Bringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics

on YouTube ↗31m

" summary

A tool called Attack Flow Finder (AFF) uses an explicit Ordered-Sigma rule file to require event sequences across disparate artifacts (MFT, USN, Browser history, EVTX) rather than single-rule hits, reducing false positives to essentially zero in four test scenarios. AFF runs as a TimeSketch extension, ingesting CAPE or X-Ways extractions and completing signature matching in about TimeSketch 10–20 minutes per endpoint (demo showed a quick 10s run), and halved triage time from 11 to 5.5 hours in a group trial.

AI-written summary · about

" chapters (14)

1. 0:00Introduction
2. 1:03Digital forensics fundamentals
3. 3:51Pivot points in investigations
4. 5:38Sigma rules limitations
5. 6:44Ordered Sigma approach
6. 8:53Creating Ordered Sigma files
7. 12:43Attack Flow Finder tool
8. 15:31Live demo setup
9. 17:50Signature matching with AFF
10. 20:05AFF performance evaluation
11. 22:57AFF versus existing tools
12. 25:06Incident response timesaving
13. 27:57Future directions
14. 29:04Q&A

" related talks

• 46mDigital Forensics – The Importance of Forensic Triage ImagesRyan Irving · BSides Tampa 2024
• 31mDiamonds are a Forensicator's Best Friend - Intelligence Support for DFIRKamil Bojarski · FIRST Cyber Threat Intelligence Symposium 2022
• 33mSpeed is key: Leveraging the Cloud for Forensic Artifact Collection & ProcessingLukas Klein, Christian Koepp · 34th Annual FIRST Conference 2022
• 34mAttack Flow - Beyond Atomic BehaviorsGabriel Bassett, Ryusuke Masuoka, Desiree Beck · 34th Annual FIRST Conference 2022
• 14mDFIR - Don't Forget Your Roots!Sabastian Hague · BSides London 2021
• 28mLets Make Needles Glow in TimesketchThomas Chopitea, Alexander Jäger · FIRST Cyber Threat Intelligence Symposium 2022
• 10mLightning Talk: Challenges in Cloud Native ForensicsAndrew J Krug · Cloud Native Security Day Europe 2021
• 27mCollect All the Data; Protect All the ThingsAaron Rosenmund · BSidesSF 2019