_results": 30, "queries": null, "query": "aspnet_state.exe", "regex": false, "source":...
tc_94d54a5c
4ms
3
lookup_attack_technique
{ "max_results": 5, "query": "T1543.003" }
tc_bfaf0b41
584ms
RM1 'Authorized USB' Role - Initial Staging for Secret Project Data 2 refs
1
search
{ "exclude_sources": null, "max_results": 30, "queries": null, "query": "Authorized USB", "regex": false, "source": n...
tc_cb048504
3ms
2
search
{ "exclude_sources": null, "max_results": 30, "queries": null, "query": "secret_project", "regex": false, "source": n...
tc_8c7bfa14
3ms
Account Creation, Privilege Escalation, and Potential Unauthorized Access 1 refs
1
get_raw_output
{ "after_id": 0, "limit": 100, "source_name": "hayabusa.alerts" }
tc_5b346b98
81ms
User Activity After Google Drive Sync Including Resignation Letter Processing 2 refs
1
search
{ "exclude_sources": null, "max_results": 50, "queries": null, "query": "2015-03-25", "regex": false, "source": null,...
tc_6862bf0e
50ms
2
search
{ "exclude_sources": null, "max_results": 30, "queries": null, "query": "2015-03-25 15:", "regex": false, "source": "...
tc_7c6e783a
26ms
Network Share Access via My Network Places Without Clear Authentication Logging 2 refs
1
search
{ "exclude_sources": null, "max_results": 50, "queries": null, "query": "secured_drive", "regex": false, "source": nu...
tc_ff01dbc4
3ms
2
get_raw_output
{ "after_id": 0, "limit": 50, "source_name": "evtx.security" }
tc_11d05674
82ms
Dormant Admin Accounts - Created for Future Backdoor Access, Not Used During Exfiltration 3 refs
1
search
{ "exclude_sources": null, "max_results": 30, "queries": null, "query": "admin11 ITechTeam temporary", "regex": false...
tc_0152539b
3ms
2
get_raw_output
{ "after_id": 0, "limit": 50, "source_name": "evtx.security" }
tc_11d05674
82ms
3
search
{ "exclude_sources": null, "max_results": 30, "queries": null, "query": "2015-03-25 15:", "regex": false, "source": "...
tc_7c6e783a
26ms
RM2 Filesystem Type and Absence of Windows Artifacts 2 refs
1
get_raw_output
{ "after_id": 0, "limit": 20, "source_name": "tsk.partitions" }
tc_6cb7b05a
80ms
2
get_raw_output
{ "after_id": 3016, "limit": 100, "source_name": "tsk.filelist" }
tc_19d674e6
2ms

Tool Call Details

Copied to clipboard