Chapter 23 — Digital forensics and malware analysis: methods I | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 Indicators"]
  N2["23.2 Searching"]
  N3["Lab — indicator search"]
  N4["23.3 Reading the result"]
  N5["23.4 Indicator quality"]
  N6["23.5 Scoping"]
  N7["23.6 Recording searches"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 Indicators"]
  N2["23.2 Searching"]
  N3["Lab — indicator search"]
  N4["23.3 Reading the result"]
  N5["23.4 Indicator quality"]
  N6["23.5 Scoping"]
  N7["23.6 Recording searches"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX067"]

[Learning outcomes]
    |
    v
[23.1 Indicators]
    |
    v
[23.2 Searching]
    |
    v
[Lab — indicator search]
    |
    v
[23.3 Reading the result]
    |
    v
[23.4 Indicator quality]
    |
    v
[23.5 Scoping]
    |
    v
[23.6 Recording searches]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) search logs for indicators of compromise; (2) scope an incident from indicator hits; (3) understand indicator quality; (4) record searches reproducibly.

23.1 Indicators

Indicators of compromise are observable values linked to malicious activity: domains, IP addresses, file hashes, registry paths. From ws-114 the team has two domains: login-portal.example.net (phishing page) and cdn-update.example.org (DLL download).

The two domains come from different stages of the attack: the phishing page from the browser history and proxy, the download domain from the proxy and static analysis of update.dll. The file hash and the run key path are further indicators from the endpoint. Each is recorded with its source and the time it was first seen.

23.2 Searching

The proxy log is searched for any host contacting either domain. Exact matching on the host field avoids false hits from similar strings in paths.

A substring search for example.net would also match unrelated hosts that share the parent domain, and might match the domain where it appears only inside a URL path. Matching the host field exactly avoids both problems. The trade-off is that subdomains used by the attacker, such as a different prefix on the same domain, would be missed, so Leah runs a second, broader search and reviews its extra results by hand.

Lab — indicator search

"""Match synthetic proxy-log lines against an indicator list."""
iocs = {"login-portal.example.net", "cdn-update.example.org"}
log = ["09:13:55 ws-114 mail.example GET /inbox",
       "09:14:30 ws-114 login-portal.example.net POST /verify",
       "09:31:02 ws-114 cdn-update.example.org GET /a.bin",
       "09:40:11 ws-207 intranet.example GET /library"]
hits = [l for l in log if l.split()[2] in iocs]
for h in hits: print("HIT", h)
print(f"{len(hits)} of {len(log)} lines matched; hosts: {sorted({h.split()[1] for h in hits})}")

Run with python3 lab_ioc.py. Verified output:

HIT 09:14:30 ws-114 login-portal.example.net POST /verify
HIT 09:31:02 ws-114 cdn-update.example.org GET /a.bin
2 of 4 lines matched; hosts: ['ws-114']

23.3 Reading the result

Two of four synthetic lines match: ws-114's POST to the phishing page at 09:14:30 and its GET of /a.bin from the download domain at 09:31:02. Only ws-114 appears, so in this sample no other host contacted the indicators. In the full log, the same search is the basis for answering Q4.

The ws-207 line is a useful negative: a host active in the same period that did not match, which shows the search is selective rather than matching everything. Exact matching on the third field depends on the log's format staying the same on every line; a line with fewer than three fields would make this simple version stop with an index error, which is why the parser from the programming chapters counts malformed lines.

23.4 Indicator quality

Domains and IPs change quickly and may be shared with legitimate services; hashes are exact but brittle. Indicators are clues to check, not verdicts.

For ws-114, the hash of update.dll is exact but would miss a recompiled variant; the download domain could be moved by the attacker within hours. Each indicator therefore leads to a question rather than a conclusion. A host that contacted cdn-update.example.org is checked for a run key and the DLL before anyone calls it infected.

23.5 Scoping

If other hosts had matched, each would become a lead with its own evidence collection.

Each lead would follow the same pattern used for ws-114: authority, inventory, preservation, analysis. Prioritising them by how recently they contacted the indicators, and by the sensitivity of the data they hold, would decide the order. In this case the search found only ws-114, which kept the investigation small, but the method scales if the result had been different. Leah's notes record that the search was done, so the absence of other hosts is a finding, not an assumption.

23.6 Recording searches

Search terms, data searched, time range and result counts are written down so a reviewer can repeat the search.

A search record for ws-114 might read: proxy log export of 09:00–12:00, exact host match on two domains, two hits, both from ws-114. Without the time range, a reader might assume the entire day was searched. Recording the count of lines searched as well as hits shows the search ran on the full export, not a truncated sample. The record goes into the case file next to the export's hash.

23.7 Sharing indicators

With approval, the security office shares indicators with peer institutions through trusted channels.

Sharing helps other institutions check their own logs for the same campaign, and they may share back indicators the university has not yet seen. Approval matters because indicators can reveal information about the incident and the university's systems. Shared items are limited to what others need, such as domains and file hashes, without names or internal hostnames, and each sharing is logged with its date and recipient.

Pivoting

A hit on one indicator can reveal new ones: the /a.bin download's response size and timing may match other requests, and the DLL's strings may name additional domains. Leah records each pivot and its source.

Worked example

The full proxy log (09:00–12:00, 48,210 lines) is searched; only ws-114 matches. Leah writes: "No other host in the proxy log contacted the two indicator domains between 09:00 and 12:00 UTC." She adds that hosts using other egress paths would not appear.

Synthetic case. The logs are generated by the lab script.

Errors and limits

A negative search is bounded by the data searched; it does not prove no other contact occurred.

Exercises

EX067 — Lab hits. Which lines matched, and which hosts?
Show marking criteria
Rubric: 3 = 09:14:30 POST, 09:31:02 GET; ws-114 only; 2 = partial; 1 = wrong; 0 = none.
EX068 — Negative bound. How should the negative full-log result be worded?
Show marking criteria
Rubric: 3 = bounded by log, range; other paths not covered; 2 = partial; 1 = no contact occurred; 0 = none.
EX069 — Hash brittleness. Why are hash indicators brittle?
Show marking criteria
Rubric: 3 = one-byte change gives new hash; variants missed; 2 = partial; 1 = weak algorithm; 0 = none.

Synthesis

Indicator searches scope incidents quickly when they are exact, recorded and bounded honestly.

Continue studying — chapter 23 of 40

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →