Investigation Dashboard
The attack timeline spans 2014-12-01 to 2015-03-25. The earliest activity was Data Staging on RM2 with Counterfeit File Extensions for Exfiltration (2014-12-01). The investigation subsequently uncovered Complete Data Exfiltration Timeline - From Source to Destination; Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions; Correlation of Masqueraded Files Between RM2 and RM3 Optical Media. The most recent activity was User Activity After Google Drive Sync Including Resignation Letter Processing (2015-03-25).
- Data Staging on RM2 with Counterfeit File Extensions for Exfiltration
- Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions
- Complete Data Exfiltration Timeline - From Source to Destination
- Correlation of Masqueraded Files Between RM2 and RM3 Optical Media
-
Data Staging on RM2 with Counterfeit File Extensions for Exfiltration
2014-12-01T14:50:26 — 2015-03-24T10:00:18
-
Data Exfiltration to Optical Media RM3 with Obfuscation Across Multiple Burn Sessions
2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
-
Complete Data Exfiltration Timeline - From Source to Destination
2015-03-22T14:33:54 — 2015-03-25T15:31:05
-
Correlation of Masqueraded Files Between RM2 and RM3 Optical Media
2015-03-24T20:54:16Z — 2015-03-24T20:57:03Z
| Case ID | ndlc |
| Evidence Root | /evidence |
| Report Generated | 2026-09-20T05:36:39 |
| Investigation Start | 2026-09-20T04:38:36 |
| Investigation End | 2026-09-20T05:36:04 |
| Total Processing | 1193.7s |
| Audit Log | /home/mulder/.mulder/cases/ndlc.audit.jsonl |
Evidence Hashes
sha256sum <file>| File | SHA-256 | Size |
|---|---|---|
| cfreds_2015_data_leakage_pc.E01 | e6365e44f1004252171acb73e6779be05277cbd57d09d7febed22d2463a956a9 | 2.0 GB |
| cfreds_2015_data_leakage_rm1.E01 | a14150a21bc1e3700b51912c2ab20cd9587ad3e27ee67475af64508a7e760121 | 74.6 MB |
| cfreds_2015_data_leakage_rm2.E01 | 25215f9bcb51ceee9147886ed3f5c13ef148de634fc5114491e0f8dad8b15696 | 243.2 MB |
| cfreds_2015_data_leakage_rm3_type3.E01 | 336e1307721ef5f63679379961d1716b74f986e69df8c40117d9cea7858d512b | 90.2 MB |
Investigation Report
Investigation Narrative: NIST Insider Threat Incident
Background
This investigation examines a suspected insider threat incident at the National Institute of Standards and Technology (NIST) involving the user account "iaman.informant@nist.gov". The investigation was initiated based on anomalous activity detected on the workstation identified as "informant-PC". Digital forensic analysis was conducted on multiple evidence sources including disk images, optical media, Windows registry hives, Windows Event Logs, and file system metadata. A total of 17 evidence sources were indexed from forensic extraction tools including the Sleuthkit, EZTools, RegRipper, Hayabusa, Bulk Extractor, and custom analysis scripts.
The primary subject of this investigation is the user account "informant" (iaman.informant@nist.gov, SID: S-1-5-21-2425377081-3129163575-2985601102-1000), who was identified as the active user during the incident timeframe. Additional user accounts were created during the incident period, including "admin11", "ITechTeam", and "temporary", all of which were subsequently granted local administrator privileges.
The evidence environment consists of a Windows 7 workstation in a WORKGROUP configuration, with Microsoft Office 2013 installed, Google Chrome web browser, and various system utilities. The investigation revealed activity spanning from December 2014 through March 25, 2015, with the most critical events occurring between March 13 and March 25, 2015.
Incident Timeline
The investigation identified a chronological sequence of events beginning with anti-forensics preparation and culminating in data exfiltration:
Phase 1: Anti-Forensics Preparation (December 2014 - January 2015)
On January 12, 2015 at 22:56:35 UTC, the anti-forensics tool "Eraser" was executed on the system (C:\Program Files\Eraser\Eraser.exe). This tool is designed to securely delete files and make them unrecoverable, indicating premeditated intent to conceal activities. During this same period, document files that would later appear on staged media showed modification dates ranging from December 1, 2014 through January 23, 2015. These documents, totaling approximately 107 MB, included Microsoft Office files related to design specifications, pricing decisions, progress reports, proposals, and technical reviews.
Phase 2: Account Creation and Privilege Escalation (March 22, 2015)
The user account "informant" first logged into the system on March 22, 2015 at 14:33:13 UTC when the user profile was created. This timestamp corresponds with the first activity recorded in the NTUSER.DAT registry hive. Within minutes of initial login, the subject began creating additional user accounts and elevating privileges.
At 14:33:54 UTC, the Windows Security Event Log recorded Event ID 4732, indicating that the "informant" user account was added to the local Administrators group by the SYSTEM account (SID: S-1-5-18, computer account WIN-D9RGPJQ68G8$). Simultaneously, Event ID 4724 recorded a password reset for the "informant" account. These events suggest that the initial compromise may have involved manipulation of system-level processes or that the SYSTEM account was used to bootstrap the privilege escalation chain.
Between 15:51:54 UTC and 15:53:11 UTC, the "informant" account performed the following actions:
- Created the "admin11" user account (SID ending in 1001) and added it to the local Administrators group (Event ID 4732, Record ID 989)
- Reset the password for "admin11" (Event ID 4724, Record ID 992)
- Created the "ITechTeam" user account (SID ending in 1002) and added it to the local Administrators group (Event ID 4732, Record ID 1000)
- Reset the password for "ITechTeam" (Event ID 4724, Record ID 1003)
- Created the "temporary" user account (SID ending in 1003) and reset its password (Event ID 4724, Record ID 1013)
The "temporary" account was not added to the Administrators group but remained in the standard Users group, suggesting it may have served a different purpose in the attack chain.
Phase 3: Software Installation and Configuration (March 22, 2015)
Following the account creation spree, the system underwent significant software installation activity. The AppCompatCache analysis revealed execution of the following programs on March 22, 2015:
- Internet Explorer 11 installation package (IE11-Windows6.1-x64-en-us.exe) was downloaded to C:\Users\informant\Desktop\Download\ and executed at 15:11:04 UTC
- Google Chrome installation and setup files were executed at 15:11:21 UTC
- Google Crash Handler was executed at 15:11:26 UTC
- Internet Explorer registration utilities were executed at 15:16:55 through 15:17:01 UTC
This software installation activity is notable as it occurs immediately after the privilege escalation events, suggesting the attacker was establishing a comfortable working environment and potentially installing browsers to facilitate external communication or data transfer.
Phase 4: Anti-Forensics Execution (March 13, 2015)
Earlier in the incident timeline, on March 13, 2015 at 11:10:25 UTC, CCleaner 64-bit (C:\Program Files\CCleaner\CCleaner64.exe) was executed. CCleaner is a system optimization tool commonly used for legitimate purposes, but it is also employed as an anti-forensics tool to clear browser history, temporary files, and other potential evidence of user activity. The execution of CCleaner represents a deliberate attempt to remove traces of prior activity on the system.
Phase 5: Data Staging on Removable Media (March 24, 2015)
The most significant evidence of data exfiltration was discovered on optical media labeled "IAMAN CD". Analysis of the UDF filesystem revealed a multi-session write-once disc with 9 VAT (Virtual Allocation Table) generations, indicating multiple burn sessions. The disc contained 17 deleted files organized in a hierarchical directory structure with the following folders:
- /design (deleted session 7) - containing winter_storm.amr and winter_whether_advisory.zip
- /pricing decision (deleted session 6) - containing my_favorite_cars.db, my_favorite_movies.7z, new_years_day.jpg, and super_bowl.avi
- /progress (deleted session 5) - containing my_friends.svg, my_smartphone.png, and new_year_calendar.one
- /proposal (deleted session 4) - containing a_gift_from_you.gif and landscape.png
- /technical review (deleted session 3) - containing diary files numbered diary_#1d.txt, diary_#1p.txt, diary_#2d.txt, diary_#2p.txt, diary_#3d.txt, and diary_#3p.txt
File signature analysis revealed that all 17 files used counterfeit file extensions to misrepresent their true content type. Files with extensions suggesting audio (.amr, .avi), archives (.zip, .7z), databases (.db), images (.jpg, .png, .gif, .svg), and text (.txt) actually contained Microsoft Office documents in DOCX, XLSX, PPTX, and OLE formats. This deliberate file extension manipulation is a classic exfiltration evasion technique designed to bypass security controls that inspect file types.
The total volume of staged data was approximately 107 MB, with individual file sizes ranging from 27 KB (new_year_calendar.one) to 35.2 MB (a_gift_from_you.gif). The file modification timestamps ranged from December 1, 2014 to January 23, 2015, while the creation timestamps on the optical media ranged from March 24, 2015 at 20:54:16 UTC to 20:57:03 UTC. The sequential deletion across multiple VAT sessions indicates an attempt to hide the staged data after burning to the disc.
A second piece of removable media, identified as RM2, contained identical files in $OrphanFiles directories, suggesting that data was first staged on this media before being burned to the optical disc.
The optical media also contained three Windows sample image files (Koala.jpg, Penguins.jpg, Tulips.jpg) that were not part of the exfiltration set, potentially serving as legitimate-looking "decoy" files to decrease suspicion if the disc was inspected.
Phase 6: Persistence Establishment (March 25, 2015)
On March 25, 2015, the attack culminated with the installation of a suspicious service. At 14:54:25 UTC, a system service named "ASP.NET State Service" was installed with a service path of "%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe" (Event ID 7045, Record ID 1585). This service was configured to run under the LocalSystem account with a start type of "demand start". The Hayabusa detection engine flagged this as a "Suspicious Service Path" due to the path structure being unusual for a legitimate service installation.
Additionally, on March 25, 2015 between 10:18:15 UTC and 14:54:07 UTC, multiple firewall rule additions were recorded (Event ID 2004). While many of these rules were associated with legitimate Windows components (BranchCache, Network Projector, Media Center Extenders, Remote Desktop), the timing and volume of firewall modifications concurrent with the service installation raises concern about potential defense evasion activities.
Key Findings
The investigation yielded 20 total findings across multiple severity levels, with 4 critical-severity, 11 high-severity, and 4 medium-severity findings. One finding was classified as negative, indicating a ruled-out hypothesis.
Data Exfiltration with File Extension Masquerading
The most critical finding confirmed that approximately 107 MB of Microsoft Office documents were staged on removable media using counterfeit file extensions. This technique, consistent with MITRE ATT&CK technique T1036 (Masquerading), involved renaming sensitive documents with extensions that suggested benign media files. The files were organized into business-relevant categories (design, pricing decisions, progress reports, proposals, and technical reviews) suggesting the documents contained proprietary or sensitive business information. The multi-session burning pattern on the optical media, combined with the sequential deletion of files across VAT generations, indicates sophisticated tradecraft meant to obscure the exfiltration activity.
Privilege Escalation and Account Manipulation
The creation of three new user accounts (admin11, ITechTeam, temporary) and their immediate elevation to local administrator privileges represents a clear abuse of privileged access. The hayabusa detection engine identified these as Event ID 4732 (Member Added to Local Group) with high severity. The pattern of account creation followed by immediate password resets (Event ID 4724) is consistent with attacker tradecraft for establishing persistent access mechanisms and creating backup administrative accounts that could survive primary account password resets.
Of particular concern is the initial privilege escalation event at 14:33:54 UTC where the SYSTEM account (WIN-D9RGPJQ68G8$) added the informant account to the Administrators group. This suggests either a security misconfiguration that allowed unauthorized privilege elevation, or that the attacker had already achieved SYSTEM-level access through an undisclosed mechanism.
Anti-Forensics Activity
The execution of both CCleaner (March 13, 2015) and Eraser (January 12, 2015) demonstrates deliberate intent to destroy evidence and evade detection. CCleaner's ability to clear browser history, download history, and application logs would effectively eliminate evidence of web browsing and file download activities. Eraser's secure deletion capability would make any files deleted with the tool forensically unrecoverable. This anti-forensics preparation indicates premeditation and familiarity with digital forensic techniques.
Suspicious Service Installation
The installation of the ASP.NET State Service on March 25, 2015 was flagged by Hayabusa as a high-severity finding for "Suspicious Service Path". The service path using environment variable expansion (%SystemRoot%) and the demand-start configuration are consistent with ATT&CK technique T1543.003 (Create or Modify System Process: Windows Service). While aspnet_state.exe is a legitimate Microsoft component, its installation in this context as a standalone service outside normal .NET Framework registration procedures suggests it may have been co-opted for persistence or to execute malicious payloads under the guise of a legitimate service name.
Data Staging on Multiple Media
Evidence revealed data staging on both optical media (IAMAN CD) and a second removable media device (RM2) containing $OrphanFiles directories. The identical file sets suggest the attacker transferred data from RM2 to the optical disc, potentially as a redundant exfiltration mechanism or as a preparation step to remove evidence from the primary staging area. The use of removable media for exfiltration is consistent with ATT&CK technique T1052 (Exfiltration over Physical Medium), which is particularly difficult to detect through network monitoring.
Threat Intelligence and Attribution
The investigation uncovered several indicators and tradecraft elements that may inform attribution analysis, though definitive attribution requires additional context:
Observed Trademark Techniques: The combination of file extension masquerading, creation of multiple administrative accounts with themed names (admin11, ITechTeam, "temporary"), multi-session burning on optical media with deliberate file deletion, and the execution of anti-forensics tools (both Eraser and CCleaner) demonstrates a level of operational security awareness consistent with a moderately sophisticated threat actor. The naming convention for accounts (ITechTeam, temporary) suggests an attempt to make the accounts appear legitimate, possibly simulating an IT department presence.
Absence of External Network Indicators: Notably absent from the forensic evidence are indicators of external command and control (C2) communication, malware binaries with known signatures, or artifact patterns matching specific threat groups. The execution of legitimate Windows utilities and Microsoft Office applications without corresponding network activity suggests the attacker relied primarily on physical media for data movement rather than network exfiltration.
Insider Threat Indicators: The evidence strongly suggests an insider threat scenario rather than external intrusion. Key indicators include:
- Physical access to the system during account creation events (no remote authentication artifacts)
- Login to the local system under the "informant" account credentials
- Use of removable media for data staging (requires physical presence)
- No evidence of exploitation, phishing, or initial access techniques typically associated with external threats
- Knowledge of local system architecture and ability to create accounts with IT-sounding names
Attribution Confidence Level: Based on the available evidence, attribution to a specific external threat actor is not warranted. The trademark indicators are most consistent with an insider threat actor with legitimate credentials to the "informant" account who abused that access to exfiltrate data. The use of anti-forensics tools and staged media burning suggests familiarity with operational security practices, potentially indicating prior training, self-study, or prior incident experience. Attribution confidence is LOW for external threat actors; confidence is MEDIUM-HIGH for insider threat classification.
The lack of sophisticated malware, the reliance on legitimate system tools, and the emphasis on physical media exfiltration suggest a threat actor whose primary objective was data theft rather than persistent access or infrastructure compromise. This operational profile is consistent with a departing employee, contractor, or other trusted insider seeking to remove proprietary information.
Impact Assessment
The confirmed data exfiltration event represents a significant security breach with potential business impact across multiple dimensions:
Data Volume and Classification: Approximately 107 MB of Microsoft Office documents were staged for exfiltration. While the specific classification level of these documents cannot be determined from forensic metadata alone, the organizational categories (design, pricing decisions, progress, proposal, technical review) suggest business-sensitive information that could include intellectual property, competitive bidding data, project plans, or internal assessments. At NIST, a federal research agency, such documents could contain pre-publication research data, measurement standards development information, or collaboration details with industry partners.
Credential Exposure: The creation of three new administrative accounts increases the attack surface of the system. While these accounts would not provide access to network resources beyond the local workstation, their existence represents a persistence mechanism that could be used for subsequent access. Additionally, the password resets of these accounts by the "informant" user were recorded in security event logs, potentially allowing an attacker with log access to identify account creation timing.
Scope of Compromise: This incident appears confined to a single workstation (informant-PC) in a WORKGROUP configuration. There is no forensic evidence of lateral movement to other systems, network-based attack activity, or compromise of domain credentials. The attacker's tradecraft focused entirely on local system manipulation and physical media exfiltration, which is inherently limited in scope compared to network-based intrusion scenarios.
Persistence Depth: The installed ASP.NET State Service represents a moderate persistence mechanism. While the service binary itself appears to be a legitimate Microsoft component, its installation in this context could allow code execution at SYSTEM privilege level on demand. This persistence mechanism, combined with the three created administrative accounts, provides multiple pathways for re-access to the workstation.
Business Impact Considerations: For a federal research institution like NIST, the exfiltration of design documents, pricing decisions, and technical review information could impact:
- Competitive advantage in standards development and measurement science
- Pre-publication research integrity
- Industry partnership trust relationships
- Potential procurement and contracting decisions
The actual business impact depends on the specific content of the exfiltrated documents, which would require subject matter expert review to fully assess.
Immediate Tactical Containment
The following containment actions should be executed immediately to prevent further damage and secure the environment:
-
Isolate the compromised workstation by disconnecting informant-PC from the network. Remove the Ethernet cable or disable the network adapter to prevent any potential lateral movement or command and control communication.
-
Disable the compromised user account by locking the "informant" account (SID: S-1-5-21-2425377081-3129163575-2985601102-1000) in Active Directory or local SAM database. Execute:
net user informant /active:no -
Disable all attacker-created accounts by removing the three created administrator accounts from the local Administrators group and disabling them:
- Remove admin11 (SID ending in 1001) from Administrators:
net localgroup Administrators admin11 /delete - Remove ITechTeam (SID ending in 1002) from Administrators:
net localgroup Administrators ITechTeam /delete -
Disable all three accounts:
net user admin11 /active:no,net user ITechTeam /active:no,net user temporary /active:no -
Stop and disable the suspicious service by halting the ASP.NET State Service and setting it to disabled:
sc stop aspnet_state-
sc config aspnet_state start= disabled -
Block the ASP.NET State Service executable from execution using AppLocker or Software Restriction Policies. Add a path rule to deny C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe.
-
Secure removable media evidence by taking possession of all removable storage devices accessible to the informant user, including optical media labeled "IAMAN CD" and any USB devices or external hard drives. These items are evidence and should be preserved using forensic imaging procedures.
-
Block removable media usage by enforcing group policy to disable USB storage devices and optical media writers on the affected system and potentially across the organization until the investigation scope is fully understood. Configure GPO: Computer Configuration > Administrative Templates > System > Removable Storage Access > All Removable Storage Classes: Deny All Access.
-
Reset passwords for all local administrator accounts on the affected system, including the built-in Administrator account (SID ending in 500). Ensure password complexity and length requirements are met.
-
Collect volatile system state before shutting down the workstation by running a live memory capture if the system is still powered on. Tools such as DumpIt or WinPMEM should be used to capture RAM for potential evidence of running processes.
-
Monitor for credential usage by watching for authentication attempts using the compromised accounts across all network systems. Configure SIEM alerts for the SIDs: -1000 (informant), -1001 (admin11), -1002 (ITechTeam), -1003 (temporary).
Strategic Remediation
The following remediation recommendations address the root causes identified in this investigation:
Control Failure: Excessive User Privileges. The "informant" account was able to create new user accounts and add them to the local Administrators group without additional authorization or oversight. This finding indicates that the user was granted privileges beyond their operational needs. The remediation is to implement the principle of least privilege by removing administrative rights from standard user accounts unless explicitly required for job functions. For users who do require administrative access, implement Just-In-Time (JIT) privileged access management that grants time-limited administrative rights only after approval workflow. This specific control failure was identified in findings related to Event ID 4732 (User Added To Local Admin Grp) on March 22, 2015.
Control Failure: Absence of Removable Media Controls. The attacker was able to write approximately 107 MB of data to optical media without restriction or monitoring. The forensic evidence shows multi-session burning on a UDF-formatted disc labeled "IAMAN CD", indicating unrestricted access to optical media writing capability. The remediation is to deploy Data Loss Prevention (DLP) controls that restrict removable media usage and monitor file transfers to external devices. Specifically, enforce Group Policy Object settings to disable optical media burning for standard users, and implement device control software that blocks unauthorized USB devices. This finding was identified in the critical-severity finding "Data Staging on RM2 with Counterfeit File Extensions for Exfiltration" and confirmed by optical media analysis.
Control Failure: Insufficient User Account Monitoring. The creation of three new user accounts and their addition to the Administrators group did not trigger immediate security alerts. While these events were logged in the Security Event Log and detected by Hayabusa during forensic analysis, no real-time alerting occurred to stop the activity. The remediation is to implement Security Information and Event Management (SIEM) correlation rules that trigger high-severity alerts on Event ID 4732 (member added to local Administrators group) and Event ID 4724 (password reset by administrator) when performed by non-standard accounts outside of approved maintenance windows. This control gap was identified in the hayabusa.alerts findings on March 22, 2015.
Control Failure: Anti-Forensics Tool Availability. The execution of CCleaner and Eraser on the target system indicates that these anti-forensics tools were either pre-installed or could be installed without restriction. Both tools have legitimate uses but are commonly employed to destroy digital evidence. The remediation is to implement application whitelisting using AppLocker or Windows Defender Application Control to prevent execution of unauthorized software. Specifically, create deny rules for known anti-forensics tool executables (eraser.exe, ccleaner64.exe) and require approval for installation of any new software. This finding was identified in the AppCompatCache analysis showing CCleaner execution on March 13, 2015 and Eraser execution on January 12, 2015.
Control Failure: Service Installation Lacks Validation. The installation of the ASP.NET State Service (aspnet_state.exe) with a suspicious configuration was not prevented or flagged until forensic analysis. While the service binary appears legitimate, its installation path and configuration are anomalous. The remediation is to implement service creation monitoring and require code signing validation for service binaries. Configure Windows Auditing for "Audit System Events" with subcategory "Security System Extension" to capture all service installation events. Additionally, implement Application Control policies that only permit signed services from trusted publishers to be installed outside of approved maintenance windows. This control gap was identified in the high-severity hayabusa finding "Suspicious Service Path" on March 25, 2015.
Conclusion
Q1. What systems were compromised?
A single workstation identified as "informant-PC" (computer name WIN-D9RGPJQ68G8, also observed as "37L4247F27-25" in firewall events) was compromised. The system is a Windows 7 Workstation in a WORKGROUP configuration, not joined to an Active Directory domain. No evidence of lateral movement to other systems was identified in the forensic artifacts.
Q2. How did the attacker gain initial access?
The forensic evidence strongly suggests an insider threat scenario where the attacker had legitimate credentials for the "informant" user account. The initial privilege escalation event at 14:33:54 UTC on March 22, 2015 shows the SYSTEM account (computer account WIN-D9RGPJQ68G8$) adding the informant account to the local Administrators group. This could indicate either a misconfiguration that allowed this escalation, or that the attacker had already achieved elevated access through an undisclosed mechanism prior to the recorded activity. No evidence of external intrusion techniques (phishing, exploitation, malware) was identified.
Q3. What lateral movement occurred?
No lateral movement was detected. The attacker's activities were confined to the single workstation. No remote authentication events, network connection artifacts to other internal systems, or Pass-the-Hash/Pass-the-Ticket indicators were found in the forensic evidence. The attack methodology focused on local system manipulation and physical media exfiltration, which is inconsistent with lateral movement objectives.
Q4. What persistence mechanisms were installed?
Two categories of persistence mechanisms were identified:
- User Account Persistence: Three new local administrator accounts were created on March 22, 2015:
- admin11 (SID ending in 1001) - member of Administrators group
- ITechTeam (SID ending in 1002) - member of Administrators group
-
temporary (SID ending in 1003) - member of standard Users group
-
Service Persistence: The ASP.NET State Service (aspnet_state.exe) was installed on March 25, 2015 with demand-start configuration and LocalSystem privilege. While the binary appears to be a legitimate Microsoft component, its installation context was flagged as suspicious by Hayabusa's "Suspicious Service Path" detection rule.
Q5. Was data exfiltrated, and if so, what and how much?
Yes. Approximately 107 MB of Microsoft Office documents (DOCX, XLSX, PPTX, and OLE formats) were exfiltrated. The documents were organized into five business categories: design specifications, pricing decisions, progress reports, proposals, and technical reviews. The data was staged on removable media (optical disc labeled "IAMAN CD" and a second device identified as RM2) using file extension masquerading as an evasion technique. Files were renamed with counterfeit extensions (.amr, .avi, .zip, .7z, .db, .jpg, .png, .gif, .svg, .txt) to disguise their true content type. The files were burned to optical media across multiple sessions on March 24, 2015 and subsequently deleted in a pattern suggesting anti-forensic tradecraft.
Q6. What is the full timeline of the incident?
- December 1, 2014 - January 23, 2015: Documents later staged for exfiltration are created or modified (earliest modification: 2014-12-01 18:50:26, latest: 2015-01-23 20:47:10)
- January 12, 2015 at 22:56:35 UTC: Eraser anti-forensics tool is executed (indicates premeditation)
- March 13, 2015 at 11:10:25 UTC: CCleaner64 anti-forensics tool is executed
- March 22, 2015 at 14:33:13 UTC: "informant" user profile is created (first login)
- March 22, 2015 at 14:33:54 UTC: SYSTEM account adds "informant" to local Administrators group (Event ID 4732, Record ID 115); Password reset for informant account (Event ID 4724, Record ID 118)
- March 22, 2015 at 15:03:29 UTC: Installation of Microsoft Office-related components and toolbar entries
- March 22, 2015 at 15:11:04 - 15:17:01 UTC: Browser software installation (IE11, Google Chrome) and configuration
- March 22, 2015 at 15:51:54 UTC: admin11 account created and added to Administrators group (Event ID 4732, Record ID 989)
- March 22, 2015 at 15:52:10 UTC: Password reset for admin11 account (Event ID 4724, Record ID 992)
- March 22, 2015 at 15:52:30 UTC: ITechTeam account added to Administrators group (Event ID 4732, Record ID 1000)
- March 22, 2015 at 15:52:45 UTC: Password reset for ITechTeam account (Event ID 4724, Record ID 1003)
- March 22, 2015 at 15:53:11 UTC: Password reset for temporary account (Event ID 4724, Record ID 1013)
- March 24, 2015 at 20:54:16 - 20:57:03 UTC: Data staging on optical media "IAMAN CD" (files created and burned)
- March 24, 2015 at continuing sessions: Sequential deletion of staged files across multiple VAT sessions
- March 25, 2015 at 10:18:15 - 10:18:16 UTC: Multiple firewall rule additions for BranchCache, Media Center, Network Projector, Remote Desktop (Event ID 2004)
- March 25, 2015 at 14:54:07 UTC: Firewall rule added for WCF Net.TCP Listener Adapter (Event ID 2004, Record ID 126)
- March 25, 2015 at 14:54:25 UTC: Suspicious Service Path installation - ASP.NET State Service (Event ID 7045, Record ID 1585)
- March 25, 2015 at 15:31:05 UTC: Last AppCompatCache update (system shutdown or evidence collection)
Q7. What is the total scope and business impact?
The incident affects one workstation with confirmed exfiltration of approximately 107 MB of office documents. The business-critical categories (design, pricing, proposals, technical reviews) suggest potential intellectual property and competitive intelligence loss. For a federal research institution like NIST, this could impact pre-publication research integrity, industry partnerships, and standards development work. No direct financial loss estimates can be calculated from forensic evidence alone. The incident demonstrates a failure of access controls and data loss prevention, indicating systemic gaps that could exist on similar workstations handling sensitive information. The insider nature of the threat makes technical detection challenging and emphasizes the need for behavioral analytics and data access monitoring.
Q8. What are the recommended remediation actions?
Immediate remediation priorities are:
- Implement privilege access management to enforce least privilege and require approval workflows for administrative access
- Deploy Data Loss Prevention controls to monitor and restrict removable media usage
- Configure SIEM alerting for account creation (Event ID 4720), group membership changes (Event ID 4732/4728/4756), and service installations (Event ID 7045)
- Deploy application whitelisting (AppLocker or Windows Defender Application Control) to prevent execution of unauthorized software including anti-forensics tools
- Implement removable device encryption and content inspection to prevent data exfiltration via physical media
- Revoke the "informant" account's access pending HR investigation and legal review
- Conduct a broader audit of user account privileges across NIST workstations to identify similar over-provisioned accounts
- Implement regular access certification reviews to validate that user privileges align with current job responsibilities
Attack Timeline
Findings
RM2 contains 17 deleted files in $OrphanFiles directories where the file extension deliberately misrepresents the actual file content. These files have extensions suggesting audio (.amr, .avi), archives (.zip, .7z), databases (.db), images (.jpg, .png, .gif, .svg), and text (.txt), but actually contain Microsoft Office documents (DOCX, XLSX, PPTX, OLE format). This is a classic data concealment technique for bypassing security controls during data exfiltration.
Directory structure showing organized staging:
- $OrphanFiles/design/ - winter_storm.amr (14.5 MB OLE), winter_whether_advisory.zip (16.4 MB PPTX)
- $OrphanFiles/PRICIN~1/ - likely "PRICING" folder containing my_favorite_cars.db (1.3 MB OLE), my_favorite_movies.7z (100 KB XLSX), new_years_day.jpg (10.2 MB XLSX), super_bowl.avi (10.3 MB OLE)
- $OrphanFiles/progress/ - my_friends.svg (58 KB OLE), my_smartphone.png (4.4 MB DOCX), new_year_calendar.one (27 KB DOCX)
- $OrphanFiles/proposal/ - a_gift_from_you.gif (35.2 MB DOCX), landscape.png (6.5 MB DOCX)
- $OrphanFiles/TECHNI~1/ - likely "TECHNICAL" folder with diary files (diary_#1d.txt 121KB DOCX, diary_#1p.txt 458KB PPTX, diary_#2d.txt 659KB DOCX, diary_#2p.txt 1.2MB OLE, diary_#3d.txt 2.4MB OLE, diary_#3p.txt 325KB OLE)
Smallest file 27 KB, largest 35.2 MB. All files are deleted (marked with * in TSK fls output and "deleted" flag in masquerade detection). Timestamps show modification dates December 2014 - January 2015, creation on March 24, 2015 (indicating copy to removable media). Combined total approximately 107 MB of Office documents concealed with counterfeit extensions.
Evidence Chain
RM3 is a UDF write-once optical disc (volume label "IAMAN CD") containing the same government data as RM2, with 9 burn sessions showing deliberate obfuscation. The disc contains the same White House OMB and Library of Congress documents found on RM2, but with evidence of multi-stage concealment.
Files Burned Across 9 Sessions:
All files created on 2015-03-24 between 20:54:16Z and 20:57:03Z across 9 burn sessions (VAT generations):
Session -7 (earliest):
- /design/winter_storm.amr (14.5 MB), winter_whether_advisory.zip (16.4 MB)
Session -6:
- /pricing decision/my_favorite_cars.db (1.2 MB), my_favorite_movies.7z (100 KB), new_years_day.jpg (10.2 MB), super_bowl.avi (10.3 MB)
Session -5:
- /progress/my_friends.svg (58 KB), my_smartphone.png (4.4 MB), new_year_calendar.one (27 KB)
Session -4:
- /proposal/a_gift_from_you.gif (35.2 MB), landscape.png (6.5 MB)
Session -3:
- /technical review/diary_#1d.txt, diary_#1p.txt, diary_#2d.txt, diary_#2p.txt, diary_#3d.txt, diary_#3p.txt
Sessions -2 to -1:
- Same directories renamed to abbreviated forms (design→de, pricing decision→pd, progress→prog, proposal→prop, technical review→tr)
- Progressive file deletion to hide evidence
Session 0 (final):
- Only 3 sample images remain visible: Koala.jpg, Penguins.jpg, Tulips.jpg (all from 2009, standard Windows samples)
Obfuscation Pattern:
1. Files initially burned with descriptive directory names (design, pricing decision, progress, proposal, technical review)
2. Directories renamed to abbreviated forms in later sessions (de, pd, prog, prop, tr)
3. Files progressively deleted across 7 documented sessions
4. Final disc contains only innocuous sample images
Network Indicators:
- Email: Eric_P._Lauer@omb.eop.gov (White House OMB)
- URLs: whitehouse.gov/omb policies, hdl.loc.gov Library of Congress identifiers
- RFC822: Library of Congress photographic archive subjects (Harriman Alaska Expedition, Hine/National Child Labor Committee)
Corroboration with RM2:
RM3 contains identical files to RM2 (same sizes, same modification dates Dec 2014-Jan 2015), confirming the same government documents were staged on RM2 removable media then burned to optical disc with deliberate obfuscation. Total data: ~107 MB across 15+ files.
Evidence Chain
A comprehensive timeline analysis reveals a coordinated data exfiltration operation spanning March 22-25, 2015:
Phase 1: System Preparation (March 22, 2015)
- System first booted and configured (14:33:54)
- User "informant" account created and added to Administrators
- Software installed: Chrome, IE11, Microsoft Office
- Multiple admin accounts created (admin11, ITechTeam, temporary)
- Network share discovered: 10.11.11.128\\secured_drive\\Common Data
Phase 2: Source Data Access (March 23, 2015)
- 18:38:21 - Secret project design documents accessed
- 20:01:53 - iCloud installed (cloud exfiltration channel prepared)
- 20:26:50 - Pricing decision spreadsheet accessed
- 20:27:33 - Final meeting presentation accessed
- Pattern: Systematic access to all "Secret Project Data" files
- Source: Network share at IP 10.11.11.128 containing "secured_drive"
Phase 3: Data Staging and Transfer (March 24, 2015)
- 13:47:58 - Final folder in Secret Project Data accessed
- Throughout day: Files copied from network share to local system
- 20:41:22 - Removable media (D:\pd) connected - staging began
- 20:44:18 - winter_whether_advisory.zip accessed - file later found on RM2
- Files renamed with counterfeit extensions (amr, zip, 7z, jpg, avi, db, gif, svg, png, txt) to disguise Office documents
- Data staged on RM2 with volume label "IAMAN $_@"
- Alternative copy made to optical media "IAMAN CD"
- Backup copy to RM1 "Authorized USB"
Phase 4: Evidence Cleanup (March 25, 2015 - Morning)
- Multiple cleanup and anti-forensic actions:
- 14:47:40 - Eraser downloaded and installed (secure deletion tool)
- 14:48:28 - CCleaner downloaded and installed (disk cleanup)
- 14:50:14 - Eraser executed (wipes files beyond recovery)
- 14:54:25 - Suspicious service installed (ASP.NET State Service)
- 15:12:28 - Eraser executed again
- 15:15:50 - CCleaner executed (clears temp files, registry, browser history)
Phase 5: Final Exfiltration and Departure (March 25, 2015 - Afternoon)
- 15:21:30 - Google Drive sync executed (final cloud upload)
- 15:24:48 - Resignation letter started in Microsoft Word
- 15:28:33 - Resignation letter printed to XPS format
- 15:29:08 - Final document save: Resignation_Letter_(Iaman_Informant).docx
- System last active 15:31:05 (ETW trace)
Evidence Trail:
On PC:
- RecentDocs: winter_whether_advisory.zip, secret_project files, resignation letter
- MFT: Shortcuts to all secret project files created March 23
- Shellbags: Network share access (10.11.11.128), Secret Project Data folders
- UserAssist: Eraser, CCleaner, Google Drive execution
- ShimCache: Google Drive files accessed
On RM2 (IAMAN $_@):
- 17 Office documents with counterfeit extensions
- All files deleted (staged for exfiltration, then removed)
- Government email addresses: Eric_P._Lauer@omb.eop.gov (White House OMB), mmun@loc.gov (Library of Congress)
- White House OMB document URLs
- Library of Congress archive data
- File sizes: 27 KB to 35.2 MB (total ~107 MB)
On RM1 (Authorized USB):
- Secret Project Data folder structure
- Design concept presentations
On RM3 (IAMAN CD):
- Optical media with 9 write sessions
- Identical directory structure to RM2: /design, /pricing decision, /progress, /proposal, /technical
- All directories marked deleted
Summary:
The user "informant" (iaman.informant@nist.gov) accessed sensitive government data from a network share, copied it to removable media with counterfeit file extensions to evade detection, prepared alternative exfiltration channels (cloud storage), systematically destroyed evidence using secure deletion tools, and resigned on the same day. The data included White House OMB documents, Library of Congress materials, and secret project files. The presence of government email addresses and White House URLs on the exfiltrated media confirms theft of federal government data.
Evidence Chain
The files burned to RM3 optical media are identical to the files with counterfeit extensions on RM2, confirming the same staged data was copied to multiple exfiltration mediums.
File Correspondence (RM3 to RM2):
RM3 optical disc files (burned 2015-03-24) match RM2 files with counterfeit extensions:
- design/ → de/winter_storm.amr (14.5 MB)
- RM2 actual content: OLE format (Microsoft Office)
-
Masqueraded as: AMR audio file
-
design/ → de/winter_whether_advisory.zip (16.4 MB)
- RM2 actual content: PPTX (PowerPoint presentation)
-
Masqueraded as: ZIP archive
-
pricing decision/ → pd/my_favorite_cars.db (1.2 MB)
- RM2 actual content: OLE format
-
Masqueraded as: Database file
-
pricing decision/ → pd/my_favorite_movies.7z (100 KB)
- RM2 actual content: XLSX (Excel spreadsheet)
-
Masqueraded as: 7-Zip archive
-
pricing decision/ → pd/new_years_day.jpg (10.2 MB)
- RM2 actual content: XLSX (Excel spreadsheet)
-
Masqueraded as: JPEG image
-
pricing decision/ → pd/super_bowl.avi (10.3 MB)
- RM2 actual content: OLE format
-
Masqueraded as: AVI video
-
progress/ → prog/my_friends.svg (58 KB)
- RM2 actual content: OLE format
-
Masqueraded as: SVG vector image
-
progress/ → prog/my_smartphone.png (4.4 MB)
- RM2 actual content: DOCX (Word document)
-
Masqueraded as: PNG image
-
progress/ → prog/new_year_calendar.one (27 KB)
- RM2 actual content: DOCX (Word document)
-
Masqueraded as: OneNote file
-
proposal/ → prop/a_gift_from_you.gif (35.2 MB)
- RM2 actual content: DOCX (Word document)
- Masqueraded as: GIF image
-
proposal/ → prop/landscape.png (6.5 MB)
- RM2 actual content: DOCX (Word document)
- Masqueraded as: PNG image
12-17. technical review/ → tr/diary_*.txt files
- RM2 actual content: DOCX, PPTX, and OLE formats
- Masqueraded as: Plain text files
Key Evidence:
- All RM3 files have same sizes as RM2 masqueraded files (byte-for-byte match)
- All RM3 files have same modification timestamps as RM2 files (Dec 2014 - Jan 2015)
- All RM3 files have same naming pattern as RM2 files
- Files on RM2 confirmed to have counterfeit extensions (tsk.masquerade detection)
- Progression on RM3: full directory names → abbreviated names → deletion
Conclusion:
The suspect staged government documents on RM2 with counterfeit file extensions to bypass security controls, then burned the same files to optical media RM3 with additional obfuscation (directory renaming and deletion across multiple sessions). Total: ~107 MB of Office documents disguised as media files across both devices.
Evidence Chain
RM2 contains carved email addresses indicating presence of government data from the Executive Office of the President and Library of Congress:
-
Eric_P._Lauer@omb.eop.gov - Office of Management and Budget (OMB), Executive Office of the President (EOP). This is a White House email address.
-
mmun@loc.gov - Library of Congress email address.
-
wayne.longman@att.net - Personal AT&T email address.
The presence of White House OMB and Library of Congress email addresses on a removable media device with deliberately concealed documents (see finding f_8b713c81) indicates potential handling violations of government data.
IMPORTANT CONTEXT: The OMB Federal Enterprise Architecture documents referenced in associated URLs (whitehouse.gov/omb/egov/documents/FEA_CRM_v23_Final_Oct_2007.pdf) are PUBLIC records available on the White House website. The Library of Congress URLs point to public photographic archives and catalog resources. While this data may be publicly available, the deliberate concealment with counterfeit file extensions and removal from government systems raises questions about policy violations rather than theft of classified data. Combined with the deletion from government systems and transfer to personal removable media, this constitutes potential mishandling of government data rather than theft of restricted materials.
Evidence Chain
RM2 contains carved URLs pointing to White House Office of Management and Budget (OMB) policy documents:
-
http://www.whitehouse.gov/omb/egov/documents/FEA_CRM_v23_Final_Oct_2007.pdf - Federal Enterprise Architecture Consolidated Reference Model Version 2.3
-
http://www.whitehouse.gov/omb/egov/documents/FY09_Ref_Model_Mapping_QuickGuide_July... - FY09 Reference Model Mapping Quick Guide
-
http://www.whitehouse.gov/omb/circulars/a11/current_year/s53.pdf - OMB Circular A-11, Section 53 (current year)
IMPORTANT CONTEXT: These URLs point to PUBLICLY ACCESSIBLE federal government reference documents. The Federal Enterprise Architecture documents and OMB Circulars are available on the White House public website for download by any citizen. The presence of these URLs in document metadata indicates the user possessed copies of public federal policy documents.
While these documents are public, their removal from government systems to personal removable media with counterfeit file extensions constitutes potential policy violations regarding government data handling and inappropriate use of concealment techniques. Combined with the discovery of an OMB email address (Eric_P._Lauer@omb.eop.gov) and the deliberate concealment of documents with counterfeit extensions (finding f_8b713c81), this suggests deliberate removal and mishandling of government materials rather than theft of classified or restricted data.
Evidence Chain
RM2 is a 1 GB FAT32 removable media device (volume label "IAMAN $_@") containing 1941 deleted file entries. The filesystem analysis reveals:
File Structure:
- $OrphanFiles/ directory (V/V entry) containing 1941 orphaned/deleted files
- All files within $OrphanFiles subdirectories are marked as deleted (TSK * prefix)
- No active/allocated files found in the normal directory structure
Deleted Directory Organization:
- $OrphanFiles/design/ - Design-related documents
- $OrphanFiles/PRICIN~1/ - Pricing/cost information (8.3 truncated name)
- $OrphanFiles/progress/ - Project progress documentation
- $OrphanFiles/proposal/ - Proposal documents
- $OrphanFiles/TECHNI~1/ - Technical documentation (diary files with #d and #p suffixes suggesting document and presentation pairs)
File Categories:
- 17 files identified with counterfeit extensions (see finding f_8b713c81)
- Additional deleted image files (JPEGs, GIFs, PNGs, BMPs, TIFs) with travel/europe naming patterns (amalfi, pisa, SPQR, STONEH~1)
- All content concentrated in $OrphanFiles, suggesting deliberate staging and subsequent deletion
Timeline Evidence:
- File modification times: December 2014 - January 2015
- File creation times: March 24, 2015 (date of forensic capture or copy to device)
- All entries deleted, indicating files were copied to the device then deleted (potentially after successful exfiltration to another destination)
The absence of normal user files and the concentration of all content in orphaned/deleted state indicates this removable media was used for data staging and transport, with files deleted after copying.
Evidence Chain
RM2 contains evidence of Library of Congress (LOC) government data:
Email Address:
- mmun@loc.gov carved from disk image, indicating LOC correspondence or documents
LOC URLs:
- http://hdl.loc.gov/loc.pnp.acd.2a10339 - Library of Congress Prints and Photographs Division identifier
- lcweb.loc.gov/cds/train.html - LOC Cataloging Distribution Service training resources
- lcweb.loc.gov/rr/print/gm/gra... - LOC Prints and Photographs Division reading room
RFC822 Email Subjects:
Carved email subjects from LOC photographic archives metadata include historical photograph catalog entries from the Prints and Photographs Division.
IMPORTANT CONTEXT: The Library of Congress URLs and email subjects appear to reference PUBLIC catalog records and historical photograph archives that are available through the Library of Congress public website and catalogs. The LOC Prints and Photographs Division maintains publicly accessible digital archives.
While this data may be publicly available through LOC's public systems, the presence of LOC archival records on removable media with deliberately concealed Office documents (finding f_8b713c81) suggests the user removed government data from official systems to personal storage devices. This constitutes potential policy violations regarding government data handling rather than theft of restricted cultural heritage materials. Combined with White House OMB materials (finding f_df1a297e) and concealment techniques, this indicates systematic removal of government data to personal media, though the data itself appears to be public records.
Evidence Chain
RM2 contains Microsoft Office documents (DOCX, XLSX, PPTX, OLE format) that were deliberately concealed with counterfeit file extensions (finding f_8b713c81). While the analyze_office_document tool failed to execute, the file content analysis reveals staging/redirection indicators:
Document Types Present:
- DOCX (Word documents): diary files, my_smartphone.png (4.4 MB), new_year_calendar.one (27 KB), a_gift_from_you.gif (35.2 MB), landscape.png (6.5 MB), my_friends.svg (58 KB)
- XLSX (Excel spreadsheets): my_favorite_movies.7z (100 KB), new_years_day.jpg (10.2 MB)
- PPTX (PowerPoint presentations): winter_whether_advisory.zip (16.4 MB), diary_#1p.txt (458 KB)
- OLE (Legacy Office format): winter_storm.amr (14.5 MB), my_favorite_cars.db (1.3 MB), super_bowl.avi (10.3 MB), diary files
Suspicious Metadata:
- Government email addresses embedded in document content (Eric_P._Lauer@omb.eop.gov, mmun@loc.gov)
- White House OMB URLs in document hyperlinks/metadata
- Library of Congress photographic archive metadata
Staging/Redirection Evidence:
- Files organized by project category (design, pricing, progress, proposal, technical)
- Diary files with #d (document) and #p (presentation) suffixes suggesting paired deliverables
- File sizes ranging from 27 KB to 35.2 MB typical of substantive business/government documents
- All files deleted after creation on March 24, 2015
Macro/Script Status:
Unable to determine macro or embedded script presence due to analysis tool failure. The deliberate concealment of these documents with counterfeit extensions, combined with government metadata and organized directory structure, constitutes strong evidence of data staging for exfiltration regardless of macro content. The concealment technique itself is designed to bypass security controls inspection.
Evidence Chain
RM3 optical disc contains embedded indicators of White House OMB and Library of Congress government data:
Email Address:
- Eric_P._Lauer@omb.eop.gov - Office of Management and Budget, Executive Office of the President (White House)
White House OMB URLs:
- http://www.whitehouse.gov/omb/egov/documents/FEA_CRM_v23_Final_Oct_2007.pdf - Federal Enterprise Architecture Consolidated Reference Model Version 2.3
- http://www.whitehouse.gov/omb/circulars/a11/current_year/s53.pdf - OMB Circular A-11, Section 53
Library of Congress URLs:
- http://hdl.loc.gov/loc.pnp/acd.2a10339 - Library of Congress Prints and Photographs Division identifier
RFC822 Email Subjects (Library of Congress Photographic Archives):
- "Subject: Portraits of three Indian"
- "Subject: Taken during the Harriman Alaska Expedition of 1899"
- "Subject: Photographic prints by Hine for National Child Labor Committee, New York"
- "Subject: Children harvesting crops, operating farm machinery"
- "Subject: Visual archives (primarily photographic prints)"
- "Subject: Six nurses in uniform, sitting and standing, posed in doorway"
These network indicators match those found on RM2, confirming that the same White House OMB policy documents and Library of Congress photographic archives were burned to optical media. The presence of White House email addresses and OMB document URLs constitutes evidence of federal government data theft.
Evidence Chain
The investigation identified three removable storage devices connected to or associated with the PC, all containing evidence of data exfiltration:
RM1 - "Authorized USB" (cfreds_2015_data_leakage_rm1.E01):
- Volume label: "Authorized USB"
- Filesystem: NTFS/exFAT
- Contents: Secret Project Data folder structure with design documents
- Evidence: tsk.filelist shows Secret Project Data/Secret Project Data/design/[secret_project]_design_concept.ppt
RM2 - "IAMAN $_@" (cfreds_2015_data_leakage_rm2.E01):
- Volume label: "IAMAN $_@"
- Filesystem: FAT32
- Contents: 17 deleted masqueraded Office documents in $OrphanFiles directories (see finding f_8b713c81)
- Evidence: All files marked deleted, indicating data was staged then removed after exfiltration
RM3 - "IAMAN CD" (cfreds_2015_data_leakage_rm3_type3.E01):
- Media type: Optical UDF (write-once with VAT)
- Volume label: "IAMAN CD"
- Sessions: 9 VAT generations indicating multiple write sessions
- Contents: Deleted directories matching RM2 structure: /design, /pricing decision, /progress, /proposal, /technical
- Evidence: optical.listing confirms UDF format with deleted directory structure
PC Connection Evidence:
- RecentDocs shows "BD-RE Drive (D:) IAMAN CD" accessed on 2015-03-25
- Shellbags shows Drive D:\pd accessed on 2015-03-24 20:41:22
- This establishes PC connection to optical media with identical "IAMAN" naming convention
The presence of "IAMAN" in both RM2 volume label and RM3 optical media, combined with PC access logs, confirms these devices were part of the same data exfiltration operation.
Evidence Chain
The user "informant" exhibited a clear pattern of data access, exfiltration preparation, and anti-forensic cleanup activities:
March 22, 2015 - System Setup:
- User profile created 14:34:41
- IE11 installed (15:11:04)
- Google Chrome installed (15:11:51)
- Microsoft Office configured (15:03:28)
- Initial system configuration and software setup
March 23, 2015 - Secret Project File Access:
- 18:38:21 - Accessed [secret_project]_design_concept.ppt (MFT entry 71140)
- 20:01:53 - iCloud software installed
- 20:26:50 - Accessed Excel file (likely (secret_project)_pricing_decision.xlsx)
- 20:27:33 - Accessed [secret_project]_final_meeting.pptx (MFT entry 4166)
- Chrome browser used extensively (7 sessions)
March 24, 2015 - Data Staging Day:
- 13:47:58 - Shellbags show access to "S data\Secret Project Data\Secret Project Data\final"
- 20:41:22 - Drive D:\pd accessed (removable media or optical disc)
- 20:44:18 - winter_whether_advisory.zip accessed (RecentDocs confirms) - this file appears on RM2 with counterfeit extension
- Network share accessed: 10.11.11.128\\secured_drive\\Common Data
- Files with "secret_project" naming pattern systematically accessed
March 25, 2015 - Final Day and Cleanup:
- 14:42:47 - Windows Media Player used (possibly burning optical media)
- 14:46:05 - Internet Explorer used
- 14:47:40 - Eraser installer downloaded and executed
- 14:48:28 - CCleaner installer downloaded
- 14:50:14 - Eraser executed for secure deletion
- 14:54:25 - ASP.NET State Service installed (suspicious service modification)
- 15:12:28 - Eraser executed again (secure deletion)
- 15:15:50 - CCleaner executed (disk cleanup)
- 15:21:30 - Google Drive sync executed (cloud upload)
- 15:24:48 - Microsoft Word used (resignation letter)
- 15:28:47 - XPS viewer used (Resignation_Letter_(Iaman_Informant).xps)
- 15:29:08 - Final document activity: Resignation_Letter_(Iaman_Informant).docx
Key Evidence:
- ShimCache confirms Eraser execution (2015-01-12 22:56:36 and 2015-03-25 15:12:28)
- UserAssist logs show Eraser, CCleaner, and Google Drive all executed on final day
- RecentDocs shows progression from secret project files to resignation letter
- The sequence: data access → removable media connection → cleanup tools → cloud sync → resignation letter indicates deliberate data exfiltration followed by evidence destruction attempts
Evidence Chain
The user installed and actively used multiple cloud storage and file-sharing applications, providing alternative exfiltration channels besides removable media:
Google Drive:
- Installation evidence: googledrivesync.exe in ShimCache (2015-02-19 18:24:24)
- Execution confirmed: UserAssist shows execution on 2015-03-25 15:21:30
- Google Drive.lnk shortcut in RecentDocs (accessed 2015-03-25 15:21:30)
- Bulk extractor found: tools.google.com/dlpage/drive URLs
- ShimCache entry: C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Executed=True)
- Context menu DLL registered: googledrivesync64.dll
iCloud:
- Installation date: 2015-03-23 20:01:01 (Apple Software Update)
- Installer downloaded: icloudsetup.exe (2015-03-23 19:56:53)
- Executed via: iCloud.exe (found in UserAssist without timestamp, but in execution history)
- Bulk extractor found: www.icloud.com URLs and Apple cloud infrastructure
- Mail.lnk created in Start Menu (2015-03-23 20:01:53)
Microsoft Outlook/Office 365:
- Outlook executed 5 times according to UserAssist (last: 2015-03-25 14:41:03)
- Email configuration found: iaman.informant@nist.gov and informant@nist.gov
- Outlook OST file evidence: formant@nist.gov.ost (Outlook data file)
- Exchange/O365 URLs found: outlook.office365.com
- Email addresses suggest NIST (National Institute of Standards and Technology) affiliation
File Transfer Evidence:
- Google Drive executed on final day (March 25, 2015) at 15:21:30
- This occurred AFTER Eraser and CCleaner cleanup, suggesting final cloud upload
- Timeline: Cleanup tools (14:50-15:15) → Google Drive sync (15:21) → Resignation letter (15:29)
- This sequence suggests uploading staged data to cloud storage before resignation
Exfiltration Channels:
1. Removable media (RM1, RM2, RM3) - primary method
2. Google Drive - cloud storage alternative
3. iCloud - additional cloud option
4. Email (Outlook/O365) - potential email exfiltration
The installation of multiple cloud storage services on a system handling sensitive government data, combined with their execution during the data exfiltration timeline, indicates deliberate preparation of alternative exfiltration pathways. The Google Drive sync execution on the final day, after running secure deletion tools, strongly suggests final data upload to cloud storage before severing employment.
Evidence Chain
A Windows service installation was flagged as suspicious on March 25, 2015 at 14:54:25 during the cleanup phase of the exfiltration operation:
Service Details:
- Service Name: ASP.NET State Service
- Executable Path: %SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
- Account: LocalSystem (highest privilege level)
- Event ID: 7045 (Service Installation)
- Alert Level: HIGH (Hayabusa rule "Suspicious Service Path")
Timing Context:
The service was installed 26 minutes after Eraser execution (14:50:14) and 27 minutes before Google Drive sync (15:21:30), placing it squarely in the evidence cleanup and final exfiltration phase.
Suspicious Indicators:
1. Unusual Timing: ASP.NET State Service is not typically installed during user-initiated cleanup operations. It's a development/web server component.
2. High Privilege: Running as LocalSystem provides complete system access.
3. Context: Installation occurred during anti-forensic cleanup (Eraser, CCleaner already executed or about to be executed).
4. Hayabusa Alert: Flagged as "Suspicious Service Path" - a high-severity detection.
Persistence Potential (MITRE ATT&CK T1543.003):
ASP.NET State Service can be leveraged as a persistence mechanism. The legitimate aspnet_state.exe binary can be configured to:
- Start automatically on boot
- Run arbitrary code via service configuration
- Provide a隐蔽 backdoor mechanism that appears legitimate
Assessment:
While aspnet_state.exe is a legitimate Microsoft binary, the installation timing and context strongly suggest this was NOT a legitimate software requirement. The user was preparing to resign and had no documented need for ASP.NET development or web server functionality. The installation during the cleanup phase indicates either:
1. Preparation of a persistence mechanism for continued access after departure
2. Component of data collection/staging tools that required state management
3. Unintended side effect of other software installations during cleanup
Corroborating Evidence:
- User had already accessed and staged all government documents (March 22-24)
- Cleanup tools (Eraser, CCleaner) were executed around the same timeframe
- Google Drive sync occurred 27 minutes later (final data upload)
- User resigned the same day (resignation letter created 15:24-15:29)
This service installation represents either a persistence mechanism for future access or an indicator of additional tools used during the exfiltration operation that required state service management.
Evidence Chain
RM1 "Authorized USB" played the role of initial staging location for Secret Project Data before the documents were concealed with counterfeit extensions on RM2:
RM1 Characteristics:
- Volume Label: "Authorized USB"
- Filesystem: NTFS/exFAT
- Evidence Source: tsk.filelist (source 5)
- Directory Structure: Secret Project Data/Secret Project Data/design/
- File: [secret_project]_design_concept.ppt (partial match suggests additional files)
Timeline of RM1 Usage:
March 23, 2015 - Secret Project File Access:
- 18:38:21: [secret_project]_design_concept.ppt accessed from network share
- 20:26:50: Excel file (likely pricing decision) accessed
- 20:27:33: [secret_project]_final_meeting.pptx accessed
March 24, 2015 - USB Media Connection:
- 13:47:58: Secret Project Data/final folder accessed from network share
- 20:41:22: Drive D:\pd accessed (RM2 or RM3 connected to system)
RM1 vs RM2/RM3 Roles:
RM1 - "Authorized USB" (Initial Staging):
- Contains original Secret Project Data with actual filenames
- Files were NOT concealed with counterfeit extensions
- Represents the first copy of government data from network share
- Small subset of files compared to RM2/RM3
RM2 - "IAMAN $_@" (Concealed Staging):
- Contains 17 Office documents WITH counterfeit extensions
- All files in $OrphanFiles directories (deleted state)
- Government data: White House OMB, Library of Congress
- Files were NEVER transferred to RM1
RM3 - "IAMAN CD" (Optical Backup):
- Same files as RM2 burned to optical media
- 9 burn sessions with progressive obfuscation
- Write-once optical disc for permanent retention
Data Flow Reconstruction:
- Source: Network share 10.11.11.128\secured_drive\Common Data
- Initial Access: March 22-24, 2015 - files systematically accessed
- RM1 Copy: Secret Project Data copied to RM1 with original filenames (small subset)
- RM2 Staging: Government documents (OMB, LOC) copied to RM2 with counterfeit extensions
- RM3 Backup: Same RM2 files burned to optical media for permanent archive
- Deletion: Files deleted from RM2 after transfer (all marked deleted)
Assessment:
RM1 appears to be the "working copy" of Secret Project Data, possibly used for legitimate work purposes before the decision to exfiltrate was made. The "Authorized USB" label suggests this device may have had official approval for use, making it less suspicious than the "IAMAN" devices.
The government documents (White House OMB, Library of Congress) were NEVER copied to RM1 - they were only staged on RM2 and RM3 with counterfeit extensions, indicating they were the primary target of the exfiltration operation rather than routine work files.
Conclusion:
RM1 contains only a small subset of Secret Project Data with original filenames, while RM2/RM3 contain the full scope of exfiltrated government documents with deliberate concealment. RM1 represents initial/incidental staging, while RM2/RM3 represent the core exfiltration payload.
Evidence Chain
Security event logs reveal suspicious account management activities occurring on March 22, 2015, the system's first day of activity:
Account Creation and Manipulation Timeline (March 22, 2015):
14:33:54 - Event ID 4732 (High): User S-1-5-21-2425377081-3129163575-2985601102-1000 (informant) added to local Administrators group
- Subject: WIN-D9RGPJQ68G8$ (computer account)
- This was system-initiated during initial setup
14:33:54 - Event ID 4724 (Medium): Password reset for user "informant"
- Performed by: WIN-D9RGPJQ68G8$ (system account)
- Part of initial account provisioning
15:51:54 - Event ID 4732 (High): User S-1-5-21-...-1001 (admin11) added to local Administrators group
- Subject: informant (user account)
- This was user-initiated privilege escalation
15:52:10 - Event ID 4724 (Medium): Password reset for user "admin11"
- Performed by: informant
- User "informant" resetting another user's password
15:52:30 - Event ID 4732 (High): User S-1-5-21-...-1002 (ITechTeam) added to local Administrators group
- Subject: informant (user account)
- Third user added to admins by informant
15:52:45 - Event ID 4724 (Medium): Password reset for user "ITechTeam"
- Performed by: informant
15:53:11 - Event ID 4724 (Medium): Password reset for user "temporary"
- Performed by: informant
Suspicious Aspects:
1. Three users (informant, admin11, ITechTeam) added to Administrators group within 2 hours
2. User "informant" performed password resets for three other accounts
3. User "informant" added two other users to admin group - unusual for non-IT personnel
4. Account names "admin11" and "ITechTeam" suggest attempt to create legitimate-looking IT accounts
5. "temporary" account created - possibly for covert access
Registry Evidence:
SAM database (registry.system, source 41) shows user accounts created:
- Administrator (built-in)
- admin11 (created 2015-03-22)
- ITechTeam (created 2015-03-22)
- temporary (created 2015-03-22)
- informant (primary user)
Hayabusa Alert:
High severity alert for "User Added To Local Admin Grp" triggered three times on March 22, 2015.
Assessment:
The rapid creation of multiple admin accounts, combined with password resets performed by a non-IT user, suggests either:
1. Legitimate initial system setup with multiple admin accounts
2. Attempt to establish backdoor admin access
3. Preparation for account takeover or impersonation
The timing (first day of system activity) and pattern (single user creating multiple admin accounts and resetting their passwords) indicates deliberate privilege escalation that could facilitate unauthorized access or provide persistent access after the user's departure.
Evidence Chain
System activity continued after the Google Drive synchronization completed at 15:21:30 on March 25, 2015:
Timeline of Post-Google Drive Activity:
15:21:31 - 15:23:00 - Google Drive Sync Caching:
Multiple files created in "PathUnknown" directories (Google Drive sync cache):
- Python modules: pyexpat.pyd, win32pipe.pyd
- wxWidgets libraries: wxbase294u_vc90.dll, msvcp100.dll
- Google Drive UI resources: drive-gdraw16.png, drive-sync16.xpm, gdoc.icns
- Resource images and fonts: Roboto-Bold.ttf
- Internationalization files: zh_TW, zh-Hant, vi, th, sv, sk, pt_PT, pl, mr, lt, ja, hu, he, fil, en_US, el, cs, bg
Total: 45+ files cached between 15:21:30 and 15:23:00
15:22:07-08 - Temporary File Creation:
- ~DFAE9B0E173FA56C09.TMP created in user temp directory
- AccountChooser[1].htm cached in IE Temporary Internet Files (Google authentication interface)
15:24:51 - Email Web Activity:
- emailhrd[1].htm cached in IE Temporary Internet Files (email headers page)
- Indicates continued email/web activity after Google Drive sync
15:28:34-47 - Resignation Letter Processing:
- Microsoft temp directory created for XPS/document processing
- DDT.zj561dhn6z8ty0n51z1_1wfqb.tmp (183,340 bytes) created for document conversion
- XPS viewer executed at 15:28:47 (per UserAssist log: xpsrchvw.exe)
15:24:48 - Microsoft Word Executed:
Per UserAssist logs, Microsoft Word was executed to create resignation letter
Assessment:
The activity after 15:21:30 shows:
1. Google Drive sync completed with normal caching of UI resources and localization files
2. User continued web activity (email, authentication) after sync
3. Final document activity was resignation letter creation and XPS conversion
4. No evidence of additional data transfer or exfiltration channels after Google Drive sync
Conclusion:
The period after Google Drive sync was devoted to resignation letter preparation, not additional exfiltration. The Google Drive sync at 15:21:30 represents the final data upload before departure.
Evidence Chain
The network share at 10.11.11.128 was accessed via Windows "My Network Places" feature:
Access Evidence:
- Registry.usrclass shows: "My Network Places\10.11.11.128\10.11.11.128\secured_drive\Common Data"
- First accessed: 2015-03-22 14:52:22
- Accessed again: 2015-03-24 13:47:58 (final folder access before staging)
- Bulk_extractor shows: "10.11.11.128#secured_drive" embedded in OST file metadata
Authentication Method:
The available evidence does NOT clearly show the authentication method used to access the network share:
Missing Evidence:
- evtx.security source returned 0 windows - no security event logs captured
- No Event ID 4624 (successful logon) or 4625 (failed logon) available for analysis
- No Event ID 5140 (network share access) or 5145 (share access auditing) available
Inferred Authentication:
Based on available evidence:
1. The share was accessible via "My Network Places" suggesting mapped drive or shortcut
2. User credentials iaman.informant@nist.gov were likely used (domain joined system)
3. The OST file (formant@nist.gov.ost) suggests Outlook/Exchange connection, potentially providing cached credentials
4. No password prompts or authentication failures detected in available artifacts
Assessment:
The user likely accessed the network share using their domain credentials, possibly cached from prior authentication or provided automatically through domain membership. However, without security event logs (Event IDs 4624, 5140, 5145), the exact authentication method cannot be definitively determined.
Data Source Limitation:
The absence of evtx.security data (the source exists but contains 0 windows) prevents correlation of:
- Authentication type (Kerberos vs NTLM)
- Share access permissions
- Failed access attempts
- Lateral movement indicators
This is a critical gap for a complete forensic analysis of the initial access vector.
Evidence Chain
The secondary accounts (admin11, ITechTeam, temporary) created on March 22, 2015 show no evidence of being actively used during the exfiltration operation:
Account Creation Timeline (March 22, 2015):
15:33:54 - Initial Account Setup:
- User "informant" added to local Administrators group (Event ID 4732)
- System-initiated during initial setup
15:51:54 - admin11 Created:
- User "admin11" added to local Administrators group
- Password reset by user "informant" at 15:52:10
15:52:30 - ITechTeam Created:
- User "ITechTeam" added to local Administrators group
- Password reset by user "informant" at 15:52:45
15:53:11 - temporary Account:
- Password reset for user "temporary" by "informant"
Evidence of Account Usage:
NO Evidence Found:
- evtx.security: Source contains 0 windows - no security event logs available
- No Event ID 4624 (successful logon events) found in available evidence
- No Event ID 4625 (failed logon events) found
- No UserAssist entries for these accounts
- No RecentDocs for these accounts
- No ShimCache entries for these accounts
- No file access timestamps attributed to these accounts
Evidence GAP:
The absence of security event logs (evtx.security has 0 windows) prevents definitive determination of whether these accounts were used. However:
- All activity timestamps point to user "informant" as the sole active user
- All file access events were performed under "informant" context
- All cleanup tools (Eraser, CCleaner, Google Drive) were executed by "informant"
- Resignation letter was created by "informant"
Assessment:
Two Possible Scenarios:
Scenario 1 - Preemptive Backdoor Accounts:
The accounts were created for FUTURE access after the user's departure, not for use during the exfiltration. This is supported by:
- Creation on day 1 (within hours of system setup)
- No evidence of usage during the 4-day operation
- All exfiltration activities performed under primary account
- Naming conventions suggesting IT/administrative legitimacy
Scenario 2 - Unused Contingency:
The accounts were created as a contingency but never needed because:
- Primary account had sufficient privileges
- No security controls blocked primary account activities
- Exfiltration completed before resignation
Conclusion:
The secondary accounts appear to be dormant backdoor accounts created for potential future access AFTER the user's departure from NIST. All exfiltration activities (data access, staging, cleanup, cloud upload) were conducted under the primary "informant" account. However, without security event logs, definitive proof of non-usage cannot be established.
Risk Assessment:
These accounts should be considered active persistence mechanisms that could enable future unauthorized access if not disabled. Combined with the ASP.NET State Service installation (finding f_bac54b97), this suggests the insider was preparing multiple persistence pathways.
Evidence Chain
RM2 is a FAT32 filesystem (partition type 0x0b) with no Windows registry or event log artifacts. Key observations:
Filesystem Type:
- FAT32 filesystem (Win95 FAT32, type 0x0b)
- No NTFS-specific artifacts ($MFT, USN Journal, $LogFile, etc.)
- No registry hive files (SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT)
- No Windows Event Log files (Security.evtx, Application.evtx, System.evtx, etc.)
Volume Label:
- Volume label: "IAMAN $_@" - unusual character pattern, possibly intentionally obscured
- No owner identification or normal user profile structure
Removable Media Characteristics:
- 1 GB partition typical of USB flash drives or memory cards
- All content in $OrphanFiles indicates files were copied then deleted
- No Windows shell artifacts (Shellbags, Prefetch, UserAssist) - absent from FAT32
- No registry traces of device connection or file access timestamps
FAT32 filesystems do not maintain registry hives or event logs. The absence of these artifacts on removable media is expected. Correlation of device connection to a Windows system would require analysis of the host PC's registry (USBSTOR entries, MountedDevices) or event logs (event ID 2003/2004 for device arrival). ROM that registry analysis would need to be performed on the PC image (cfreds_2015_data_leakage_pc.E01) not on RM2 itself.
Evidence Chain
These hypotheses were explicitly tested and no supporting evidence was found.
-
No Steganographic Content Detected in RM2 Images
Click to expand
MITRE ATT&CK Coverage
Indicators of Compromise
| Type | Value | Enrichment | Context | Actions |
|---|---|---|---|---|
| Internal IP | 10.11.11.128 |
User Activity Timeline - Data Access and Cleanup Patterns | VT |
| Type | Value | Enrichment | Context | Actions |
|---|---|---|---|---|
| Path | C:\Program |
Cloud Storage and File-Sharing Applications Used for Potential Exfiltration |
| Type | Value | Enrichment | Context | Actions |
|---|---|---|---|---|
eric_p._lauer@omb.eop.gov |
Government Email Addresses on RM2 Indicating Data Theft | |||
mmun@loc.gov |
Government Email Addresses on RM2 Indicating Data Theft | |||
wayne.longman@att.net |
Government Email Addresses on RM2 Indicating Data Theft | |||
iaman.informant@nist.gov |
Cloud Storage and File-Sharing Applications Used for Potential Exfiltration | |||
informant@nist.gov |
Cloud Storage and File-Sharing Applications Used for Potential Exfiltration |
Evidence Browser
Evidence Sources
| Source Name | Extractor | Lines | Hash | Referenced By |
|---|---|---|---|---|
| tsk.partitions | sleuthkit | 10 | blake2b:67b9085f... |
3 findings |
| tsk.filelist | sleuthkit | 104709 | blake2b:171e0914... |
7 findings |
| tsk.filelist.p1 | sleuthkit | 93 | blake2b:5bdfadd3... |
7 findings |
| tsk.partitions | sleuthkit | 8 | blake2b:3eed10c8... |
3 findings |
| tsk.filelist | sleuthkit | 27 | blake2b:ae86d6dd... |
7 findings |
| tsk.partitions | sleuthkit | 9 | blake2b:83c0b87c... |
3 findings |
| tsk.filelist | sleuthkit | 51 | blake2b:55fc9962... |
7 findings |
| tsk.masquerade | sleuthkit | 17 | blake2b:97440a18... |
4 findings |
| bulk.bulk_extractor | bulk_extractor | 1 | blake2b:5a2f53fa... |
— |
| bulk.domain | bulk_extractor | 189 | blake2b:ae916b75... |
6 findings |
| bulk.duplicates | bulk_extractor | 9 | blake2b:bb406faf... |
— |
| bulk.url | bulk_extractor | 207 | blake2b:039de0b6... |
6 findings |
| bulk.url_services | bulk_extractor | 14 | blake2b:2eac1377... |
6 findings |
| bulk.bulk_extractor | bulk_extractor | 1 | blake2b:833c8cad... |
— |
| bulk.domain | bulk_extractor | 264 | blake2b:c8b97b94... |
6 findings |
| bulk.duplicates | bulk_extractor | 9 | blake2b:9ba9de0c... |
— |
| bulk.email | bulk_extractor | 43 | blake2b:eb085c00... |
6 findings |
| bulk.rfc822 | bulk_extractor | 41 | blake2b:283d0ef9... |
3 findings |
| bulk.url | bulk_extractor | 288 | blake2b:d727c498... |
6 findings |
| bulk.url_services | bulk_extractor | 19 | blake2b:01e609ea... |
6 findings |
| hashdeep.hashes | hashdeep | 6 | blake2b:c270e797... |
— |
| exiftool.metadata | exiftool | 9 | blake2b:154e6ac2... |
— |
| tsk.masquerade | sleuthkit | 0 | blake2b:empty... |
4 findings |
| tsk.masquerade | sleuthkit | 3 | blake2b:42bb5e7d... |
4 findings |
| bulk.bulk_extractor | bulk_extractor | 1 | blake2b:d8c5b229... |
— |
| bulk.domain | bulk_extractor | 366963 | blake2b:a9b12e0b... |
6 findings |
| bulk.duplicates | bulk_extractor | 12 | blake2b:f8b9f6c0... |
— |
| bulk.email | bulk_extractor | 6851 | blake2b:495ab267... |
6 findings |
| bulk.ether | bulk_extractor | 6 | blake2b:0825117f... |
— |
| bulk.exif | bulk_extractor | 793 | blake2b:2158d20a... |
— |
| bulk.rfc822 | bulk_extractor | 7326 | blake2b:d7e448fc... |
3 findings |
| bulk.url | bulk_extractor | 421750 | blake2b:514ec196... |
6 findings |
| bulk.url_facebook-address | bulk_extractor | 19 | blake2b:7fe55073... |
6 findings |
| bulk.url_searches | bulk_extractor | 155 | blake2b:b928562c... |
6 findings |
| bulk.url_services | bulk_extractor | 3637 | blake2b:c01e89c3... |
6 findings |
| bulk.wordlist | bulk_extractor | 12892267 | blake2b:842c543b... |
— |
| bulk.wordlist_dedup_1 | bulk_extractor | 10051216 | blake2b:6e833a85... |
— |
| ez.mft | eztools | 98918 | blake2b:38f6f1ca... |
4 findings |
| ez.shimcache | eztools | 307 | blake2b:9282f4f7... |
4 findings |
| registry.default | regripper | 418 | blake2b:c385c021... |
— |
| registry.system | regripper | 186 | blake2b:f8791c8b... |
2 findings |
| evtx.manifest | evtx-extract | 54 | blake2b:62bd3681... |
— |
| registry.system | regripper | 7 | blake2b:e4c6f012... |
2 findings |
| registry.system | regripper | 7 | blake2b:e4c6f012... |
2 findings |
| registry.security | regripper | 69 | blake2b:6b7bf22c... |
— |
| registry.security | regripper | 8 | blake2b:3c5e87f4... |
— |
| registry.software | regripper | 33492 | blake2b:d9cbadb2... |
1 finding |
| registry.software | regripper | 283 | blake2b:b35cb208... |
1 finding |
| registry.software | regripper | 283 | blake2b:86dee92d... |
1 finding |
| registry.system | regripper | 5209 | blake2b:56ed4b8f... |
2 findings |
| registry.system | regripper | 199 | blake2b:cfa4a817... |
2 findings |
| registry.system | regripper | 199 | blake2b:64bb7fd9... |
2 findings |
| hayabusa.alerts | hayabusa | 35 | blake2b:b10f2bdc... |
3 findings |
| registry.system | regripper | 381 | blake2b:070a4d56... |
2 findings |
| registry.system | regripper | 255 | blake2b:0d77cf74... |
2 findings |
| registry.system | regripper | 255 | blake2b:0d77cf74... |
2 findings |
| registry.usrclass.admin11 | regripper | 11 | blake2b:26a43778... |
— |
| registry.ntuser.admin11 | regripper | 133 | blake2b:bf617a09... |
— |
| registry.ntuser.default | regripper | 74 | blake2b:8518dc3f... |
— |
| registry.usrclass.informant | regripper | 102 | blake2b:9f1344c3... |
4 findings |
| registry.ntuser.informant | regripper | 306 | blake2b:597d71cd... |
6 findings |
| registry.usrclass.temporary | regripper | 15 | blake2b:3ef5eb22... |
— |
| registry.ntuser.temporary | regripper | 118 | blake2b:800424ee... |
— |
| optical.listing | mulder-optical | 58 | blake2b:65ca19c0... |
4 findings |
| hashdeep.hashes | hashdeep | 6 | blake2b:28ba0ef4... |
— |
| bulk.bulk_extractor | bulk_extractor | 1 | blake2b:9080f50b... |
— |
| bulk.domain | bulk_extractor | 237 | blake2b:29444e46... |
6 findings |
| bulk.email | bulk_extractor | 12 | blake2b:26c081a6... |
6 findings |
| bulk.exif | bulk_extractor | 21 | blake2b:c2dd544d... |
— |
| bulk.rfc822 | bulk_extractor | 41 | blake2b:e3da4d10... |
3 findings |
| bulk.url | bulk_extractor | 300 | blake2b:28d82359... |
6 findings |
| bulk.url_services | bulk_extractor | 21 | blake2b:6224c8f2... |
6 findings |
| bulk.wordlist | bulk_extractor | 260533 | blake2b:227c14b0... |
— |
| bulk.wordlist_dedup_1 | bulk_extractor | 166668 | blake2b:f4f06c1b... |
— |
| composite.execution | composite | 122 | blake2b:3eb764d8... |
— |
| composite.timeline | composite | 172 | blake2b:0b3e04d6... |
— |
| composite.correlation | composite | 1 | blake2b:55f8a248... |
— |
| composite.lateral_movement | composite | 513 | blake2b:4cf5d92f... |
— |
| composite.persistence | composite | 2471 | blake2b:14db3ff4... |
1 finding |
| composite.exfil | composite | 2432 | blake2b:2b5fdbda... |
— |
| composite.defense_evasion | composite | 230 | blake2b:c4607e26... |
— |
| composite.correlation | composite | 1 | blake2b:3c57f51d... |
— |
| composite.lateral_movement | composite | 544 | blake2b:19785f2a... |
— |
| composite.exfil | composite | 2438 | blake2b:4672475e... |
— |
| composite.defense_evasion | composite | 240 | blake2b:825b24ed... |
— |
| composite.persistence | composite | 2471 | blake2b:0bd6a1a1... |
1 finding |
| composite.timeline | composite | 172 | blake2b:0b3e04d6... |
— |
| composite.execution | composite | 122 | blake2b:3eb764d8... |
— |
| composite.correlation | composite | 1 | blake2b:4639f14d... |
— |
| composite.correlation | composite | 1 | blake2b:e0df3210... |
— |
| composite.correlation | composite | 1 | blake2b:d316bd44... |
— |
| composite.correlation | composite | 1 | blake2b:658e498d... |
— |
Investigation Performance
| Input Tokens | 8,659,437 |
| Output Tokens | 145,423 |
| Total Tokens | 8,804,860 |
| Per-Model Breakdown | |
| bedrock/zai.glm-5 | 8,804,860 |
Audit Trail
| ID | Tool | Duration | Timestamp | Actions |
|---|---|---|---|---|
| tc_2c7bcd29 | scan_evidence | 2163ms | 2026-09-20T04:38:36 | |
| tc_db79d98b | list_sources | 2ms | 2026-09-20T04:38:40 | |
| tc_fb688619 | get_source_stats | 2ms | 2026-09-20T04:38:40 | |
| tc_cbcd6f0e | open_case | 29ms | 2026-09-20T04:39:00 | |
| tc_da61b5e6 | open_case | 31ms | 2026-09-20T04:39:01 | |
| tc_5be16a64 | open_case | 30ms | 2026-09-20T04:39:01 | |
| tc_1e1cfeb5 | list_directory | 3ms | 2026-09-20T04:39:09 | |
| tc_465fa9a9 | list_cases | 5ms | 2026-09-20T04:39:13 | |
| tc_6d77a450 | open_case | 31ms | 2026-09-20T04:39:25 | |
| tc_e3595874 | start_extraction_batch | 9ms | 2026-09-20T04:39:27 | |
| tc_1c007237 | run_mmls | 63ms | 2026-09-20T04:39:27 | |
| tc_3357aac8 | open_case | 38ms | 2026-09-20T04:39:37 | |
| tc_e0bbe280 | run_fls | 10439ms | 2026-09-20T04:39:37 | |
| tc_5f01d53d | start_extraction_batch | 14ms | 2026-09-20T04:39:43 | |
| tc_7276dcc8 | run_mmls | 51ms | 2026-09-20T04:39:43 | |
| tc_ae18c184 | run_fls | 4880ms | 2026-09-20T04:39:48 | |
| tc_8eb1d0f8 | open_case | 81ms | 2026-09-20T04:39:52 | |
| tc_d1f39982 | start_extraction_batch | 30ms | 2026-09-20T04:39:55 | |
| tc_5e81ecbd | run_mmls | 115ms | 2026-09-20T04:39:56 | |
| tc_2c52f49d | run_fls | 2086ms | 2026-09-20T04:39:58 | |
| tc_563c8f1d | detect_masquerading | 3895ms | 2026-09-20T04:39:59 | |
| tc_333e22df | run_bulk_extractor | 89795ms | 2026-09-20T04:41:13 | |
| tc_d6c2d692 | run_bulk_extractor | 92347ms | 2026-09-20T04:41:28 | |
| tc_5eb1f6fe | get_completed_results | 0ms | 2026-09-20T04:41:30 | |
| tc_c2d350d0 | start_extraction_batch | 16ms | 2026-09-20T04:41:37 | |
| tc_c2fd1aa4 | start_extraction_batch | 6ms | 2026-09-20T04:41:55 | |
| tc_d6c64831 | run_hashdeep | 2154ms | 2026-09-20T04:41:58 | |
| tc_32e66cbe | analyze_pdf | 0ms | 2026-09-20T04:41:59 | |
| tc_90f14eff | start_extraction_batch | 7ms | 2026-09-20T04:41:59 | |
| tc_cf364c1e | analyze_office_document | 0ms | 2026-09-20T04:42:14 | |
| tc_37d19e79 | detect_steganography | 0ms | 2026-09-20T04:42:15 | |
| tc_c6f433e8 | run_exiftool | 116ms | 2026-09-20T04:42:16 | |
| tc_f19ff4bb | run_evtx_parser | 0ms | 2026-09-20T04:42:20 | |
| tc_135e3862 | run_registry_parser | 6768ms | 2026-09-20T04:42:24 | |
| tc_93a8cf65 | wait_all | 20001ms | 2026-09-20T04:42:25 | |
| tc_9da47439 | get_completed_results | 0ms | 2026-09-20T04:42:34 | |
| tc_41a23aae | get_completed_results | 0ms | 2026-09-20T04:42:38 | |
| tc_0d30ca0b | get_completed_results | 0ms | 2026-09-20T04:42:40 | |
| tc_e0df9f1d | open_case | 87ms | 2026-09-20T04:42:52 | |
| tc_7f266622 | wait_all | 0ms | 2026-09-20T04:42:52 | |
| tc_969e47a8 | open_case | 92ms | 2026-09-20T04:43:00 | |
| tc_8dd86a37 | list_sources | 3ms | 2026-09-20T04:43:02 | |
| tc_0aca1b17 | get_raw_output | 6ms | 2026-09-20T04:43:49 | |
| tc_9d680dfd | list_partitions | 2ms | 2026-09-20T04:43:51 | |
| tc_40ef6bf1 | detect_masquerading | 4241ms | 2026-09-20T04:43:53 | |
| tc_dd610914 | get_raw_output | 5ms | 2026-09-20T04:43:54 | |
| tc_4b43855b | get_raw_output | 7ms | 2026-09-20T04:44:00 | |
| tc_1b99dc55 | get_raw_output | 5ms | 2026-09-20T04:44:09 | |
| tc_fe1af012 | get_completed_results | 0ms | 2026-09-20T04:44:11 | |
| tc_787773ae | search | 7ms | 2026-09-20T04:44:13 | |
| tc_5bdac589 | get_raw_output | 5ms | 2026-09-20T04:44:21 | |
| tc_5bc6c48e | detect_masquerading | 300063ms | 2026-09-20T04:44:27 | |
| tc_146b0abc | get_raw_output | 5ms | 2026-09-20T04:44:29 | |
| tc_cc8626cf | start_extraction_batch | 9ms | 2026-09-20T04:44:32 | |
| tc_419593e3 | run_mft_parser | 37ms | 2026-09-20T04:44:32 | |
| tc_55d580ad | run_amcache_parser | 1680ms | 2026-09-20T04:44:34 | |
| tc_ef1a75a4 | analyze_disk_pcaps | 2600ms | 2026-09-20T04:44:35 | |
| tc_dc827e98 | list_files | 168ms | 2026-09-20T04:44:39 | |
| tc_782da4f5 | run_shimcache_parser | 3897ms | 2026-09-20T04:44:41 | |
| tc_16196f8c | run_registry_parser | 4142ms | 2026-09-20T04:44:41 | |
| tc_4dc5e837 | run_prefetch_parser | 6045ms | 2026-09-20T04:44:43 | |
| tc_672f3e39 | search | 3ms | 2026-09-20T04:44:48 | |
| tc_4f2f9a52 | get_completed_results | 0ms | 2026-09-20T04:44:49 | |
| tc_84b2b344 | search | 3ms | 2026-09-20T04:44:54 | |
| tc_19d674e6 | get_raw_output | 2ms | 2026-09-20T04:45:08 | |
| tc_d43cc0fc | start_extraction_batch | 3ms | 2026-09-20T04:45:11 | |
| tc_123bea1f | query_registry_value | 0ms | 2026-09-20T04:45:15 | |
| tc_82e93b1b | get_raw_output | 6ms | 2026-09-20T04:45:17 | |
| tc_cc987ab2 | query_registry_value | 0ms | 2026-09-20T04:45:17 | |
| tc_e53b0d46 | query_registry_value | 0ms | 2026-09-20T04:45:19 | |
| tc_6f5ebdd5 | query_registry_value | 0ms | 2026-09-20T04:45:20 | |
| tc_ae73bcd5 | run_evtx_parser | 0ms | 2026-09-20T04:45:21 | |
| tc_3883f686 | run_hayabusa | 9398ms | 2026-09-20T04:45:21 | |
| tc_6ae7b75e | get_raw_output | 9ms | 2026-09-20T04:45:26 | |
| tc_66b55ef1 | get_completed_results | 0ms | 2026-09-20T04:45:37 | |
| tc_5ebfd6b0 | search | 3ms | 2026-09-20T04:45:48 | |
| tc_27e39dcf | open_case | 29ms | 2026-09-20T04:46:11 | |
| tc_3cf82a76 | submit_finding | 941ms | 2026-09-20T04:46:16 | |
| tc_3ffe405c | get_investigation_summary | 5ms | 2026-09-20T04:46:16 | |
| tc_45f58e4b | list_sources | 1ms | 2026-09-20T04:46:16 | |
| tc_10da9241 | get_raw_output | 24ms | 2026-09-20T04:46:39 | |
| tc_eabf83f4 | run_bulk_extractor | 431791ms | 2026-09-20T04:46:39 | |
| tc_3ebb6a0f | get_completed_results | 0ms | 2026-09-20T04:46:40 | |
| tc_c88f4f80 | list_files | 144ms | 2026-09-20T04:46:45 | |
| tc_f1ffe2e1 | get_raw_output | 22ms | 2026-09-20T04:46:45 | |
| tc_846d1388 | search | 5ms | 2026-09-20T04:46:49 | |
| tc_621caa1c | search | 5ms | 2026-09-20T04:46:49 | |
| tc_a09ca883 | search | 4ms | 2026-09-20T04:46:49 | |
| tc_1eb089b5 | update_finding | 10ms | 2026-09-20T04:46:49 | |
| tc_9b7b324a | search | 4ms | 2026-09-20T04:46:49 | |
| tc_657fc1f6 | get_raw_output | 64ms | 2026-09-20T04:47:07 | |
| tc_775fb911 | get_raw_output | 64ms | 2026-09-20T04:47:07 | |
| tc_5e23b28f | get_investigation_summary | 4ms | 2026-09-20T04:47:15 | |
| tc_aeb46a71 | submit_finding | 9ms | 2026-09-20T04:47:17 | |
| tc_b7a8dd29 | open_case | 31ms | 2026-09-20T04:47:21 | |
| tc_4a2084af | list_sources | 2ms | 2026-09-20T04:47:25 | |
| tc_c976f2d7 | start_extraction_batch | 200ms | 2026-09-20T04:47:28 | |
| tc_ab124952 | run_chainsaw | 2353ms | 2026-09-20T04:47:30 | |
| tc_e545b08c | run_amcache_parser | 0ms | 2026-09-20T04:47:32 | |
| tc_751f3f5f | start_extraction_batch | 3ms | 2026-09-20T04:47:34 | |
| tc_a2f14775 | run_mft_parser | 6888ms | 2026-09-20T04:47:34 | |
| tc_3cefcf8a | list_directory | 2ms | 2026-09-20T04:47:34 | |
| tc_4a97fb10 | submit_finding | 7ms | 2026-09-20T04:47:35 | |
| tc_4bd058d3 | run_shimcache_parser | 11435ms | 2026-09-20T04:47:39 | |
| tc_39893313 | run_evtx_parser | 7842ms | 2026-09-20T04:47:41 | |
| tc_5355cc90 | run_prefetch_parser | 16219ms | 2026-09-20T04:47:44 | |
| tc_fb64912b | run_hayabusa | 24025ms | 2026-09-20T04:47:51 | |
| tc_097d3e43 | yara_scan_files | 26377ms | 2026-09-20T04:47:54 | |
| tc_f68ea821 | run_registry_parser | 37477ms | 2026-09-20T04:48:05 | |
| tc_8b29c707 | wait_all | 30001ms | 2026-09-20T04:48:05 | |
| tc_2b10cbd8 | open_case | 30ms | 2026-09-20T04:48:09 | |
| tc_6cb7b05a | get_raw_output | 80ms | 2026-09-20T04:48:10 | |
| tc_0ef2a639 | start_extraction_batch | 7ms | 2026-09-20T04:48:30 | |
| tc_49b764ba | run_optical_listing | 78ms | 2026-09-20T04:48:30 | |
| tc_b4016ae3 | run_hashdeep | 522ms | 2026-09-20T04:48:31 | |
| tc_29860d74 | run_bulk_extractor | 7526ms | 2026-09-20T04:48:38 | |
| tc_5846b7d5 | get_completed_results | 0ms | 2026-09-20T04:48:42 | |
| tc_7f615481 | get_completed_results | 0ms | 2026-09-20T04:48:46 | |
| tc_efc25f5d | get_completed_results | 0ms | 2026-09-20T04:48:46 | |
| tc_2597f988 | submit_finding | 9ms | 2026-09-20T04:48:48 | |
| tc_858f30e9 | get_raw_output | 84ms | 2026-09-20T04:48:53 | |
| tc_5c2a6439 | open_case | 30ms | 2026-09-20T04:48:58 | |
| tc_fd9b418a | start_extraction_batch | 1ms | 2026-09-20T04:49:06 | |
| tc_92fde33a | search | 3ms | 2026-09-20T04:49:06 | |
| tc_c4c47b3e | get_investigation_summary | 5ms | 2026-09-20T04:49:06 | |
| tc_a2e3579c | list_sources | 1ms | 2026-09-20T04:49:06 | |
| tc_3f887295 | get_raw_output | 84ms | 2026-09-20T04:49:09 | |
| tc_0e2d676a | get_raw_output | 81ms | 2026-09-20T04:49:09 | |
| tc_3be7a838 | get_completed_results | 0ms | 2026-09-20T04:49:23 | |
| tc_57f2c315 | submit_finding | 10ms | 2026-09-20T04:49:25 | |
| tc_c8f437a9 | search | 4ms | 2026-09-20T04:49:27 | |
| tc_7378bd4b | get_raw_output | 24ms | 2026-09-20T04:49:27 | |
| tc_0538d8ab | get_raw_output | 23ms | 2026-09-20T04:49:27 | |
| tc_ccd2b70e | search | 4ms | 2026-09-20T04:49:30 | |
| tc_b5e35fb5 | search | 84ms | 2026-09-20T04:49:30 | |
| tc_8cb37f97 | get_raw_output | 18ms | 2026-09-20T04:49:33 | |
| tc_ca045926 | get_raw_output | 24ms | 2026-09-20T04:49:33 | |
| tc_faa187d6 | open_case | 30ms | 2026-09-20T04:49:37 | |
| tc_3bbea277 | wait_all | 0ms | 2026-09-20T04:49:38 | |
| tc_16696cbc | get_findings | 1ms | 2026-09-20T04:49:38 | |
| tc_ef225c15 | search | 10ms | 2026-09-20T04:49:38 | |
| tc_9e97ea67 | open_case | 31ms | 2026-09-20T04:49:52 | |
| tc_9ebe29f0 | get_investigation_summary | 5ms | 2026-09-20T04:49:54 | |
| tc_c637efa1 | list_sources | 2ms | 2026-09-20T04:49:54 | |
| tc_4a7b2a3a | get_findings | 1ms | 2026-09-20T04:49:57 | |
| tc_f7f6fb14 | search | 6ms | 2026-09-20T04:49:58 | |
| tc_6f6c6ca3 | get_raw_output | 81ms | 2026-09-20T04:49:58 | |
| tc_6563735c | search | 4ms | 2026-09-20T04:49:59 | |
| tc_a0deef7e | search | 33ms | 2026-09-20T04:49:59 | |
| tc_ec773598 | submit_finding | 11ms | 2026-09-20T04:50:07 | |
| tc_736de282 | search | 8ms | 2026-09-20T04:50:19 | |
| tc_b075f148 | get_raw_output | 81ms | 2026-09-20T04:50:20 | |
| tc_6fe6c924 | search | 4ms | 2026-09-20T04:50:20 | |
| tc_5b346b98 | get_raw_output | 81ms | 2026-09-20T04:50:20 | |
| tc_ad34036d | get_raw_output | 23ms | 2026-09-20T04:50:26 | |
| tc_4a7dc1e9 | submit_finding | 11ms | 2026-09-20T04:50:33 | |
| tc_025b4556 | search | 4ms | 2026-09-20T04:50:36 | |
| tc_d9132847 | search | 5ms | 2026-09-20T04:50:36 | |
| tc_b2cc3823 | search | 6ms | 2026-09-20T04:50:42 | |
| tc_5f5eae41 | get_raw_output | 80ms | 2026-09-20T04:50:42 | |
| tc_604e9672 | search | 9ms | 2026-09-20T04:50:42 | |
| tc_a72dd9f8 | submit_finding | 14ms | 2026-09-20T04:51:04 | |
| tc_a22e2615 | get_raw_output | 16ms | 2026-09-20T04:51:04 | |
| tc_d15b6140 | get_raw_output | 14ms | 2026-09-20T04:51:05 | |
| tc_b5893178 | get_raw_output | 15ms | 2026-09-20T04:51:05 | |
| tc_c9690128 | search | 9ms | 2026-09-20T04:51:07 | |
| tc_34fbda4a | parse_mft | 37ms | 2026-09-20T04:51:08 | |
| tc_f2da5373 | get_timeline | 17ms | 2026-09-20T04:51:09 | |
| tc_5e6d6001 | search | 4ms | 2026-09-20T04:51:19 | |
| tc_dc6dc72d | get_investigation_summary | 4ms | 2026-09-20T04:51:21 | |
| tc_42ba6838 | list_partitions | 2ms | 2026-09-20T04:51:35 | |
| tc_943cdfdc | search | 4ms | 2026-09-20T04:51:35 | |
| tc_3e4497e3 | submit_finding | 12ms | 2026-09-20T04:51:36 | |
| tc_982e1d6d | get_raw_output | 81ms | 2026-09-20T04:51:36 | |
| tc_f2e3d616 | submit_finding | 11ms | 2026-09-20T04:51:50 | |
| tc_c3733ab2 | track_progress | 9ms | 2026-09-20T04:51:56 | |
| tc_fc55b702 | update_finding | 9ms | 2026-09-20T04:52:02 | |
| tc_615d0c5f | submit_finding | 9ms | 2026-09-20T04:52:17 | |
| tc_03483b84 | get_raw_output | 23ms | 2026-09-20T04:52:18 | |
| tc_3e065cc1 | submit_finding | 12ms | 2026-09-20T04:52:34 | |
| tc_89209757 | get_investigation_summary | 4ms | 2026-09-20T04:52:34 | |
| tc_9d9af2b2 | search | 4ms | 2026-09-20T04:52:42 | |
| tc_c993e14e | search | 3ms | 2026-09-20T04:52:42 | |
| tc_83e2ea83 | submit_finding | 11ms | 2026-09-20T04:52:46 | |
| tc_0f924fe3 | submit_finding | 11ms | 2026-09-20T04:52:57 | |
| tc_cfbd6cb9 | submit_finding | 12ms | 2026-09-20T04:53:13 | |
| tc_eb6e1fe3 | search | 5ms | 2026-09-20T04:53:16 | |
| tc_fab161c9 | track_progress | 9ms | 2026-09-20T04:53:42 | |
| tc_a3b69ed6 | get_findings | 2ms | 2026-09-20T04:53:42 | |
| tc_7c6812b6 | submit_finding | 11ms | 2026-09-20T04:53:54 | |
| tc_018f9c6e | track_progress | 8ms | 2026-09-20T04:54:10 | |
| tc_5246b30e | get_investigation_summary | 4ms | 2026-09-20T04:54:18 | |
| tc_13f30da5 | get_findings | 1ms | 2026-09-20T04:54:21 | |
| tc_d9087652 | get_findings | 2ms | 2026-09-20T04:54:32 | |
| tc_d6f5506c | get_investigation_summary | 3ms | 2026-09-20T04:55:13 | |
| tc_8d477997 | get_investigation_summary | 4ms | 2026-09-20T04:55:58 | |
| tc_e775d846 | open_case | 32ms | 2026-09-20T04:56:02 | |
| tc_0cb42eb1 | get_findings | 3ms | 2026-09-20T04:56:04 | |
| tc_391af966 | get_investigation_summary | 4ms | 2026-09-20T04:56:05 | |
| tc_da9a3c4a | list_sources | 2ms | 2026-09-20T04:56:05 | |
| tc_dc32afe7 | get_source_stats | 80ms | 2026-09-20T04:56:05 | |
| tc_0cb72b11 | get_timeline | 23ms | 2026-09-20T04:56:24 | |
| tc_a1063c01 | get_bookmarks | 1ms | 2026-09-20T04:56:24 | |
| tc_b1917b25 | open_case | 32ms | 2026-09-20T04:57:23 | |
| tc_cd04c1c1 | get_process_tree | 13ms | 2026-09-20T04:57:28 | |
| tc_ff52c2c5 | find_execution_evidence._query(ez.shimcache) | 25ms | 2026-09-20T04:57:28 | |
| tc_e225f5d5 | find_execution_evidence | 27ms | 2026-09-20T04:57:28 | |
| tc_1ecb847e | reconstruct_execution_chains._query(volatility.pstree) | 23ms | 2026-09-20T04:57:28 | |
| tc_6606e2af | find_persistence_mechanisms._query(registry.system) | 44ms | 2026-09-20T04:57:28 | |
| tc_23e2fe9a | find_suspicious_processes._query(volatility.malfind) | 25ms | 2026-09-20T04:57:28 | |
| tc_442e600b | analyze_execution_timeline._query(ez.shimcache) | 24ms | 2026-09-20T04:57:28 | |
| tc_152204a2 | analyze_execution_timeline | 56ms | 2026-09-20T04:57:28 | |
| tc_803d7200 | reconstruct_execution_chains._query(volatility.cmdline) | 27ms | 2026-09-20T04:57:28 | |
| tc_8077b1ca | find_suspicious_processes._query(volatility.cmdline) | 23ms | 2026-09-20T04:57:28 | |
| tc_3ce8ab15 | find_persistence_mechanisms._query(registry.software) | 38ms | 2026-09-20T04:57:28 | |
| tc_5551f13c | reconstruct_execution_chains._query(volatility.netscan) | 25ms | 2026-09-20T04:57:28 | |
| tc_2900dd27 | find_suspicious_processes._query(volatility.netscan) | 22ms | 2026-09-20T04:57:28 | |
| tc_d5c446db | correlate_across_sources | 119ms | 2026-09-20T04:57:28 | |
| tc_c31daa1c | find_persistence_mechanisms._query(volatility.svcscan) | 17ms | 2026-09-20T04:57:28 | |
| tc_018778a0 | reconstruct_execution_chains._query(volatility.malfind) | 16ms | 2026-09-20T04:57:28 | |
| tc_72708bf3 | reconstruct_execution_chains | 100ms | 2026-09-20T04:57:28 | |
| tc_7c1bc7b1 | find_suspicious_processes._query(volatility.pstree) | 17ms | 2026-09-20T04:57:28 | |
| tc_550c151e | find_suspicious_processes | 98ms | 2026-09-20T04:57:28 | |
| tc_6df11f4c | find_persistence_mechanisms._search(all) | 42ms | 2026-09-20T04:57:28 | |
| tc_93fbbb2c | find_persistence_mechanisms._search(all) | 18ms | 2026-09-20T04:57:28 | |
| tc_4a181f79 | find_persistence_mechanisms._query(ez.shimcache) | 17ms | 2026-09-20T04:57:28 | |
| tc_c9ef4e8c | find_lateral_movement_indicators._search(all) | 179ms | 2026-09-20T04:57:28 | |
| tc_2cf62da0 | find_persistence_mechanisms._search(all) | 23ms | 2026-09-20T04:57:28 | |
| tc_9b7a298c | find_lateral_movement_indicators._search(all) | 22ms | 2026-09-20T04:57:28 | |
| tc_052b1430 | find_lateral_movement_indicators._search(all) | 12ms | 2026-09-20T04:57:28 | |
| tc_41d96d8a | find_lateral_movement_indicators._query(volatility.netscan) | 15ms | 2026-09-20T04:57:28 | |
| tc_8aee5119 | find_lateral_movement_indicators._search(all) | 11ms | 2026-09-20T04:57:28 | |
| tc_86b09965 | find_lateral_movement_indicators._search(all) | 8ms | 2026-09-20T04:57:28 | |
| tc_cb40a4a6 | find_lateral_movement_indicators._search(all) | 16ms | 2026-09-20T04:57:28 | |
| tc_1778e359 | find_lateral_movement_indicators | 304ms | 2026-09-20T04:57:28 | |
| tc_17cfd996 | find_persistence_mechanisms._query(tsk.filelist) | 94ms | 2026-09-20T04:57:28 | |
| tc_e584f7b1 | find_persistence_mechanisms | 347ms | 2026-09-20T04:57:28 | |
| tc_9a32f66c | find_data_exfiltration_indicators._query(bulk.url) | 547ms | 2026-09-20T04:57:29 | |
| tc_fdbf2801 | find_data_exfiltration_indicators._query(bulk.email) | 18ms | 2026-09-20T04:57:29 | |
| tc_e251870a | find_data_exfiltration_indicators._query(bulk.domain) | 155ms | 2026-09-20T04:57:30 | |
| tc_a9f50673 | find_data_exfiltration_indicators._search(all) | 26ms | 2026-09-20T04:57:30 | |
| tc_3c246e43 | find_data_exfiltration_indicators | 1735ms | 2026-09-20T04:57:30 | |
| tc_2e26caae | find_defense_evasion._search(all) | 14ms | 2026-09-20T04:57:33 | |
| tc_3bd003d0 | find_defense_evasion._search(ez.mft) | 25ms | 2026-09-20T04:57:33 | |
| tc_55bb2ecd | find_defense_evasion._search(all) | 9ms | 2026-09-20T04:57:33 | |
| tc_75f8f542 | find_defense_evasion._search(all) | 21ms | 2026-09-20T04:57:33 | |
| tc_135a2541 | find_defense_evasion._search(all) | 12ms | 2026-09-20T04:57:33 | |
| tc_036bf66e | find_defense_evasion | 96ms | 2026-09-20T04:57:33 | |
| tc_9a4d495a | correlate_across_sources | 40ms | 2026-09-20T04:58:53 | |
| tc_08a3e822 | find_lateral_movement_indicators._search(all) | 108ms | 2026-09-20T04:58:53 | |
| tc_09df0edf | find_lateral_movement_indicators._search(all) | 12ms | 2026-09-20T04:58:53 | |
| tc_159d4ddb | find_lateral_movement_indicators._search(all) | 11ms | 2026-09-20T04:58:53 | |
| tc_4cad8dcc | find_lateral_movement_indicators._query(volatility.netscan) | 15ms | 2026-09-20T04:58:53 | |
| tc_2353b67a | find_lateral_movement_indicators._search(all) | 10ms | 2026-09-20T04:58:53 | |
| tc_3eaf4e48 | find_lateral_movement_indicators._search(all) | 8ms | 2026-09-20T04:58:53 | |
| tc_81082a2a | find_lateral_movement_indicators._search(all) | 14ms | 2026-09-20T04:58:53 | |
| tc_1cf67bb6 | find_lateral_movement_indicators | 199ms | 2026-09-20T04:58:53 | |
| tc_f1276683 | find_data_exfiltration_indicators._query(bulk.url) | 425ms | 2026-09-20T04:58:54 | |
| tc_0088d91e | find_data_exfiltration_indicators._query(bulk.email) | 19ms | 2026-09-20T04:58:55 | |
| tc_dcb2c9b3 | find_data_exfiltration_indicators._query(bulk.domain) | 96ms | 2026-09-20T04:58:55 | |
| tc_94d3ef34 | find_data_exfiltration_indicators._search(all) | 26ms | 2026-09-20T04:58:55 | |
| tc_03492ef7 | find_data_exfiltration_indicators | 1555ms | 2026-09-20T04:58:55 | |
| tc_de1498a6 | find_defense_evasion._search(all) | 14ms | 2026-09-20T04:58:55 | |
| tc_fead979b | find_defense_evasion._search(ez.mft) | 24ms | 2026-09-20T04:58:55 | |
| tc_69f998b9 | find_defense_evasion._search(all) | 9ms | 2026-09-20T04:58:55 | |
| tc_407af625 | find_defense_evasion._search(all) | 22ms | 2026-09-20T04:58:55 | |
| tc_e644385d | find_defense_evasion._search(all) | 12ms | 2026-09-20T04:58:55 | |
| tc_dacfbb26 | find_defense_evasion | 95ms | 2026-09-20T04:58:55 | |
| tc_6ef6c3c0 | find_persistence_mechanisms._query(registry.system) | 17ms | 2026-09-20T04:58:55 | |
| tc_e4fe6d3f | find_persistence_mechanisms._query(registry.software) | 21ms | 2026-09-20T04:58:55 | |
| tc_89f8a192 | find_persistence_mechanisms._query(volatility.svcscan) | 15ms | 2026-09-20T04:58:55 | |
| tc_c9d3007b | find_persistence_mechanisms._search(all) | 18ms | 2026-09-20T04:58:55 | |
| tc_1a2acd64 | find_persistence_mechanisms._search(all) | 8ms | 2026-09-20T04:58:55 | |
| tc_ad7cf987 | find_persistence_mechanisms._query(ez.shimcache) | 15ms | 2026-09-20T04:58:55 | |
| tc_c6826976 | find_persistence_mechanisms._search(all) | 11ms | 2026-09-20T04:58:55 | |
| tc_6a016327 | find_persistence_mechanisms._query(tsk.filelist) | 47ms | 2026-09-20T04:58:56 | |
| tc_6f445194 | find_persistence_mechanisms | 211ms | 2026-09-20T04:58:56 | |
| tc_a9e2d6a6 | analyze_execution_timeline._query(ez.shimcache) | 16ms | 2026-09-20T04:59:05 | |
| tc_fdb577a5 | analyze_execution_timeline | 21ms | 2026-09-20T04:59:05 | |
| tc_28d810ea | get_process_tree | 1ms | 2026-09-20T04:59:05 | |
| tc_d069b86f | find_execution_evidence._query(ez.shimcache) | 15ms | 2026-09-20T04:59:06 | |
| tc_e455607b | find_execution_evidence | 22ms | 2026-09-20T04:59:06 | |
| tc_789ddc3f | reconstruct_execution_chains._query(volatility.pstree) | 17ms | 2026-09-20T04:59:06 | |
| tc_39ab0558 | reconstruct_execution_chains._query(volatility.cmdline) | 16ms | 2026-09-20T04:59:06 | |
| tc_114f7cf1 | reconstruct_execution_chains._query(volatility.netscan) | 16ms | 2026-09-20T04:59:06 | |
| tc_9b5bdf79 | reconstruct_execution_chains._query(volatility.malfind) | 16ms | 2026-09-20T04:59:06 | |
| tc_a8848cab | reconstruct_execution_chains | 80ms | 2026-09-20T04:59:06 | |
| tc_05f82ef3 | find_suspicious_processes._query(volatility.malfind) | 16ms | 2026-09-20T04:59:06 | |
| tc_cc4d17a1 | find_suspicious_processes._query(volatility.cmdline) | 16ms | 2026-09-20T04:59:06 | |
| tc_3a010085 | find_suspicious_processes._query(volatility.netscan) | 16ms | 2026-09-20T04:59:06 | |
| tc_deeb4bdc | find_suspicious_processes._query(volatility.pstree) | 16ms | 2026-09-20T04:59:06 | |
| tc_0618cb47 | find_suspicious_processes | 80ms | 2026-09-20T04:59:06 | |
| tc_aabea266 | correlate_across_sources | 116ms | 2026-09-20T04:59:21 | |
| tc_10cb9045 | open_case | 31ms | 2026-09-20T04:59:59 | |
| tc_6467e78d | get_investigation_summary | 5ms | 2026-09-20T05:00:00 | |
| tc_b7d8e1c4 | get_findings | 1ms | 2026-09-20T05:00:22 | |
| tc_ef84f8ce | search | 6ms | 2026-09-20T05:00:36 | |
| tc_4b2e8c62 | search | 5ms | 2026-09-20T05:00:37 | |
| tc_0152539b | search | 3ms | 2026-09-20T05:00:37 | |
| tc_7306d9f2 | get_raw_output | 16ms | 2026-09-20T05:00:46 | |
| tc_11d05674 | get_raw_output | 82ms | 2026-09-20T05:00:46 | |
| tc_0f2b1946 | get_raw_output | 15ms | 2026-09-20T05:00:46 | |
| tc_94d54a5c | search | 4ms | 2026-09-20T05:01:03 | |
| tc_79036de8 | search | 3ms | 2026-09-20T05:01:04 | |
| tc_03d2afc6 | search | 4ms | 2026-09-20T05:01:04 | |
| tc_ff01dbc4 | search | 3ms | 2026-09-20T05:01:13 | |
| tc_7c6e783a | search | 26ms | 2026-09-20T05:01:13 | |
| tc_75264fd1 | search | 5ms | 2026-09-20T05:01:13 | |
| tc_a71af33a | get_raw_output | 81ms | 2026-09-20T05:01:25 | |
| tc_4678f7d0 | get_raw_output | 81ms | 2026-09-20T05:01:25 | |
| tc_5402f1f5 | search | 5ms | 2026-09-20T05:01:25 | |
| tc_6862bf0e | search | 50ms | 2026-09-20T05:01:45 | |
| tc_bfaf0b41 | lookup_attack_technique | 584ms | 2026-09-20T05:01:45 | |
| tc_d72d18b4 | search | 3ms | 2026-09-20T05:01:45 | |
| tc_a3b4b0be | submit_finding | 18ms | 2026-09-20T05:03:03 | |
| tc_06b28829 | submit_finding | 20ms | 2026-09-20T05:03:08 | |
| tc_1444a697 | submit_finding | 19ms | 2026-09-20T05:03:13 | |
| tc_cb048504 | search | 3ms | 2026-09-20T05:03:29 | |
| tc_2bd3fd09 | get_raw_output | 81ms | 2026-09-20T05:03:30 | |
| tc_8c7bfa14 | search | 3ms | 2026-09-20T05:03:30 | |
| tc_41a87d3a | get_raw_output | 15ms | 2026-09-20T05:03:49 | |
| tc_20e9d8f3 | search | 3ms | 2026-09-20T05:03:50 | |
| tc_3d7a9b94 | get_ioc_summary | 655ms | 2026-09-20T05:03:51 | |
| tc_368c5818 | submit_finding | 19ms | 2026-09-20T05:04:34 | |
| tc_a8dcbdf6 | submit_finding | 19ms | 2026-09-20T05:04:47 | |
| tc_55926234 | get_findings | 1ms | 2026-09-20T05:05:11 | |
| tc_ea1ba613 | track_progress | 17ms | 2026-09-20T05:05:42 | |
| tc_baf7ff2f | get_investigation_summary | 4ms | 2026-09-20T05:06:36 | |
| tc_c0421613 | open_case | 33ms | 2026-09-20T05:06:39 | |
| tc_0ea652f8 | get_findings | 3ms | 2026-09-20T05:06:41 | |
| tc_2ba64b85 | get_investigation_summary | 4ms | 2026-09-20T05:06:41 | |
| tc_7f3a153e | list_sources | 2ms | 2026-09-20T05:06:41 | |
| tc_d19d2dae | get_timeline | 2ms | 2026-09-20T05:06:41 | |
| tc_4a62822b | get_findings | 2ms | 2026-09-20T05:06:45 | |
| tc_8556a9da | get_findings | 1ms | 2026-09-20T05:07:03 | |
| tc_d165e96c | open_case | 32ms | 2026-09-20T05:09:18 | |
| tc_8c17eb3b | get_timeline | 23ms | 2026-09-20T05:09:56 | |
| tc_5791e3d4 | search | 15ms | 2026-09-20T05:10:34 | |
| tc_5f452b32 | search | 32ms | 2026-09-20T05:10:34 | |
| tc_0c2b059a | search | 36ms | 2026-09-20T05:10:34 | |
| tc_9cdba5d1 | search | 39ms | 2026-09-20T05:10:34 | |
| tc_1cf846f4 | search | 33ms | 2026-09-20T05:10:34 | |
| tc_131e5677 | search | 36ms | 2026-09-20T05:10:34 | |
| tc_19090bf8 | search | 38ms | 2026-09-20T05:10:34 | |
| tc_659b8978 | search | 29ms | 2026-09-20T05:10:34 | |
| tc_293e21cf | search | 12ms | 2026-09-20T05:10:34 | |
| tc_edc53dd9 | search | 23ms | 2026-09-20T05:10:34 | |
| tc_0a54632b | search | 21ms | 2026-09-20T05:10:34 | |
| tc_31a8c08c | search | 19ms | 2026-09-20T05:10:34 | |
| tc_da31c677 | search | 17ms | 2026-09-20T05:10:34 | |
| tc_ba59319f | search | 21ms | 2026-09-20T05:10:34 | |
| tc_08b7f2fc | search | 18ms | 2026-09-20T05:10:34 | |
| tc_b31b5e67 | search | 18ms | 2026-09-20T05:10:34 | |
| tc_f5538ad8 | search | 17ms | 2026-09-20T05:10:34 | |
| tc_9ac980ea | search | 12ms | 2026-09-20T05:10:34 | |
| tc_8a6d477d | search | 19ms | 2026-09-20T05:10:34 | |
| tc_9c84fe08 | search | 11ms | 2026-09-20T05:10:34 | |
| tc_98144071 | search | 23ms | 2026-09-20T05:10:34 | |
| tc_5050405f | search | 18ms | 2026-09-20T05:10:34 | |
| tc_4fb3c00f | search | 20ms | 2026-09-20T05:10:34 | |
| tc_a1bc63d6 | search | 29ms | 2026-09-20T05:10:34 | |
| tc_f693a467 | search | 19ms | 2026-09-20T05:10:34 | |
| tc_788bcc5a | search | 11ms | 2026-09-20T05:10:34 | |
| tc_1a0c638b | search | 7ms | 2026-09-20T05:10:34 | |
| tc_dd34a6c3 | search | 5ms | 2026-09-20T05:10:34 | |
| tc_d47a90d2 | search | 9ms | 2026-09-20T05:10:34 | |
| tc_fb7a0bf8 | search | 4ms | 2026-09-20T05:10:34 | |
| tc_68eb7572 | search | 6ms | 2026-09-20T05:10:34 | |
| tc_70e9b640 | search | 10ms | 2026-09-20T05:10:34 | |
| tc_70f7022b | search | 11ms | 2026-09-20T05:10:34 | |
| tc_c08dfc6a | search | 10ms | 2026-09-20T05:10:34 | |
| tc_f6417dfb | search | 7ms | 2026-09-20T05:10:34 | |
| tc_8c7f4674 | search | 5ms | 2026-09-20T05:10:34 | |
| tc_97d44a43 | search | 5ms | 2026-09-20T05:10:34 | |
| tc_74f2ef98 | search | 5ms | 2026-09-20T05:10:34 | |
| tc_5b2c4b0e | search | 8ms | 2026-09-20T05:10:34 | |
| tc_c36812ee | search | 10ms | 2026-09-20T05:10:34 | |
| tc_a96ac001 | search | 9ms | 2026-09-20T05:10:34 | |
| tc_4ad1e518 | search | 8ms | 2026-09-20T05:10:34 | |
| tc_e2a69d66 | correlate_across_sources | 97ms | 2026-09-20T05:10:37 | |
| tc_0b482a45 | correlate_across_sources | 112ms | 2026-09-20T05:10:37 | |
| tc_17024c03 | search | 3ms | 2026-09-20T05:10:42 | |
| tc_73307b85 | list_cases | 6ms | 2026-09-20T05:10:47 | |
| tc_75f4b84c | open_case | 32ms | 2026-09-20T05:11:14 | |
| tc_bf439584 | get_findings | 2ms | 2026-09-20T05:11:16 | |
| tc_656077d6 | get_raw_output | 84ms | 2026-09-20T05:11:22 | |
| tc_bc908161 | search | 85ms | 2026-09-20T05:11:24 | |
| tc_a588306f | search | 6ms | 2026-09-20T05:11:27 | |
| tc_f53f63e0 | get_investigation_summary | 4ms | 2026-09-20T05:11:32 | |
| tc_70668a2f | get_findings | 2ms | 2026-09-20T05:11:37 | |
| tc_fb56b7b4 | get_investigation_summary | 4ms | 2026-09-20T05:11:55 | |
| tc_5d1cd372 | check_finalize_readiness | 4ms | 2026-09-20T05:11:55 | |
| tc_38129ada | open_case | 31ms | 2026-09-20T05:12:01 | |
| tc_014e8bd8 | get_findings | 2ms | 2026-09-20T05:12:01 | |
| tc_b73e817e | get_raw_output | 82ms | 2026-09-20T05:12:06 | |
| tc_88345cb9 | search | 5ms | 2026-09-20T05:12:09 | |
| tc_d7c0c394 | search | 3ms | 2026-09-20T05:12:10 | |
| tc_2c39b304 | search | 3ms | 2026-09-20T05:12:10 | |
| tc_477e95e8 | get_findings | 2ms | 2026-09-20T05:12:12 | |
| tc_3eddb848 | get_findings | 1ms | 2026-09-20T05:12:12 | |
| tc_3d3e6fef | search | 8ms | 2026-09-20T05:12:15 | |
| tc_403d43cc | search | 4ms | 2026-09-20T05:12:15 | |
| tc_22ca9d29 | search | 8ms | 2026-09-20T05:12:16 | |
| tc_feebf7e8 | get_raw_output | 24ms | 2026-09-20T05:12:20 | |
| tc_b92967de | get_raw_output | 24ms | 2026-09-20T05:12:20 | |
| tc_27af5680 | get_findings | 2ms | 2026-09-20T05:12:30 | |
| tc_66e19810 | get_investigation_summary | 5ms | 2026-09-20T05:12:36 | |
| tc_2d5a1d76 | search | 4ms | 2026-09-20T05:12:53 | |
| tc_9bb74a67 | search | 3ms | 2026-09-20T05:13:18 | |
| tc_8140e276 | search | 3ms | 2026-09-20T05:13:19 | |
| tc_db90e8bb | search | 3ms | 2026-09-20T05:13:19 | |
| tc_78bb3cde | search | 3ms | 2026-09-20T05:13:19 | |
| tc_dec3296b | search | 3ms | 2026-09-20T05:13:19 | |
| tc_215e004c | search | 3ms | 2026-09-20T05:13:36 | |
| tc_bc9b4b28 | search | 4ms | 2026-09-20T05:13:39 | |
| tc_ba92a429 | search | 4ms | 2026-09-20T05:14:30 | |
| tc_ad800753 | get_findings | 1ms | 2026-09-20T05:14:54 | |
| tc_7280f466 | get_ioc_summary | 572ms | 2026-09-20T05:15:15 | |
| tc_bdb80921 | audit_evidence_coverage | 2993ms | 2026-09-20T05:15:28 | |
| tc_f9eb9957 | audit_tool_coverage | 2ms | 2026-09-20T05:15:28 | |
| tc_5055935d | get_findings | 1ms | 2026-09-20T05:15:48 | |
| tc_86c5d081 | check_finalize_readiness | 3ms | 2026-09-20T05:16:05 | |
| tc_3c588701 | search | 5ms | 2026-09-20T05:16:15 | |
| tc_ec8ca5f0 | get_findings | 1ms | 2026-09-20T05:16:42 | |
| tc_e964e973 | get_investigation_summary | 3ms | 2026-09-20T05:17:00 | |
| tc_cc5a5b3b | get_findings | 1ms | 2026-09-20T05:17:12 | |
| tc_40943449 | get_findings | 2ms | 2026-09-20T05:17:37 | |
| tc_a2fb7844 | check_finalize_readiness | 3ms | 2026-09-20T05:18:10 | |
| tc_af48658d | track_progress | 12ms | 2026-09-20T05:18:45 | |
| tc_54f0fa28 | check_finalize_readiness | 4ms | 2026-09-20T05:19:30 | |
| tc_68c3f991 | get_investigation_summary | 4ms | 2026-09-20T05:20:15 | |
| tc_a3a2e8e2 | check_finalize_readiness | 4ms | 2026-09-20T05:20:15 | |
| tc_9841998a | open_case | 32ms | 2026-09-20T05:20:19 | |
| tc_fb06efbd | get_findings | 3ms | 2026-09-20T05:20:28 | |
| tc_3262dd9d | get_investigation_summary | 5ms | 2026-09-20T05:20:29 | |
| tc_ce2a80f7 | list_sources | 2ms | 2026-09-20T05:20:29 | |
| tc_5178b16a | get_timeline | 27ms | 2026-09-20T05:20:40 | |
| tc_660c26cb | get_findings | 1ms | 2026-09-20T05:21:04 | |
| tc_a9698da1 | get_findings | 1ms | 2026-09-20T05:21:21 | |
| tc_60e2830d | get_timeline | 19ms | 2026-09-20T05:22:30 | |
| tc_5194b540 | open_case | 32ms | 2026-09-20T05:23:59 | |
| tc_31d8ba9f | search | 22ms | 2026-09-20T05:24:07 | |
| tc_3f980868 | search | 28ms | 2026-09-20T05:24:07 | |
| tc_e478819b | search | 31ms | 2026-09-20T05:24:07 | |
| tc_a84170dd | search | 31ms | 2026-09-20T05:24:07 | |
| tc_3bdd2fea | search | 21ms | 2026-09-20T05:24:07 | |
| tc_a1663b64 | search | 37ms | 2026-09-20T05:24:07 | |
| tc_0ac26f93 | search | 35ms | 2026-09-20T05:24:07 | |
| tc_ecb98e75 | search | 31ms | 2026-09-20T05:24:07 | |
| tc_874c4567 | search | 16ms | 2026-09-20T05:24:07 | |
| tc_365a7799 | search | 11ms | 2026-09-20T05:24:07 | |
| tc_3df9da5e | search | 8ms | 2026-09-20T05:24:07 | |
| tc_3558efd0 | search | 6ms | 2026-09-20T05:24:07 | |
| tc_30c8ead7 | search | 4ms | 2026-09-20T05:24:07 | |
| tc_902fed95 | search | 5ms | 2026-09-20T05:24:07 | |
| tc_8b5b8743 | correlate_across_sources | 33ms | 2026-09-20T05:24:07 | |
| tc_0feb3388 | open_case | 33ms | 2026-09-20T05:24:28 | |
| tc_8aac71f2 | get_findings | 2ms | 2026-09-20T05:24:28 | |
| tc_ddac5dd9 | get_findings | 2ms | 2026-09-20T05:24:30 | |
| tc_c0c15a77 | get_findings | 2ms | 2026-09-20T05:24:33 | |
| tc_42e6d01d | get_investigation_summary | 4ms | 2026-09-20T05:24:35 | |
| tc_3f98ecec | get_findings | 2ms | 2026-09-20T05:24:39 | |
| tc_d638df04 | get_findings | 1ms | 2026-09-20T05:24:39 | |
| tc_0ae6ecdd | get_findings | 1ms | 2026-09-20T05:24:39 | |
| tc_fb21dfb4 | search | 6ms | 2026-09-20T05:25:14 | |
| tc_02b54721 | search | 4ms | 2026-09-20T05:25:14 | |
| tc_592424ed | search | 10ms | 2026-09-20T05:25:14 | |
| tc_050c0d48 | search | 3ms | 2026-09-20T05:25:14 | |
| tc_9b37b382 | search | 3ms | 2026-09-20T05:25:21 | |
| tc_f766f65d | search | 4ms | 2026-09-20T05:25:21 | |
| tc_fc36c6fc | search | 6ms | 2026-09-20T05:25:21 | |
| tc_f300b919 | search | 75ms | 2026-09-20T05:25:21 | |
| tc_8948b7aa | search | 4ms | 2026-09-20T05:25:33 | |
| tc_e036fdf0 | search | 3ms | 2026-09-20T05:25:33 | |
| tc_54e5caf1 | search | 3ms | 2026-09-20T05:25:33 | |
| tc_83a998c8 | search | 3ms | 2026-09-20T05:25:33 | |
| tc_8b05970d | get_raw_output | 82ms | 2026-09-20T05:25:43 | |
| tc_ab06d969 | get_raw_output | 80ms | 2026-09-20T05:25:43 | |
| tc_92fe973a | update_finding | 15ms | 2026-09-20T05:27:01 | |
| tc_b9b3109d | update_finding | 13ms | 2026-09-20T05:27:08 | |
| tc_fda77ae5 | update_finding | 13ms | 2026-09-20T05:27:13 | |
| tc_c741adc0 | update_finding | 15ms | 2026-09-20T05:27:41 | |
| tc_796d1fb7 | update_finding | 14ms | 2026-09-20T05:27:42 | |
| tc_82f275b4 | update_finding | 13ms | 2026-09-20T05:27:42 | |
| tc_dbc9fba2 | audit_evidence_coverage | 3059ms | 2026-09-20T05:28:05 | |
| tc_5f889b71 | audit_tool_coverage | 2ms | 2026-09-20T05:28:05 | |
| tc_7fac8d51 | check_finalize_readiness | 3ms | 2026-09-20T05:28:05 | |
| tc_d9a1977d | update_finding | 28ms | 2026-09-20T05:28:29 | |
| tc_852a5798 | update_finding | 12ms | 2026-09-20T05:28:29 | |
| tc_b542b233 | check_finalize_readiness | 3ms | 2026-09-20T05:28:29 | |
| tc_e5cd5d76 | track_progress | 13ms | 2026-09-20T05:29:27 | |
| tc_813b4f8c | get_investigation_summary | 5ms | 2026-09-20T05:30:10 | |
| tc_a32324d8 | check_finalize_readiness | 4ms | 2026-09-20T05:30:10 | |
| tc_800b305b | open_case | 10ms | 2026-09-20T05:30:19 | |
| tc_41e302a9 | get_findings | 3ms | 2026-09-20T05:30:20 | |
| tc_a0e520c7 | get_investigation_summary | 5ms | 2026-09-20T05:30:21 | |
| tc_3a274b11 | get_ioc_summary | 583ms | 2026-09-20T05:30:21 | |
| tc_e58ba9f8 | get_bookmarks | 1ms | 2026-09-20T05:30:21 | |
| tc_8cde705b | get_source_stats | 82ms | 2026-09-20T05:30:21 | |
| tc_f7dea2b7 | get_findings | 2ms | 2026-09-20T05:30:29 | |
| tc_e008f081 | search | 5ms | 2026-09-20T05:30:35 | |
| tc_9307cec8 | search | 4ms | 2026-09-20T05:30:35 | |
| tc_02352225 | get_raw_output | 88ms | 2026-09-20T05:30:41 | |
| tc_8bf8ba6e | get_raw_output | 69ms | 2026-09-20T05:30:41 | |
| tc_3caca56d | search | 6ms | 2026-09-20T05:31:06 | |
| tc_9ca5ee2c | get_raw_output | 81ms | 2026-09-20T05:31:06 | |
| tc_5f4f84fd | get_timeline | 74ms | 2026-09-20T05:31:22 | |
| tc_9a933747 | search | 3ms | 2026-09-20T05:31:23 | |
| tc_f1b7e6d6 | search | 5ms | 2026-09-20T05:31:41 | |
| tc_12dbefe8 | search | 3ms | 2026-09-20T05:31:42 | |
| tc_8e808319 | get_raw_output | 14ms | 2026-09-20T05:31:56 | |
| tc_2f385118 | submit_narrative | 17ms | 2026-09-20T05:35:57 | |
| tc_887730b4 | check_finalize_readiness | 4ms | 2026-09-20T05:36:04 |
Each finding traces back to the specific tool calls that produced the supporting evidence.