Welcome to my portfolio, with all things related to...

Incident Types

While I have experience tackling a broad spectrum of cases, recently I've focused on leading intricate IR cases, particularly those involving a cloud platform compromise. Here's an overview of the types of incidents I've responded to. To read more about similar case studies, see my blog post here!

Types of Digital Forensics Cases

• Data Breach Investigation: Investigating unauthorized access to sensitive data, such as customer records or financial information, to determine the extent of the breach and identify the responsible party, if possible.
• Intellectual Property Theft: Analyzing digital evidence to uncover instances of intellectual property theft, such as trade secrets, patents, or proprietary information stolen by insider or external threats.
• Employee Misconduct: Examining digital devices and communications to gather evidence of employee misconduct, including unauthorized access to company resources, data theft, or policy violations. Also includes departed employees
• Fraud Investigations: Investigating digital evidence related to financial fraud, identity theft, or online scams to identify perpetrators, trace fraudulent transactions, and compile evidence for legal proceedings.

Types of Incident Response Cases

• Advanced Persistent Threat (APT): Sophisticated, often long-term cyberattack orchestrated by well-funded and highly skilled threat actors, such as nation-states (China, Russia, North Korea) or organized cybercriminal groups. APT attacks are characterized by their stealthy, long-term nature, where attackers gain unauthorized access to target networks or systems, remain undetected for extended periods, and exfiltrate sensitive information or disrupt operations.
• Ransomwares: Designed to encrypt files or block access to computer systems until a ransom is paid by the victim. Ransomware attacks often involve threat actors encrypting critical data on infected devices and demanding payment, usually in cryptocurrency, in exchange for a decryption key to restore access. Some groups operate shame sites to leak exfiltrated data for victims who don't pay within an allotted timeframe. Ransomwares can affect industries and companies of all shapes and sizes, ranging from enterprise organizations to even local mom-and-pop shops.
• Business Email Compromise (BEC): Cyberattack where threat actors gain unauthorized access to a business email account, typically through phishing or social engineering tactics, and use it to conduct fraudulent activities. BEC attacks can take various forms, including email spoofing, invoice fraud, and CEO impersonation, with the goal of tricking employees into transferring funds, disclosing sensitive information, or initiating unauthorized transactions.
• Supply chain attack: Cyberattack where attackers compromise or gain unauthorized access to a company's system/network by targeting vulnerabilities in the supply chain of an organization. Also known as “value-chain” or “third-party” attacks. Supply chain attacks often involve exploiting weaknesses in third-party vendors, contractors, or service providers to infiltrate the target organization's infrastructure and carry out malicious activities, such as data theft, espionage, or sabotage.
• Insider threat: Refers to the risk posed to an organization's security and data integrity by individuals within the organization who misuse their access privileges or intentionally engage in malicious activities. Insider threats can include current or former employees, contractors, or business partners who exploit their insider knowledge and access to commit fraud, data theft, sabotage, or espionage against the organization. Insider threats can be unintentional, such as negligence or accidental data breaches, or deliberate, involving malicious intent.

Cloud IR

Cloud Incident Response is an emerging and booming subset of IR that refers to responding to security incidents that occur within cloud environments, such as across cloud infrastructure or services across platforms such as Microsoft's Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP). See my blog post here for examples of cloud compromises across major cloud provider platforms.

What's new in Cloud IR?

Cloud-based incidents are reshaping traditional DFIR work with a shift in commonly accepted investigative practices, tools, and expertise to effectively address the complexities of cloud environments. Incident responders should adapt and evolve their approaches to keep pace with the changing landscape of cybersecurity in the cloud. A few of major changes I've noticed:

1. Shift in Data Sources: In 2024, around 87% of Fortune 500 companies have adopted at least one public cloud platform. Incident responders typically collected data from on-premises systems, such as servers, workstations, and network (firewall) logs - the physical access parameters. As more organizations utilize services from a variety of cloud platforms, working with the access parameters of each cloud provider requires a deeper level of expertise - such as taking logical storage snapshots, understanding log retention, etc.
2. Complexity of Investigations: Cloud-based incidents introduce additional complexity to DFIR investigations because of its efficient, but distributed nature, including shared responsibility models and multi-tenant architectures. Investigating incidents involving cloud services requires coordination and collaboration between the cloud customer, CSPs, and potentially other third-party service providers. In my experience,
3. Challenges in Data Collection and Preservation: Collecting and preserving digital evidence in cloud environments presents unique challenges compared to collecting from on-premises systems. Cloud-based data may be dispersed across multiple geographic regions, stored in shared storage systems, or subject to automated data lifecycle management by CSPs. Ensuring the integrity and admissibility of digital evidence collected from cloud environments requires specialized techniques and tools tailored to cloud forensics. Also requires expertise in a variety of cloud platforms.
4. Adaptation of Investigative Techniques: Investigators should adapt their techniques and methodologies to address cloud-specific artifacts, including logging mechanisms, encryption practices, and access controls implemented by CSPs. Traditional DFIR methodologies may need to be modified or supplemented with cloud-specific approaches to effectively investigate incidents in cloud environments (i.e., lateral movement across cloud resources, data exfiltration from cloud storage, etc.)
5. Integration with Cloud Security Tools: Cloud-based incidents necessitate the integration of traditional DFIR workflows with cloud-native security tools and technologies. This includes leveraging CSP-provided security services, such as cloud monitoring, threat detection, and incident response automation. Integrating these tools into DFIR workflows enables faster detection, analysis, and response to cloud-based threats and security incidents. See DFIR Toolkit tab for several cloud-native tools across major cloud providers.

Cloud IR requires a deep understanding of cloud computing architectures, security controls, and compliance requirements, along with proficiency in traditional DFIR methodologies adapted to the cloud environment. Effective cloud IR strategies prioritize proactive threat detection, rapid incident triage, and coordinated response efforts between cloud customers, cloud service providers (CSPs), and other stakeholders.

DFIR Toolkit

DFIR is a massive industry with new tools and platforms emerging as the needs change and evolve. While there are many out there, here’s some that I use regularly through my investigations. My preferred tools are marked with a .

Forensic Preservation Tools

• Logicube Forensic Falcon – A standalone forensics device offering various functions such as data acquisition, secure encryption, data verification, and disk formatting tailored for forensic applications.
• AccessData FTK Imager – A free forensic tool used for capturing live data and creating forensic images of files, folders, and disk images, while supporting live memory acquisition on both 32-bit and 64-bit systems.
• Guymager – Free Linux-based imager for forensic acquisition of media drives, optimized for full-drive data captures.
• Magnet ACQUIRE – Acquires forensic images from a variety of platforms including Windows, macOS, Linux, and mobile devices.
• Cellebrite – Cellebrite's Digital Collector (MacQuisition) supports imaging of Intel + Apple Silicon (M1, M2) as well as Ventura OSes (as of mid-2023). Cellebrite's UFED is a tool used to extract data from mobile devices, SIM cards, removable media (USBs), and even drones!
• F-Response – Enables remote, secure, and read-only access to target systems for real-time data analysis and incident response, ensuring data integrity.
• PSRecon – Utilizes PowerShell (v2+) to remotely collect and organize data from Windows systems, ensuring data integrity through comprehensive hashing.
• bulk_extractor – Scans digital media to extract critical information quickly without requiring file system parsing, enhancing the efficiency of forensic examinations.
• X1 Social Discovery – Specializes in collecting data from social media and websites, particularly for digital investigations and legal discovery

Memory Tools

• Belkasoft RAM Capturer – Forensic tool that reliably acquires volatile memory of a running computer. Designed to be fail-safe and easy to use, it captures system RAM with minimal risk of data corruption.
• Live Response Collection – Automates the collection of volatile data from Windows, OS, and *nix based operating systems.
• Volatility 3 - Specializes in extracting artifacts from volatile memory, providing crucial insights into the runtime state of systems.
• ReKall - Open-source tool + library for extraction of digital artifacts from volatile memory (RAM) samples.

All-In-One Tools

• X-Ways Forensics - A versatile tool for disk cloning, imaging, file recovery, and detailed analysis of data, serving as a cornerstone for forensic investigations.
• OSquery - Open-source endpoint visibility tool developed by Meta, transforming device states into queryable databases, enabling real-time visibility and analysis across multiple operating systems.
• Velociraptor - An advanced tool providing deep endpoint visibility and data collection capabilities to enhance investigative and monitoring activities. Uses Velocidex Query Language (VQL).

Host-Based Analysis

• Hayabusa - Quickly parses and generates timelines from Windows event logs.
• RegRipper - Open source tool written in Perl for extracting/parsing (keys, values, data) from registry hives for values of interest.
• Event Log Explorer - Viewing, analyzing, and monitoring events recorded in Microsoft Windows event logs. It provides powerful features to aggregate, analyze, and export logs.
• Loki - Python-based scanner leveraging indicators of compromise and YARA rules for comprehensive endpoint scanning
• Thor Lite - Extensive IOC and YARA scanning capabilities, equipped with advanced modules and signature sets for detailed threat detection. Built upon Loki.
• Intella Pro - Focuses on email investigation and eDiscovery, offering powerful tools for processing and analyzing email data.
• Eric Zimmerman Tools - A suite of open-source forensic tools that provide deep insights and cross-validation capabilities in digital investigations.
• Magnet AXIOM - Integrates evidence from mobile, cloud, and computer sources into a single case file, streamlining the investigation process.
• Exiftool - A powerful tool for manipulating metadata in a wide array of file types, critical for forensic and investigative purposes.
• John the Ripper - Fast password cracker, widely used for its ability to automatically detect password hash types and support numerous cracking modes.

Log Analysis Platforms + Tools

• Splunk Enterprise - A robust platform that captures, indexes, and correlates real-time data in a searchable repository, enabling complex querying, analysis, visualization, and monitoring.
• Elastic’s ELK Stack - Combines Elasticsearch, Logstash, and Kibana to process, search, and visualize large volumes of data in real time, providing an integrated solution for log and time-series analytics.
• LogRhythm - Security information and event management (SIEM) solution that combines log management, machine learning, and advanced analytics to help identify and respond to threats quickly.
• Sumo Logic - A cloud-based log management and analytics service that transforms big data into sources for security and operational intelligence. It is designed to help with real-time forensics and incident response.
• IBM Security QRadar - SIEM solution that consolidates log events and network flow data from thousands of devices, endpoints, and applications across a network.
• Other great tools for loose log analysis
• Jupyter Notebook - Provides an interactive computing environment where you can combine code execution, rich text, mathematics, plots, and rich media.
• PostgreSQL’s pgAdmin - A comprehensive administration tool for PostgreSQL, offering GUI for database management, query tooling, and monitoring
• Cygwin - A POSIX-compatible environment that runs natively on Microsoft Windows, allowing the running of Linux-based applications and tools. An essential tool in my opinion.

Shoutout to Microsoft's Excel and Notepad++ for all the support through my journey here.

Network Analysis

• NetWitness Investigator - Facilitates advanced network forensics with real-time visibility into network traffic, aiding in the detection and investigation of security threats.
• NetworkMiner - An open-source network forensics tool for extracting artifacts from captured network traffic.
• WireShark - Network protocol analyzer for deep inspection of network protocols and payload content.
• TCPDump - Command-line packet analyzer used for network diagnostics and network traffic monitoring by capturing packet data. Isolate packets, sessions, and events of interest for deeper review.

Open Source Intelligence (OSINT) Tools

• Shodan.io - A specialized search engine for finding specific types of internet-connected devices and systems.
• MaxMind - Provides IP geolocation and online fraud prevention tools.
• DomainTools - Offers domain profile information and history.
• CyberChef - Versatile web application for encoding, decoding, ciphering, hashing, and data analysis, with numerous operations and chainable tools
• OpenPhish - Repository of active phishing sites, offering free phishing intelligence feeds.
• VirusTotal - Analyzes suspicious files and URLs to detect malware and other threats using multiple antivirus engines and website scanners
• JOE Security - A sandboxing solution that analyzes suspicious files, malware, and URLs across multiple operating systems, providing detailed security reports.
• AlientVault OTX (Open Threat Exchange) - Global open threat intelligence community that shares in real-time, aiding in the response to emerging threats, promoting faster incident response.
• SpiderFoot - Open-source intelligence automation tool, automating the process of gathering intelligence about a given target (ex. IP address, domain name, hostname, network subnet, etc.)

Visualization Software

• Timesketch - An open-source collaborative forensic timeline analysis tool designed to help teams work together on digital investigations.
• Plaso - Python-based backend that extracts timestamps from various files found on a system and aggregates them into a single timeline.
• Maltego by Paterva - A powerful visualization tool for understanding and displaying the relationships and real-world links between digital entities.
• XMind - A full-featured mind-mapping and brainstorming tool, enabling the structuring of thoughts, complex information, and ideas for projects and research.
• Metabase - Interface for creating visualizations and dashboards from various databases without requiring extensive technical knowledge

Cloud Platform tools

Unlike traditional DFIR tools, which focus on on-premises infrastructure, cloud-native tools are tailored for the scalable, dynamic nature of cloud environments. The tools range from real-time monitoring to automated security for cloud architectures like serverless and containers.

Amazon Web Services AWS

• AWS CloudTrail - Provides governance, compliance, operational auditing, and risk auditing of your AWS account by logging all account activity.
• Amazon GuardDuty - Offers intelligent threat detection that monitors your AWS environment for malicious activity and unauthorized behavior.
• AWS Security Hub - Aggregates security alerts and findings from various AWS services and third-party tools to provide a comprehensive view of your security posture.
• Amazon Inspector - Automatically assesses applications for vulnerabilities or deviations from best practices, including those deployed on EC2 instances.
• Splunk - Integrating Splunk with AWS services can provide deeper insights into the data and more advanced analytics capabilities for threat detection and response.

Microsoft's Azure Microsoft

• Azure Security Center - Provides unified security management and advanced threat protection across hybrid cloud workloads. It includes continuous monitoring and policy enforcement.
• Azure Sentinel - This is Microsoft’s cloud-native SIEM that provides intelligent security analytics at cloud scale for enterprises of all sizes and workloads.
• Azure AD Identity Protection - Helps detect potential vulnerabilities affecting your organization’s identities, configure automated responses, and investigate incidents.
• Microsoft Defender for Cloud - Offers tools for navigating to the root cause of a breach or verifying that alerts are false positives.

Google Cloud Platform GCP

• Google Chronicle - As part of Google Cloud, Chronicle provides a powerful analytics engine to help enterprises manage their security data at scale, including threat hunting and incident investigation.
• Google Cloud Security Command Center - Provides risk assessment and threat identification across your Google Cloud data, assets, and services.
• Google Cloud’s operations suite (formerly Stackdriver) - Monitors, logs, and diagnoses cloud applications’ issues on GCP in real time
• Sysdig Secure - Used for securing containerized environments and can be integrated with GCP for monitoring, security, and forensics in a Kubernetes environment.

Additional Cloud Security Tools (EDR, SIEMs)

• Orca Security - Provides agentless cloud security for AWS, Azure, and GCP, utilizing SideScanning technology to assess vulnerabilities, malware, misconfigurations, and compliance risks in cloud assets without the use of agents.
• CrowdStrike Falcon Insight XDR - Delivers endpoint protection through advanced analysis of threat data, offering real-time visibility and proactive threat hunting capabilities.
• Palo Alto Networks Prisma Cloud - Offers visibility and control over data across all cloud environments, providing continuous threat detection, compliance monitoring, secure access, and data protection.
• VMWare Carbon Black EDR - Provides advanced threat detection and response by analyzing endpoint data and offering tools for incident response and defense.
• SentinelOne Singularity - A unified, AI-powered platform providing prevention, detection, response, and hunting across endpoints, containers, cloud workloads, and IoT devices.
• Sophos Intercept X - Offers next-gen endpoint protection using deep learning technology to block malware, exploits, and ransomware attacks.