Chapter 5 — Digital forensics and malware analysis: tools and interpretation
Lesson map
Lesson 05 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["5.1 The toolset"]
N2["5.2 Mailbox rules"]
N3["Lab — flagging external forwards"]
N4["5.3 Reading the result"]
N5["5.4 Message trace"]
N6["5.6 Forwarded content"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 The toolset"]
N2["5.2 Mailbox rules"]
N3["Lab — flagging external forwards"]
N4["5.3 Reading the result"]
N5["5.4 Message trace"]
N6["5.6 Forwarded content"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]
[Learning outcomes]
|
v
[5.1 The toolset]
|
v
[5.2 Mailbox rules]
|
v
[Lab — flagging external forwards]
|
v
[5.3 Reading the result]
|
v
[5.4 Message trace]
|
v
[5.6 Forwarded content]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) use admin console exports and small scripts as tools; (2) interpret mailbox rules; (3) read message trace and audit records; (4) avoid over-reading tool output.
5.1 The toolset
Practitioners at Marlow use the email admin console (search, audit and export), the proxy reporting page, a spreadsheet for review and short standard-library scripts for repeatable checks. Tools are approved by Dev and their versions recorded. Every tool here is simple on purpose, so its behaviour can be checked by reading it. Lena records the console she used, export settings such as the date range, and the script name and version for each check. That record later explains the missing sign-ins problem, where the console's default 48-hour range had cut off older records.
5.2 Mailbox rules
Inbox rules move, delete or forward messages automatically. Attackers who take over a mailbox often add a rule to forward copies outside, or to hide replies, so the real owner does not notice. Legitimate rules are common too, so each must be interpreted. Joy's mailbox illustrates both: 'Supplier folder' is the kind of rule an accounts clerk sets up to sort supplier mail, while 'fwd' sends copies to billing.records@example.org. Lena therefore reads each rule's action, target, creation time and creating session before calling it suspicious.
Lab — flagging external forwards
"""Synthetic inbox-rule export: flag rules that forward mail outside the company domain."""
RULES = [
("j.okafor", "Supplier folder", "move", "Suppliers"),
("j.okafor", "fwd", "forward", "billing.records@example.org"),
("m.lee", "Copy to team", "forward", "ap-team@marlow.example"),
]
for user, name, action, target in RULES:
external = action == "forward" and not target.endswith("@marlow.example")
print(f"{user:9} {name:16} {action:8} {target:30} {'EXTERNAL' if external else 'ok'}")
Run with python3 lab_rules.py. Verified output:
j.okafor Supplier folder move Suppliers ok
j.okafor fwd forward billing.records@example.org EXTERNAL
m.lee Copy to team forward ap-team@marlow.example ok
5.3 Reading the result
Joy has two rules: "Supplier folder" moves mail into a folder (normal), and "fwd" forwards to billing.records@example.org, outside the company — flagged EXTERNAL. m.lee's rule copies to an internal team address. The audit log shows "fwd" was created at 09:20 from the 203.0.113.50 session. The script only tests whether a forwarding target ends in @marlow.example; it does not know who created the rule. That link comes from the mailbox audit record, which ties the 09:20 creation to the same session as the 09:14 sign-in. The internal forward on m.lee's mailbox is left alone because nothing ties it to the attacker.
5.4 Message trace
Message trace shows messages sent and received. At 09:40, Joy's account sent "Updated bank details" to Kestrel's finance address. No other external messages were sent in the attacker's session. The trace answers the 'what did they do?' question for outgoing mail. Lena filters it to j.okafor between the 09:14 sign-in and the 10:05 reset and lists every message with time, recipient and subject. The bank-change email is the only message the attacker sent directly to an outside address in that window; the forwarded copies appear as traffic generated by the 'fwd' rule.
5.5 Interpretation limits
A rule created from the attacker's session is strong evidence. The rule name "fwd" proves nothing on its own; the session link does. Tool output is a starting point: Lena checks the audit record behind each flag. A legitimate rule forwarding to an accountant outside Marlow would be flagged too, and a malicious rule pointing to a compromised internal mailbox would not be flagged at all. The flag is only a reason to look; the audit record is the evidence she cites.
5.6 Forwarded content
Trace shows 11 messages forwarded between 09:20 and 10:05. The reset at 10:05 ended the attacker's sign-in, but it did not disable 'fwd', because a server-side rule keeps running after a password change until it is removed. The rule stayed in place until IT deleted it at 10:15, so mail arriving between 10:05 and 10:15 could also have been forwarded to billing.records@example.org. Lena therefore checks the mailbox audit and message trace for 10:05 to 10:15 before treating eleven as the final count. Lena lists their subjects for the data protection lead without opening attachments. Subjects are enough for the data protection lead to judge what left the company: they show supplier names and invoice topics without Lena reading message bodies or opening attachments. The list goes into a restricted appendix, not the main report. If a subject suggested sensitive content, Lena would ask Dev and the data protection lead how far to look, rather than opening the message on her own initiative.
Worked example
Lena's table: "Rule 'fwd' — created 09:20 by session from 203.0.113.50 — forward to billing.records@example.org — 11 messages forwarded 09:20–10:05 — rule exported 10:12, removed 10:15; 10:05–10:15 forwarding to be checked in mailbox audit and trace."
Synthetic case. Records come from the lab script.
Errors and limits
Consoles show what the provider records; some actions, such as reading a message, may not be logged at all levels of licence.
Exercises
- EX021 — Rule purposes. Why do attackers add inbox rules? Rubric: 3 = forward copies outside; hide replies from owner; 2 = one; 1 = vague; 0 = none.
- EX022 — Flagged rule. Which rule was flagged, and what links it to the attacker? Rubric: 3 = 'fwd' external; created 09:20 from 203.0.113.50 session; 2 = rule only; 1 = wrong; 0 = none.
- EX023 — Trace finding. What did message trace show at 09:40? Rubric: 3 = 'Updated bank details' sent to Kestrel finance; only external send; 2 = partial; 1 = wrong; 0 = none.
- EX024 — Over-reading. Why is the rule name alone weak evidence? Rubric: 3 = names are arbitrary; the session link is the evidence; 2 = partial; 1 = strong; 0 = none.
- EX025 — Forwarded mail. How were forwarded messages listed for data protection? Rubric: 3 = subjects listed from trace; attachments not opened; 11 messages; 2 = partial; 1 = read them all; 0 = none.
Synthesis
Use tools for leads, then confirm each flag with the record behind it and state what the tool cannot see.
Continue studying — chapter 05 of 12
← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →