Detecting Cross-Network File Transfer via Extension Tampering
Company C identified a case in which an executable file was transferred into its internal network after its extension was changed to bypass file transfer controls. The file was later restored to its original executable extension and executed on the internal network.
The challenge was that file modification, cross-network file transfer, and internal execution were recorded as separate events. Individual logs alone could not provide a complete view of the activity or clearly identify the associated users and endpoints.
Correlating Activity To Establish Investigative Evidence
AhnLab EDR correlated file modification and execution activity with user and endpoint data, allowing Company C to identify the users and endpoints associated with the file and key timestamps related to its modification and use. This helped the security team narrow the investigation scope and define the users, endpoints, and files that required priority verification.
[Figure 1] Bypassing Cross-Network File Transfer Controls via File Extension Modification and Collecting Investigative Evidence with AhnLab EDR
Supporting On-Site Verification and Follow-Up Actions
Based on the investigation scope identified through AhnLab EDR, the security team conducted on-site checks of the relevant users and endpoints, verified the transferred file, and collected and preserved evidence.
The team then correlated the AhnLab EDR analysis records with evidence collected on site to determine whether internal policies had been violated and carried out follow-up actions in accordance with the company’s security policies.
By correlating previously fragmented records into a single activity timeline, AhnLab EDR provided visibility into the file transfer bypass path and helped Company C identify the users, endpoints, files, and timestamps involved.
[Figure 2] On-Site Response Benefits with AhnLab EDR
Download the full case study to see how AhnLab EDR reconstructed the activity timeline and supported investigation and response.
- AhnLab
