Investigation Report: Insider Data Exfiltration — CFReDS 2015 Data Leakage Scenario

Background

This investigation concerns a suspected insider data-leak incident on a Windows 7 workstation assigned to the user account "informant" (iaman.informant@nist.gov). The evidence set comprises a forensic disk image of the informant's PC, two removable USB flash-drive images (RM#1, an exFAT device labeled "Authorized USB" mounted as E:, and RM#2, a FAT32 device labeled "IAMAN" mounted as D:), and an optical CD/DVD image (RM#3, a UDF write-once disc labeled "IAMAN CD"). A total of 23 evidence sources were indexed across 827 tool executions, spanning SleuthKit filesystem analysis, registry parsing (SYSTEM, NTUSER, USRCLASS), Windows Event Log analysis (EVTX, Hayabusa, Chainsaw), ShimCache/UserAssist execution artifacts, MFT parsing, bulk_extractor string carving, ExifTool metadata analysis, optical-media UDF reconstruction, YARA malware scanning, steganography detection, and Volume Shadow Copy analysis.

The environment is a small internal network (10.11.11.0/24, domain "localdomain"). The informant PC held DHCP address 10.11.11.129; the sensitive data resided on a network share at \10.11.11.128\secured_drive in a folder tree named "Secret Project Data" with subfolders design, pricing decision, final, technical review, proposal, and progress. The system timezone is US Eastern (UTC-4 during the relevant period). The evidence is drawn from the NIST CFReDS 2015 Data Leakage scenario, in which the document set is derived from the publicly available NIST GovDocs corpus and represents sensitive/classified material within the scenario; the behavioral findings regarding the user's conduct are the subject of this report and are unaffected by the public origin of the underlying test documents.

Incident Timeline

The incident unfolded in four distinct operational phases over four days, from 2015-03-22 through 2015-03-25.

Phase 1 — Preparation and persistence (2015-03-22). On the afternoon of 2015-03-22, shortly after initial system setup, the informant created three unauthorized local Administrator accounts in a roughly two-minute span: "admin11" (created 15:51:54), "ITechTeam" (15:52:30), and "temporary" (15:53:01). Each was added to the local Administrators group and had its password reset, and each was then interactively logged on (LogonType 2) — admin11 at 15:53:44 and again at 15:57:02 via explicit credentials, and temporary at 15:55:57. The name "ITechTeam" mimics a legitimate IT-support account, indicating an attempt to create plausible-looking backdoor accounts. Notably, admin11 opened setupapi.dev.log (the device/USB installation log), consistent with reviewing what USB activity had been recorded. At 14:52:22 the same day, the informant first browsed the \10.11.11.128\secured_drive "Secret Project Data" share. This account-creation activity preceded any data staging by two days, establishing premeditation.

Phase 2 — Reconnaissance and cloud-channel setup (2015-03-22 to 2015-03-23). Beginning with the first Chrome use on 2015-03-22 14:33:13 and continuing through the incident, the informant conducted extensive web research into data leakage and anti-forensics. Carved browser search artifacts reveal queries including "how to leak a secret," "leaking confidential information," "information leakage cases," "intellectual property theft," "data leakage methods," "anti-forensic tools," "how to delete data," "eraser," "ccleaner," "DLP DRM," "windows event logs," "what is windows system artifacts," "Forensic Email Investigation," "external device and forensics," "cd burning method," "security checkpoint cd-r," "google drive," and "cloud storage." The user visited a DEFCON-20 AntiForensics PDF, forensicswiki.org/wiki/Anti-forensic, NIJ digital-evidence pages, and a PCAdvisor article comparing cloud-storage services. On 2015-03-23 at 19:56:33 the informant executed the Google Drive installer (googledrivesync.exe); the client installed at 20:02 and the "Google Drive" folder was created at 20:05:32. The informant again browsed the secured_drive share on 2015-03-23 at 20:23–20:28.

Phase 3 — Multi-media exfiltration (2015-03-24). This was the execution day. In the morning (~09:59–10:00), 17 files were written to the RM#2 "IAMAN" FAT32 device with false extensions to disguise Office documents as innocuous media/text files. In the early afternoon (13:38–14:01), the informant accessed a local "S data\Secret Project Data" copy and staged the data onto the RM#1 "Authorized USB" exFAT device (E:\Secret Project Data and E:\RM#1\Secret Project Data), retaining real filenames. That evening (19:47–20:44), the informant created the disguised folder structure on RM#2 (D:\de, D:\tr, D:\pd, D:\prop, D:\prog — abbreviations for design, technical review, pricing decision, proposal, progress) and browsed into the internal structure of a masqueraded PowerPoint file. Finally, from 20:54:16 to 20:57:03, the informant burned the same data to the RM#3 "IAMAN CD" optical disc across 9 UDF write sessions, renaming folders from full names to the abbreviated disguised names across sessions, and added three stock Windows 7 sample photos (Koala.jpg, Penguins.jpg, Tulips.jpg) to the disc root at 20:57 as decoys to make the CD appear to be an innocuous photo disc.

Phase 4 — Anti-forensic cleanup (2015-03-25). The day after the staging, the informant downloaded and executed two data-destruction tools: Eraser 6.2.0.2962 (installer run 14:47:40, application run 15:15:50) and CCleaner (installer ccsetup504.exe run 14:48:28, application CCleaner64.exe run 15:21:30). The Google Drive sync client was also executed at 15:24:48. The 17 masqueraded files on RM#2 survive only as deleted $OrphanFiles entries, consistent with this wiping activity; the live browser history databases were likewise unrecoverable, consistent with the CCleaner run.

Key Findings

The investigation produced 12 findings (10 confirmed, 2 inference, 3 negative), of which 1 is critical, 5 are high, and 6 are medium severity. Eight findings carry MITRE ATT&CK mappings spanning 12 techniques.

Persistence — backdoor accounts. The informant created three local Administrator accounts (admin11, ITechTeam, temporary) on 2015-03-22 and logged into them interactively. None were deleted (no EID 4726), so all three persisted. This maps to MITRE T1136.001 (Create Account: Local Account), T1098 (Account Manipulation), and T1078 (Valid Accounts). The account "ITechTeam" was named to blend in with legitimate IT support.

Data collection and staging. The source data was harvested from \10.11.11.128\secured_drive (T1039, Data from Network Shared Drive; T1020, Automated Exfiltration context). The data was staged locally and then onto removable media (T1074.001, Data Staged: Local Data Staging).

Exfiltration — three physical vectors plus a cloud channel. The investigation identified an unusually broad set of exfiltration channels. RM#1 ("Authorized USB") held the data with real filenames. RM#2 ("IAMAN") held identical content with 17 files renamed to false extensions (T1036.005, Masquerading: Match Legitimate Name or Location; T1567.002, Exfiltration to Cloud/physical; T1052.001, Exfiltration over Physical Medium: USB). RM#3 ("IAMAN CD") held the same content burned to optical disc with decoy photos (T1052.001, T1036.005, T1030, Data Transfer Size Limits context). The identical 16,381,123-byte winter_whether_advisory.zip on both RM#2 and RM#3 confirms the same content was written to multiple devices. Additionally, the Google Drive sync client was installed and run, representing a potential cloud exfiltration channel, though actual upload of the leaked files could not be confirmed from the indexed artifacts (confidence: inference).

Masquerading and concealment. The 17 files on RM#2 and RM#3 were Office documents (DOCX/XLSX/PPTX/OLE) renamed with media/archive extensions (.amr, .zip, .db, .7z, .jpg, .avi, .svg, .png, .one, .gif, .txt). Shellbags independently corroborated this by showing the user browsing into the internal PPTX structure of a ".zip" file. The decoy JPEGs on RM#3 were genuine Windows sample photos placed to make the disc look innocuous.

Anti-forensics. Eraser and CCleaner were downloaded and executed on 2015-03-25 (T1070.004, Indicator Removal: File Deletion; T1070.002, Clear Linux or Mac System Logs / general cleanup). The deletion of the RM#2 files and the unrecoverability of the browser history are consistent with this cleanup.

Negative results. Several hypotheses were affirmatively ruled out. No archiver (7-Zip/WinRAR) or file-transfer (FileZilla/WinSCP/PuTTY) tools were present, ruling out FTP/SFTP/SSH transfer and local archive creation — the ".7z"/".zip" files were renamed Office documents, not archives. No steganography was detected in the disc images. No malware was found (YARA produced no matches; no macros/JS/OLE exploits in the documents) — the tooling was legitimate-but-misused software. No Volume Shadow Copies existed on the removable media (expected for FAT32/exFAT). No external/remote intrusion vector was found — all network logons were benign ANONYMOUS LOGON, with no failed logons or RDP.

IOC clarification. The address Eric_P._Lauer@omb.eop.gov appears on both RM#2 and RM#3 with an identical surrounding byte context, indicating it is embedded document metadata carried inside the GovDocs-derived files rather than an exfiltration destination typed by the actor. It is therefore treated as a low-value indicator. The most defensible indicators are the internal source share (\10.11.11.128\secured_drive) and the actor's own accounts (iaman.informant@nist.gov, iaman.informant.personal@gmail.com).

Threat Intelligence and Attribution

This incident is attributable to an insider — the "informant" user — rather than an external threat actor. The evidence for this is convergent and strong: the backdoor accounts were created by the informant's own SID; the data access originated from the informant's PC on the same LAN segment as the server; the staging, masquerading, and cleanup were all performed interactively under the informant's session; and the web research into "how to leak a secret" and anti-forensics was conducted from the informant's browser. No external intrusion, malware, or remote-access vector was identified.

Attribution to a named external threat group is not applicable here; this is an insider-threat scenario. The TTP pattern — premeditated research, creation of plausible-looking backdoor accounts, multi-vector physical exfiltration with filename masquerading and decoy content, followed by anti-forensic cleanup — is consistent with a deliberate, planned insider data-theft operation rather than opportunistic or automated activity. The specific research queries ("security checkpoint cd-r," "DLP DRM," "windows event logs") indicate the actor anticipated physical security screening and forensic investigation and actively sought to defeat both. Confidence in the insider attribution is high and confirmed by multiple independent artifact sources; confidence in any external actor is nil.

Impact Assessment

The scope of compromise is a single workstation (the informant PC, 10.11.11.129) and the data it could reach. The data at risk is the "Secret Project Data" collection, which within the scenario represents sensitive US federal government IT-investment and budget data spanning numerous departments and agencies (Air Force, Army, Navy, DoD Agencies, USDA, DOC, ED, Energy, HHS, DHS, HUD, Interior, DOJ, Labor, State, USAID, DOT, Treasury, VA, USACE, EPA, GSA, NASA, NARA, NRC, OMB, OPM) plus climate/satellite research presentations. The total staged volume is substantial — individual files ranged up to 35 MB, with the aggregate across the 17 masqueraded files exceeding 100 MB, replicated across three separate physical media.

Credential and access exposure is significant: three unauthorized local Administrator accounts were created and persisted, granting the actor continued privileged access independent of the primary account. Persistence depth is therefore moderate (local account backdoors on one host). The exfiltration breadth is high — the data left the environment on at least two USB devices and one optical disc, with a possible additional cloud channel via Google Drive. The anti-forensic activity (Eraser/CCleaner) partially succeeded in destroying browser history and the on-media copies, though the deleted files were recoverable from orphan space and the behavioral record survived in registry, event logs, and execution artifacts.

Immediate Tactical Containment

The following steps should be executed immediately to stop the active threat. Note that this is a historical/forensic scenario; the steps are framed as they would apply to a live equivalent incident.

1. Isolate the informant workstation (last known IP 10.11.11.129) from the network — pull the network cable or quarantine via switch/NAC to prevent any further access to \10.11.11.128\secured_drive.
2. Disable the primary user account "informant" (iaman.informant@nist.gov) in Active Directory / locally, and revoke any associated credentials and active sessions.
3. Disable and investigate the three backdoor local Administrator accounts: "admin11," "ITechTeam," and "temporary." Do not delete them until their hives and activity are preserved; reset their passwords and remove them from the Administrators group.
4. Preserve and restrict access to the file server at 10.11.11.128; audit access to the "secured_drive" share and enable detailed file-access auditing on the "Secret Project Data" tree.
5. Seize and forensically image all removable media associated with the user — specifically the two SanDisk Cruzer Fit USB devices (serials 4C530012450531101593&0 and 4C530012550531106501&0) and the "IAMAN CD" optical disc — and issue a recall for any media that may have left the premises.
6. Block and audit the Google Drive sync client (googledrivesync.exe) and the consumer cloud-storage channel at the proxy/egress filter; capture any pending sync activity to determine whether data was uploaded.
7. Quarantine the anti-forensic tools pending review — preserve C:\Program Files\Eraser\Eraser.exe and C:\Program Files\CCleaner\CCleaner64.exe and their installers as evidence; do not run them.
8. Block egress to drive.google.com and consumer cloud-storage domains at the perimeter until the scope of any cloud upload is determined.
9. Preserve the Security event log, ShimCache, UserAssist, USRCLASS shellbags, and MFT from the workstation before any cleanup or reimaging.
10. Interview/escort the user per insider-threat protocol and preserve their Outlook OST (iaman.informant@nist.gov.ost) and any personal webmail artifacts (iaman.informant.personal@gmail.com) via legal hold.

Strategic Remediation

Root cause 1 — Unrestricted local Administrator and account-creation rights. The informant was able to create three local Administrator accounts and add them to the Administrators group (finding f_d2b08f44, T1136.001/T1098). The control that failed was the absence of any restriction or alerting on privileged-account creation. The specific change that would have prevented this attack path is to remove standing local-admin rights from standard users, route account creation through a controlled process, and alert on Security EID 4720 (account created) and 4732 (member added to Administrators) in near-real-time — the three accounts created in a two-minute burst at 15:51–15:53 on 2015-03-22 would have triggered immediate investigation two days before the data was staged.

Root cause 2 — Unrestricted access to the sensitive network share. The informant browsed and harvested \10.11.11.128\secured_drive "Secret Project Data" without any apparent access control or DLP intervention (findings f_8a3b21e2, f_84fc9db9, T1039). The control that failed was overly permissive share ACLs combined with no data-loss-prevention monitoring. The specific change is to enforce least-privilege ACLs on the secured_drive share so only authorized project members can read the Secret Project Data tree, and to deploy DLP that alerts on bulk reads from that share — the actor explicitly researched "DLP DRM" (90 hits), indicating they expected and sought to evade such a control.

Root cause 3 — Uncontrolled removable-media and optical-burning capability. The actor staged data onto two USB devices and burned a CD, using filename masquerading and decoy photos to defeat casual inspection (findings f_84fc9db9, f_b0a2bacd, f_5dc19002, T1052.001/T1036.005). The control that failed was the absence of removable-media control and optical-burn restrictions. The specific change is to enforce a device-control policy that blocks or encrypts writes to unapproved USB storage and disables optical burning for users without a business need — the actor researched "security checkpoint cd-r" and "cd burning method," indicating they planned to physically carry media past a checkpoint, which a device-control policy rendering media unreadable off-system would have defeated.

Root cause 4 — Unrestricted installation of cloud-sync and anti-forensic software. The actor installed Google Drive, Eraser, and CCleaner without restriction (findings f_5b6d90e2, f_97049535, T1567.002/T1070.004). The control that failed was the absence of application allow-listing. The specific change is to deploy application control (e.g., AppLocker/WDAC) that blocks unapproved executables — this would have prevented both the cloud exfiltration channel (googledrivesync.exe) and the evidence-destruction tools (Eraser/CCleaner) from running.

Root cause 5 — No monitoring of anti-forensic research or execution. The actor conducted extensive reconnaissance into forensic artifacts and evidence destruction and then executed wiping tools, with no detection (findings f_437ab754, f_97049535). The control that failed was the absence of user-behavior and execution monitoring. The specific change is to alert on execution of known anti-forensic tools (Eraser, CCleaner secure-delete functions) and on ShimCache/UserAssist anomalies, so that the 2015-03-25 cleanup would have been detected and the media preserved before deletion.

Conclusion

This investigation confirms a deliberate, premeditated insider data-exfiltration incident carried out by the "informant" user between 2015-03-22 and 2015-03-25.

Q1. What systems were compromised? A single workstation — the informant PC at 10.11.11.129 — was compromised, in the sense that the legitimate user abused their own access. Three backdoor local Administrator accounts (admin11, ITechTeam, temporary) were created on it. The file server at 10.11.11.128 was accessed as the data source but was not itself compromised.

Q2. How did the attacker gain initial access? This is an insider threat; the actor already had legitimate access. No external intrusion occurred — the actor used their own authorized credentials and local access. The "initial access" for the data-theft phase was the actor's legitimate ability to read the \10.11.11.128\secured_drive share.

Q3. What lateral movement occurred? No lateral movement to other systems occurred. The actor's activity was confined to their own workstation and access to the single network share. All network logons were benign ANONYMOUS LOGON; there were no failed logons, no RDP, and no movement to other hosts.

Q4. What persistence mechanisms were installed? Three unauthorized local Administrator accounts (admin11, ITechTeam, temporary) were created on 2015-03-22, added to the Administrators group, and never deleted. These constitute the persistence mechanism, providing continued privileged access independent of the primary account.

Q5. Was data exfiltrated, and if so, what and how much? Yes. The "Secret Project Data" collection — representing US federal government IT-investment/budget data and climate-research documents — was staged onto at least three physical media: two USB flash drives (RM#1 "Authorized USB" with real filenames, RM#2 "IAMAN" with 17 masqueraded files) and one optical CD ("IAMAN CD" with the same masqueraded files plus decoy photos). Individual files ranged up to 35 MB, with the aggregate across the 17 files exceeding 100 MB replicated across the three media. A Google Drive cloud channel was set up but actual upload could not be confirmed.

Q6. What is the full timeline of the incident? 2015-03-22: backdoor accounts created (15:51–15:57), share first browsed (14:52), research begun. 2015-03-23: share re-browsed (20:23–20:28), Google Drive installed (19:56–20:05). 2015-03-24: RM#2 files written (~09:59–10:00), RM#1 staged (13:38–14:01), RM#2 disguised structure created and browsed (19:47–20:44), RM#3 CD burned (20:54–20:57). 2015-03-25: Eraser and CCleaner executed (14:47–15:21), Google Drive sync run (15:24).

Q7. What is the total scope and business impact? The scope is one workstation, one data source, three backdoor accounts, and exfiltration of a sensitive multi-agency government data collection across three physical media plus a potential cloud channel. The business impact is the loss of confidentiality of the Secret Project Data and the persistence of privileged backdoor access; within the scenario this represents a serious breach of restricted government data.

Q8. What are the recommended remediation actions? Contain the workstation and disable the informant and backdoor accounts immediately; preserve all media and forensic artifacts; then implement the five strategic remediations — restrict and alert on privileged-account creation, enforce least-privilege and DLP on the secured_drive share, deploy removable-media and optical-burn device control, enforce application allow-listing to block unapproved cloud-sync and anti-forensic tools, and add behavioral/execution monitoring for anti-forensic activity. These map directly to the specific failures observed in this case.