DFIR Group Project · Case File

Catching an Intruder Three Ways

Multi-Source Detection & Forensic Reconstruction of a Simulated Windows 11 Intrusion Using Open-Source Tooling

  • Endpoint Logs
  • Disk Artifacts
  • Physical Memory

One attack, three independent lenses — and no single source saw all of it.

Course
Digital Forensics (CSE_3135) × Incident Response & Threat Intelligence (CSE_3136) — MIT Bengaluru
Team
Lavanya Sharma · Ayushi · Mansi Sharma · Alina Noorain

01 Overview

The research question

Incident responders rarely get the whole story. They reconstruct an attack from fragments: an event log here, a prefetch file there, maybe a memory image if they were quick. Every source is incomplete in its own way. We wanted to measure how incomplete, by running a known attack and checking what each lens could recover.

When a known set of attacker techniques is executed, how much can be detected and forensically reconstructed from each evidence source — and where does each one succeed or fail?

  • 11ATT&CK techniques attempted
  • 7ran with full success
  • 8/8executed techniques detected
  • 297/297evidence files hash-verified

02 Methodology & Safety

A five-step pipeline

  1. Isolate

    Windows 11 25H2 VM on VMware, host-only networking.

  2. Instrument

    Sysmon + PowerShell script-block logging.

  3. Attack

    11 ATT&CK techniques via Atomic Red Team.

  4. Acquire

    Memory, logs, prefetch, registry, all SHA-256 hashed.

  5. Analyse ×3

    Detection, Disk and Memory tracks, run independently.

Chain of custody 297/297 evidence files re-hashed — 0 mismatches

03 Tools

Open-source, and chosen for a reason

ToolRoleWhy this oneAlternative considered
VMware WorkstationRuns the isolated victim VMHost had Hyper-V active; VMware cooperates where VirtualBox crawlsVirtualBox (slow under Hyper-V)
SysmonRich endpoint telemetryFull command lines, parent, hashes — beyond default logsDefault Windows auditing
Atomic Red TeamSafe adversary emulationOne ready test per ATT&CK technique; no real malwareCaldera / manual exploitation
Hayabusa + ChainsawDetection over logs~4,500 Sigma rules applied offline in seconds; no SIEM to deployFull Wazuh/Splunk SIEM
Prefetch + Registry (Eric Zimmerman tools)Disk forensicsDurable execution & persistence proof that survives reboots—
Volatility 3Memory forensicsStandard open-source memory frameworkWinPMEM / vmss2core (acquisition)

04 The Attack

Eleven techniques, three outcomes

IDTechniqueTacticResult
T1059.001PowerShell Command ExecutionExecutionOK
T1053.005Scheduled Task (persistence)PersistenceOK
T1547.001Registry Run Key (persistence)PersistenceOK
T1112Modify RegistryDefense EvasionOK
T1016Network Config DiscoveryDiscoveryOK
T1082System Information DiscoveryDiscoveryOK
T1057Process Discovery (tasklist)DiscoveryOK
T1033System Owner/User DiscoveryDiscoveryPartial
T1047WMI ReconnaissanceDiscoveryFailed wmic removed in Win11 25H2
T1070.004File Deletion—Skipped no Windows atomic
T1057 (test 1)Process Discovery—Skipped no Windows atomic

Note: T1047 and the WMIC part of T1033 both failed because Microsoft removed wmic in Windows 11 25H2. Attacker tooling has to keep up with OS changes too.

05 The Coverage Matrix

Who saw what

Each of the 8 executed techniques, checked against each evidence source. Hover, focus or tap a cell for the detail.

Technique Detection logs Prefetch Registry Memory
T1059.001 PowerShell
T1053.005 Scheduled task
T1547.001 Run key
T1112 Modify registry
T1016 Net discovery
T1082 System info
T1057 tasklist
T1033 Owner/user (partial)
  • Detected / recovered
  • Detected with a caveat
  • Not present
  • Not applicable (benign default)

Every executed technique was recovered by at least two independent sources, and 7 of 8 by both logs and prefetch. Memory alone caught nothing.

06 Results

Three tracks

Track 1 · Detection over logs

  • 10,277events processed by Hayabusa
  • 5,608rule hits (~50% data reduction)
  • 8/8executed techniques detected
  • 2custom Sigma rules written

Hayabusa ran the Sigma corpus offline over the Sysmon and PowerShell logs. Chainsaw independently confirmed the results. All 8 executed techniques fired at least one rule. Two of them came with caveats:

  • T1057 missed by default rules. The tasklist discovery wasn't flagged by the stock corpus. We only caught it with threat-hunting and a custom Sigma rule.
  • T1112 mis-tagged as T1137. The detection fired, but under the wrong ATT&CK ID. A defender triaging by ID would attribute it to the wrong technique.
Fig. T1-a Hayabusa results summary — 10,277 events, 5,608 detections
Fig. T1-b Full Hayabusa run with severity breakdown and top alerts
Fig. T1-c Custom Sigma rules firing on T1057 (tasklist) and T1112 (reg add)

Track 2 · Disk artifacts

  • 0–4 sprefetch offset from ground truth
  • 7 dayspersistence still live afterwards
  • 0WMIC.EXE prefetch entries
  • Prefetch timed every technique. It placed each technique's binaries within 0–4 seconds of ground truth. arp, netsh, nbtstat, systeminfo and tasklist each ran exactly once, so those runs can only be the attack.
  • Negative evidence. There is no WMIC.EXE prefetch at all. The absence independently confirms that the WMI techniques failed.
  • Persistence outlived the attack. Seven days later, an HKCU Run value named Atomic Red Team and two scheduled tasks (OnLogon / OnStartup, action cmd.exe /c calc.exe) were all still live.
  • T1112 left no registry trace. It rewrote a value to its existing default, so only Prefetch can prove it ran.
Fig. T2-a Attack binaries in Prefetch, each within 0–4 s of ground truth. Zero WMIC.EXE files.
Fig. T2-b Two scheduled tasks in TaskCache, still live 7 days later
Fig. T2-c HKCU Run value “Atomic Red Team”
Fig. T2-d HideFileExt is still at its default, and the key's LastWrite predates the attack, so the registry holds no trace

Track 3 · Physical memory

07 Errors We Solved

What broke, and what we did

  • ProblemHyper-V blocked VirtualBox

    FixSwitched to VMware Workstation.

  • ProblemWindows 11 refused to install (4 GB RAM / 52 GB disk minimums)

    FixResized the VM to 4 GB / 60 GB.

  • ProblemDefender blocked our PowerShell (Tamper Protection, 0xc0000142)

    FixDisabled real-time protection and added an exclusion via the Security GUI.

  • ProblemWindows updated mid-setup

    FixRe-verified timezone, Sysmon and Defender state before attacking.

  • ProblemWinPMEM driver blocked (0x241)

    FixFell back to a VMware suspend image and documented it.

  • ProblemVolatility couldn't parse the suspend image

    FixReported it as a modern-OS acquisition finding.

08 Team & Learnings

Who did what, and what we learned

  • Lavanya Sharma

    Lab build, instrumentation, attack execution, evidence acquisition, memory track & integration

  • Ayushi

    Detection: Hayabusa, Chainsaw, custom Sigma

  • Mansi Sharma

    Disk forensics: prefetch & registry, Autopsy validation

  • Alina Noorain

    Memory track (initial)

  1. No single source is complete.
  2. A detection that fires is not necessarily a correct detection.
  3. Persistence lives on disk long after an attack; memory is fleeting.
  4. On a hardened OS, acquisition is the hard part.
  5. Upfront instrumentation decides what evidence exists at all.
  6. Documenting failures honestly makes the work stronger.