Hello Reader,
If you followed the original Crowdstrike post or the follow on post from LMG security calling the Activities API a 'unicorn' of sorts then I'm sorry to say the technique now appears to no longer be functional. It's been a long time since I've seen the DFIR community be this obsessed with a single artifact but either Microsoft is closing this for good or is going to replace this with maybe default mailbox audit logging in the future.
To be clear this isn't the first or only evidence source that a company has retained as a secret. I'm not in the business of airing companies internal choices but I will point this out to put this in a larger context. DFIR is made up of two niche industries, Digital Forensics and Incident Response. There are differences between these two fields of work and while they may rely on each other to function those on the DF side need to document their new research in reports and disclose them to allow another party to verify and respond to their work. There are normally two or more experts from different companies working on every case.
Compare this to the very competitive Incident Response world where a company can get a substantial competitive advantage by finding a new evidence source. If one IR company can tell a client they can find evidence another can't they might win more business while if a DF expert tells a client they can find evidence no one else can it might not be admissible unless they can explain how to do it to the other side. There are many IR companies right now sitting on undisclosed evidence sources and threat intelligence sources. They will continue to do so until they are required not to.
The point? In this case the public disclosure of an evidence source has ended its use by all parties. Whether this was because
If I was arguing to disclose a secret evidence source within my company I'm pretty sure I just lost that argument to those who worry it would stop working after disclosure.
To be clear this isn't the first or only evidence source that a company has retained as a secret. I'm not in the business of airing companies internal choices but I will point this out to put this in a larger context. DFIR is made up of two niche industries, Digital Forensics and Incident Response. There are differences between these two fields of work and while they may rely on each other to function those on the DF side need to document their new research in reports and disclose them to allow another party to verify and respond to their work. There are normally two or more experts from different companies working on every case.
Compare this to the very competitive Incident Response world where a company can get a substantial competitive advantage by finding a new evidence source. If one IR company can tell a client they can find evidence another can't they might win more business while if a DF expert tells a client they can find evidence no one else can it might not be admissible unless they can explain how to do it to the other side. There are many IR companies right now sitting on undisclosed evidence sources and threat intelligence sources. They will continue to do so until they are required not to.
The point? In this case the public disclosure of an evidence source has ended its use by all parties. Whether this was because
- it wasn't supposed to be used for these purposes
- too many people began taxing the use of the API
- the powers that be at Microsoft were worried about people misinterpreting the results of the API
- or just a large company not enjoying being called unethical for people using an API that was documented but had a use that most within the company were not aware of
If I was arguing to disclose a secret evidence source within my company I'm pretty sure I just lost that argument to those who worry it would stop working after disclosure.
Also Read: Daily Blog #414
Post a Comment