Our final section deals with file and object obfuscation.
I'm sure at this point you're asking yourself, Ashley, what does this even mean?
This is essentially the act of covering your tracks.
This can occur by changing file extensions,
hiding data inside of other data, encrypting or packing malware,
and many other methods employed today.
So why exactly do we care about being able to identify this?
One of the most infamous attacks in 2020 was perhaps the SolarWinds compromise.
The attackers in that case compromised the supply chain,
and their malware used multiple obfuscation layers and block lists to identify
forensic and antivirus tools in order to evade detection.
Forensicators, in that case, and in many other cases just like it,
heavily relied on the ability to positively identify this
activity so that they could quickly respond,
contain, and mitigate the attack.
The SolarWinds attack was incredibly difficult to detect due
to the sophistication of the attackers.
In this course,
we're going to be doing a deep dive into attacker defense evasion tactics,
specifically focusing on those that may attempt to obfuscate
files or information in order to evade detection.
This is commonly referred to as steganography.
But we'll break down exactly what that means and how
to detect it in just a moment.
Our last demo here is how to identify obfuscated
objects and files within Autopsy.
We're going to take a look at how to identify and
detect evidence of steganography.
So, what exactly does this mean?
Steganography is the practice of concealing messages and
information within other objects or data.
Sometimes,
this is as simple as changing a .exe extension to
appear as a harmless text file.
However, this can quickly become quite complex with more advanced malware.
This demo deals primarily with logical evidence files,
how to add them to cases, extract content from them,
and most importantly, how to identify those hidden artifacts.
Remember this evidence file from earlier, the Example_Image.EO11 file.
Depending on how much processing power your workstation
has and how large the evidence file is,
it may take some time for Autopsy to finish running
these modules we selected earlier.
We talked about sophisticated methods of obfuscation
and a little bit about steganography,
but one of the most common ways I've seen attackers avoid detection
in a network is simply by changing file extensions on malicious
payloads to something a bit more benign,
like a .docx or .txt.
Autopsy actually has a really useful module for detecting
this called Extension Mismatched Detection,
which we ran earlier.
If you navigate over to the left‑hand side of the screen here,
you'll actually see this listed under the Analysis Results there.
And we've actually detected an extension mismatch
here on this autopsy.docx file.
So if you take a look at this DOC file,
we see that it's actually an image contained within here.
Looks like it's a little logo of the Autopsy dog.
And if we dive down a little deeper into the hex code,
we can see that those first couple bytes of data actually label it as a PNG.
Now this is referred to as the magic number of a file,
and this right here,
the fact that it is a PNG with those first couple bytes there,
is exactly why Autopsy flagged this under this module.