Bringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics

Bringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics

Speakers: Junya Hiwatari, Digital Forensic Analyst, NTT Social Informatics Laboratories

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=WBLzk6-iVTg

Overview

Digital forensics and incident response (DFIR) are critical yet often time-consuming processes, particularly when dealing with the vast amounts of log and artifact data generated in modern IT environments. A significant challenge lies in distinguishing legitimate, everyday system activities from malicious attack sequences, leading to an overwhelming number of false positives that analysts must manually review. Junya Hiwatari, a Digital Forensic Analyst at NTT Social Informatics Laboratories in Japan, presented an innovative approach at FIRSTCON designed to streamline this process by injecting chronological context into detection rules.

Hiwatari's talk introduced Ordered Sigma, an extension to the popular Sigma rule format that allows for the definition of sequential event patterns and crucial cross-artifact searches. Complementing this, he unveiled Attack Flow Finder (AFF), a powerful extension for Google's TimeSketch platform, which automates the application of Ordered Sigma rules to forensic timelines. This methodology drastically reduces false positives, accelerates the identification of pivot points in an investigation, and effectively halves the time required for initial incident response, offering a significant leap forward in the efficiency and accuracy of digital forensic investigations.

Background

▶ Watch: Understanding the "pivot point" in investigations (3:00)

In the aftermath of a cyberattack, executives and incident responders seek answers to the "five W's and one H" (Who, What, When, Where, Why, How) to contain, eradicate, recover from, and disclose the incident. Identifying when and where an incident occurred is paramount for immediate containment, while understanding the who, what, why, and how is crucial for recovery and public disclosure. However, investigators face the daunting task of sifting through immense volumes of data, making the identification of an effective pivot point – a starting clue from which to reconstruct the attack flow – an essential first step.

Consider a common scenario: file exfiltration via a web browser. An attacker might first copy sensitive files to a temporary location, then compress and encrypt them, and finally upload them through a browser to cloud storage. If an investigator discovers evidence of the folder being compressed, this compression event becomes a pivot point. From here, the investigator must search backward in time for evidence of the initial file collection and forward for traces of data exfiltration. Manually reconstructing such a sequence across disparate logs and artifacts is complex and laborious.

Sigma rules have emerged as a powerful framework to describe detection logic for log data in a platform-independent manner. In DFIR, Sigma rules help analysts quickly identify events potentially related to security incidents. A Sigma rule specifies metadata (e.g., title, description) and, crucially, detection logic, including log sources (e.g., event ID, search keyword). While highly effective for individual event detection, standard Sigma rules present a critical limitation: each trace, when detected in isolation, can be common in legitimate everyday activities. For instance, a file being copied, an archive utility running, or a browser accessing cloud storage are all routine operations. Relying on individual Sigma detections thus leads to a large number of false positives, rendering manual review prohibitively time-consuming and slowing down the investigation significantly. The absence of built-in capabilities to define a temporal order across multiple, potentially disparate, log sources further complicates the reconstruction of complex attack chains.

Key Findings

▶ Watch: Introducing Ordered Sigma for temporal event sequences (6:00)

The core problem addressed by Junya Hiwatari's research is the inherent inefficiency and high false positive rate associated with applying standard Sigma rules in isolation for digital forensics. While individual Sigma rules are excellent for detecting specific events, they often fail to provide the necessary chronological context or the ability to correlate events across different log sources, which is vital for reconstructing a complete attack flow. This leads to analysts spending excessive time sifting through irrelevant detections.

Hiwatari's primary contribution is the introduction of Ordered Sigma, an innovative extension that fundamentally transforms how detection rules are applied in forensic investigations. Ordered Sigma addresses the limitations of standard Sigma by enabling investigators to:

1. Define the sequence of events: Instead of searching for individual events, Ordered Sigma allows specifying a precise order in which events are expected to occur, directly incorporating temporal context into the detection logic.
2. Perform cross-artifact OR searches: This is a critical feature optimized for digital forensics. Unlike standard Sigma, which typically limits OR logic to within the same log source, Ordered Sigma facilitates searches for evidence across multiple, distinct forensic artifacts (e.g., checking the Master File Table or the USN Journal for file creation). This capability is crucial because attackers can delete or modify artifacts, meaning evidence might only remain in one of several possible locations.

The practical application of Ordered Sigma is realized through Attack Flow Finder (AFF), a tool implemented as an extension of Google's TimeSketch platform. AFF automates the signature matching process based on Ordered Sigma files, processing collected forensic data and presenting a consolidated, visually highlighted timeline of events that match the defined attack flow. The key findings demonstrate that AFF significantly:

• Reduces False Positives: In various simulated attack scenarios, Ordered Sigma successfully detected only the single log sequence directly related to the incident, effectively eliminating all false positives generated by individual Sigma rules. This was particularly evident in the file exfiltration scenario, where a "large number" of false positives were reduced to a single, accurate detection.
• Accelerates Investigations: By providing a clear, chronologically ordered view of malicious activity, AFF allows forensic investigators to quickly identify compromised machines and crucial pivot points. Performance evaluations showed that processing and signature matching could be completed rapidly, enabling faster triage and detailed analysis.
• Enhances Collaboration and Triage: AFF's integration with TimeSketch, a collaborative platform, combined with its ability to quickly identify attack flows, empowers even less experienced incident responders in group companies to perform initial triage, dramatically shortening the overall incident response timeline.

Technical Deep Dive

▶ Watch: Attack Flow Finder (AFF) demonstration and workflow (15:00)

The technical core of Hiwatari's presentation revolves around the Ordered Sigma format and its implementation within Attack Flow Finder (AFF). The approach is designed to overcome the inherent limitations of standard Sigma rules in a forensic context, primarily the generation of high false positives and the inability to correlate events across disparate forensic artifacts in a chronological manner.

Standard Sigma rules are powerful for defining individual event detections. However, their log source field typically allows only a single source, meaning OR conditions are confined to events within that same log source. This restriction makes it challenging to model complex attack chains that leave traces across various system components, such as file system metadata, registry hives, network logs, and browser history.

Ordered Sigma introduces a YAML-based structure that extends Sigma's capabilities by adding explicit fields for sequence definition and cross-artifact correlation. For each referenced Sigma rule, Ordered Sigma defines four key fields:

1. serial number: A unique identifier assigned to each step in the defined sequence.
2. order: This field dictates the temporal sequence of events. If multiple items share the same order value, their appearance order can be interchangeable. If the field is left blank, the event can appear at any point in the sequence relative to other events.
3. or: This crucial field enables cross-artifact OR searches. By assigning the same value to multiple items, investigators can specify that evidence for a particular event stage can be found in any of the referenced artifacts. This is a significant departure from standard Sigma and is highly optimized for digital forensics, where artifacts may be deleted, modified, or simply not present in all expected locations.
4. phase: A free-text field for describing the stage or purpose of the event.
5. sigma_yaml: Specifies the path to the individual standard Sigma rule YAML file used for detecting the actual log entry.

To illustrate, Hiwatari provided a detailed example of reconstructing a file exfiltration attack. This activity typically involves several stages:

• Stage 1: File Copying: An attacker copies target files.
• Forensic Record: A new file was created.
• Artifacts: Evidence could exist in the Master File Table (MFT), the USN Journal, or the User Assist registry hive. Ordered Sigma would define an or condition across these artifacts, meaning the detection succeeds if the file creation is found in any of them.
• Stage 2: Compression: The copied files are compressed (e.g., into a ZIP archive).
• Forensic Record: An archival executable (e.g., winzip.exe, 7z.exe) was run.
• Artifacts: Proof of execution can often be found in Prefetch files.
• Stage 3: Exfiltration: The compressed file is uploaded via a web browser to cloud storage.
• Forensic Record: Browser access to a cloud storage service occurred, and an outbound network connection was made.
• Artifacts: Browser history and Sysmon logs (for outbound connections). For browser history, the order field might be left blank, as browser access could occur before or during the file copy operation in some scenarios.

This detailed breakdown demonstrates how Ordered Sigma allows investigators to map an attack chain to specific forensic records and then define an OR condition across multiple potential artifacts for each record, all while maintaining a strict or flexible temporal order.

Attack Flow Finder (AFF) is implemented as an extension of TimeSketch, Google's free, collaborative timeline analysis platform. TimeSketch provides a user-friendly graphical interface, fast query execution, and a rich set of APIs for integrating Sigma rules. The workflow with AFF is as follows:

1. Data Collection: Forensic data is collected from the target endpoint using tools like KAPE, CDIR, or by creating disk images and extracting artifacts with tools like X-Ways or EnCase.
2. Data Parsing and Upload: The collected data is parsed (e.g., using log2timeline, which is automatically invoked by AFF) and uploaded to TimeSketch, where it is consolidated into a single super timeline. This process typically takes about 5 minutes for a standard Windows machine.
3. Signature Matching: AFF then performs signature matching against this super timeline using the defined Ordered Sigma file. This matching process is remarkably fast, completing in approximately 10 to 20 seconds per endpoint.
4. Results Visualization: AFF highlights only the rows in the TimeSketch timeline that match the Ordered Sigma conditions, and it also generates a new, filtered timeline containing only the detected events. This visual highlighting helps forensic investigators quickly focus on relevant events, eliminating the noise of false positives.

While the talk skipped over the underlying mathematical concepts, Hiwatari mentioned that the detailed design of AFF includes techniques such as the Longest Common Subsequence (LCS), which are crucial for efficiently identifying ordered patterns within a timeline.

Demo / Proof of Concept

▶ Watch: Halving incident response time with Ordered Sigma (26:00)

Junya Hiwatari provided a compelling video demonstration of Attack Flow Finder (AFF) in action, showcasing its capability to process forensic data, apply Ordered Sigma rules, and visualize attack flows within TimeSketch. The demo environment comprised an Ubuntu system running AFF, processing log data collected from a Windows machine. This data included standard Windows event logs (.evtx files) and other artifacts collected using tools like KAPE.

For the demonstration, an Ordered Sigma YAML file for WannaCry ransomware was used, containing seven distinct Sigma rules chained together to represent the attack's progression. The process unfolded in several key steps:

1. Data Import: The demonstration began by executing a command to parse the collected log data and import it into TimeSketch. AFF automatically invoked parsing tools like log2timeline in the background. While this step was accelerated in the demo, it typically takes around five minutes for a standard Windows endpoint.
2. Timeline Creation: Once imported, the parsed data was visible in the TimeSketch web interface as a single, consolidated super timeline, bringing together events from various log sources into a chronological view.
3. Signature Matching: Next, a command was executed to initiate signature matching based on the WannaCry Ordered Sigma file. This process was remarkably quick, completing in approximately 10 seconds.
4. Results Visualization: The power of AFF became evident in the results:

• A new timeline was automatically created within TimeSketch, containing only the logs that precisely matched the defined sequence in the Ordered Sigma rule. In the demo, this resulted in a "five items timeline" being added, representing the detected WannaCry attack flow.
• Crucially, by narrowing the time range in the overall super timeline, only the logs detected by Ordered Sigma were highlighted, allowing investigators to visually focus on the relevant events within the broader context of system activity.

Hiwatari then presented performance evaluation results across four incident scenarios: ransomware infection, remote access, file exfiltration, and Active Directory credential theft (using Mimikatz, referred to as "lubels" in the transcript). In all scenarios, Ordered Sigma demonstrated exceptional accuracy:

• It successfully detected only the single log sequence that was actually related to the incident.
• It eliminated all false positives that would have been generated by applying individual Sigma rules without temporal ordering.

The file exfiltration scenario was highlighted as particularly impactful. This type of attack involves many common individual events (file copying, compression, browser access) that typically lead to a "large number of false positives" with standard Sigma rules. However, when the temporal order and cross-artifact correlation defined by Ordered Sigma were applied, the system accurately identified the specific malicious sequence, effectively ignoring all irrelevant background activity. Hiwatari noted that these test datasets were created specifically for the experiment and contained fewer background activities than a real-world incident. Therefore, AFF and Ordered Sigma are expected to deliver even more significant performance improvements and false positive reductions in live environments.

Defensive Implications

▶ Watch: Future: AI for automated investigation report generation (28:00)

The implications of Ordered Sigma and Attack Flow Finder (AFF) for defensive security operations are profound, offering a substantial leap in the efficiency and effectiveness of digital forensics and incident response.

Firstly, the most immediate and impactful benefit is the drastic reduction in false positives. By incorporating chronological context and enabling cross-artifact OR searches, Ordered Sigma transforms noisy, individual event detections into precise, high-fidelity alerts that represent actual attack flows. As demonstrated in the file exfiltration scenario, this capability can reduce "a large number" of false positives to a single, accurate detection. This frees up valuable analyst time, allowing them to focus on true threats rather than sifting through irrelevant logs, thereby accelerating the identification of compromised systems and key pivot points.

Secondly, AFF significantly accelerates incident response triage and investigation. NTT's experience, as a central CERT for a large group of companies, highlights this. Many group companies lack dedicated forensic teams, leading to delays as compromised endpoints are shipped to NTT for analysis. By deploying AFF in these group companies and providing them with appropriate Ordered Sigma rules, they can mechanically perform initial triage and basic investigations on affected endpoints. This enables a much faster initial response, with only those devices truly requiring deep forensic investigation being sent to NTT. A real-world trial simulating an incident response showed a remarkable 50% reduction in initial response time, from 11 hours to just 5.5 hours, for a single compromised endpoint. This time-saving effect is expected to be even greater in incidents involving multiple endpoints.

Hiwatari also contextualized AFF by comparing it to existing tools:

• Hayabusa: While incredibly fast for performing Sigma-based signature matching on Windows event logs, Hayabusa is limited to a single log source type. It excels at rapid event log analysis but falls short in deep forensics scenarios that require correlating events across different artifacts or understanding the temporal order of diverse activities. AFF and Hayabusa are complementary, used for different purposes based on the depth and scope of investigation required.
• Official Sigma Project (Temporal Order): The official Sigma project has introduced a "temporal order" grammar rule that considers event sequences. However, this feature lacks support for cross-artifact OR searches, which is critical for robust forensic investigations where evidence might be scattered or partially deleted. Furthermore, the temporal order feature currently has limited backend support and cannot be converted into usable queries for platforms like TimeSketch, whereas Ordered Sigma is specifically designed to integrate seamlessly with TimeSketch.

Looking ahead, NTT plans to release AFF as open-source software, which will allow the broader security community to leverage and contribute to this innovative tool, fostering wider adoption and further development. Another exciting future direction is the integration of AI with AFF. The output of AFF, which includes crucial information such as MITRE ATT&CK IDs, can be fed into AI systems. This allows AI to understand the progression of an attack and automatically generate draft investigation reports, further automating the DFIR workflow and providing immediate, actionable intelligence to stakeholders.

Key Takeaways

• Standard Sigma Limitations: Traditional Sigma rules, while powerful for individual event detection, often lead to excessive false positives and struggle to provide crucial chronological context across disparate forensic artifacts, hindering efficient attack flow reconstruction.
• Ordered Sigma for Contextual Detection: The introduction of Ordered Sigma enables the definition of specific event sequences and, critically, supports cross-artifact OR searches. This significantly enhances detection accuracy by correlating events across various log sources and artifacts, even if some evidence is missing.
• Attack Flow Finder (AFF) for Automation: Attack Flow Finder (AFF) is an open-source-bound TimeSketch extension that automates the application of Ordered Sigma rules. It processes collected forensic data, builds a super timeline, and visually highlights only the events that match the defined attack sequences, effectively cutting through investigative noise.
• Dramatic False Positive Reduction & Time Savings: AFF demonstrably reduces false positives to near zero in test scenarios, allowing investigators to focus solely on relevant events. This leads to significant time savings, with initial incident response times observed to be halved (e.g., from 11 hours to 5.5 hours) in simulated environments.
• Empowering Triage and Collaboration: The methodology empowers organizations, particularly those with limited dedicated forensic teams, to perform effective initial triage and accelerate incident response by leveraging readily deployable, high-fidelity detection rules.
• Future-Proofing with AI: Future plans include open-sourcing AFF and integrating it with AI systems to automatically generate investigation reports based on detected attack flows and MITRE ATT&CK IDs, further streamlining the DFIR process.

About the Speaker(s)

Junya Hiwatari is a Digital Forensic Analyst at NTT Social Informatics Laboratories in Japan. Within the vast NTT group, which comprises over 950 companies, NTT's CERT (Computer Emergency Response Team) serves as the central security hub. Hiwatari's recent work focuses on the cutting-edge application of AI and large language models to automate various aspects of digital forensics and incident response, striving to make these complex processes more efficient and accessible. His presentation at FIRSTCON reflects his commitment to innovating within the DFIR space, particularly in addressing the challenges of data volume and false positives.