Detection & Analysis
verified, reproducible triage.
Retrieval proposes, deterministic matchers dispose, the agent decides, the vault remembers — with chain-of-custody the whole way.
- 4 / 6
- Reproduced exactly
- 2
- Partial
- 0
- Refuted
- < 5 min
- Verify one number (347)
The lane we own.
We are deliberate about what we deliver versus what we inform. Preparation is the moat; Detection & Analysis is the primary deliverable; Containment and Eradication get cited targets, not actions; Recovery is out of scope.
Preparation
OWNThe moat — the vault, governance, and the matcher engine that make every finding defensible.
Detection & Analysis
OWNThe primary deliverable — verified, reproducible triage of the compromise.
Containment
INFORMWe hand off prioritized, evidence-cited targets — not actions.
Eradication
INFORMSame hand-off: cited targets for the responder to action.
Recovery
OUTOut of scope — we supply the known-good hash baseline for clean-state checks.
The integrity gate, before analysis.
This is the bridge acquisition omits: prove the evidence is intact before drawing a single conclusion from it. Two checks run first, and both must pass.
sha256sum -c4 / 4 OKAll four SRL-2015 evidence ZIPs verify against their recorded digests before any analysis runs (runs/run-02.out).
clean-manifest SHA256 == IOC outer-ZIP anchors4 / 4 MATCHThe clean-manifest hashes anchor exactly to the IOC outer-ZIP — the integrity gate that makes every downstream finding defensible.
Expected, then actual.
Each checkpoint pairs the scout's expectation against the verified result, with a fidelity meter. Four reproduce exactly; two are honest partials with named pending items — nothing inflated.
Integrity
Evidence ZIPs intact; clean-manifest hashes anchor to the IOC outer-ZIP.
sha256sum -c => 4/4 SRL-2015 ZIPs OK; clean-manifest SHA256 == IOC outer-ZIP anchors (4/4 MATCH).
Temp executables
Dropped temp executables (a.exe / pkxezy1tji98.exe) and masqueraded dllhost/svchost present.
a.exe nromanoff 104 / tdungan 23; pkxezy1tji98.exe 6 (timeline); masqueraded dllhost/svchost present in Redline. Clean XP hash catalog shows 0 — expected.
Memory API hooks
API-hook stealth resident in memory across both hosts.
nromanoff 347 (WININET 135 / USER32 90 / ntdll 62 / WS2_32 45); tdungan 6 (IAT 3 / Inline 3).
Timeline windows
Execution windows bracket the temp-exec activity.
nromanoff A.EXE 104 (04/03/2012 23:54:46 -> 04/05/2012 05:19:11); tdungan A.EXE 23, PKXEZY 6 (source tz literal "UCT").
Cross-host masquerade
dllhost\svchost.exe masquerade confirmed on both hosts.
tdungan Processes/UniqueProcesses PID 3296 = c:\windows\system32\dllhost\svchost.exe CONFIRMED; nromanoff PID 6404 PENDING (.mans not yet extracted). Cross-host dllhost+svchost timeline lines 12 / 16.
Persistence
Service-install + Run/RunOnce persistence on both hosts.
nromanoff winsvchost EventID 7045 service-install CONFIRMED; tdungan Run/RunOnce keys present, exact value match PENDING.
The chain no single tool sees.
No one artifact proves the intrusion. Stitched left to right — temp execution, masqueraded service binaries, persistence, in-memory stealth, repeated across both hosts — the chain is what makes the verdict hold.
- 01plaso timeline
Temp exec
a.exe / pkxezy1tji98.exe - 02Redline .mans
Masqueraded svchost
dllhost\svchost.exe - 03event log + registry
Persistence
winsvchost 7045 / Run-key - 04Volatility apihooks
API-hook stealth
347 hooks - 05both hosts
Cross-host repetition
nromanoff + tdungan
What makes the findings defensible.
The preparation layer is the moat: a retrieval vault, governance encoded as policy, and a deterministic matcher engine. Together they let the agent propose fast and prove slow.
The vault as RAG knowledge base
A layered evidence store (00–04 layers) the agent retrieves from to form hypotheses.
Governance as policy-as-code
Raw evidence is un-writable, every action lands in a chain-of-custody log, and a casenote heartbeat proves liveness.
The matcher engine
One engine driving 30 deterministic parsers — the dispose half of propose/dispose.
The agent re-derives every IOC from raw evidence before believing it — retrieval only proposes, the agent proves.
Reproduce 347 in under five minutes.
Run the gold path to regenerate the number, or grep the recorded run output and IOC signatures for a static check that needs no execution. Paths are absolute — a relative path is the one known failure mode.
python3 /home/sansforensics/Documents/SIFTVault/01-SKILLS/memory/scripts/mem_05_apihook_aggregate_crosshost.py
# expect: nromanoff total_hooks=347 (WININET 135 / USER32 90 / ntdll 62 / WS2_32 45); tdungan 6grep total_hooks=347 /home/sansforensics/Documents/SIFTVault/00-TRIAGE/analysis/SRL2015-REPLAY-TEST-01/runs/mem_05.out
grep 347 /home/sansforensics/Documents/SIFTVault/03-INTELLIGENCE/ioc-signatures/apt15-srl-ioc-signatures.mdPrioritized targets, evidence-cited.
We do not contain or eradicate — we hand the responder a ranked, cited target list so action stays with the operator who owns the box.
c:\windows\system32\dllhost\svchost.exe (PID 3296)INFORMwinsvchost service (EventID 7045)INFORMRun / RunOnce keysINFORMa.exe / pkxezy1tji98.exe + windowsINFORMRecovery is explicitly out of scope — we supply the known-good hash baseline (WinXPSP3x86.txt) for clean-state checks.
What we have not closed yet.
Stated plainly, no inflation. These are the open edges of the current run.
C5 nromanoff 6404 + C6 tdungan Run-key value PENDING.
mactime-format CSVs return no first/last (l2tcsv only).
dllhost/svchost uses loose co-occurrence (counts run slightly high vs strict path; windows still align).
.mans numeric-PID substring match is noisy (authoritative hits are in Processes/UniqueProcesses).