12. History¶

12.1. Ver 3.7.0 (Jun 30, 2023)¶

New Features
- Custom File Collection Sets: Users can specify additional files that Cyber Triage should collect
- Propagate score to other instances of an item:
  
  When a file is manually scored as bad, propagate the score to other hosts in the incident and future hosts.
  
  Manually scored items can be exported as JSON for threat intel sharing.
  
  Manually scored items can be imported as bad list items for threat intel sharing
  
  Users can chose to suppress propagation of items that were previously incorrectly scored
  
  Changed the “Other Occurrence Viewer” to differentiate exact match occurrences and fuzzy match.
- MITRE ATT&CK categorization is applied to automated analysis results.
  
  Items will have a link to the MITRE ATT&CK page
  
  HTML report will show which category an item belongs to
  
  JSON report can be generated to import into ATT&CK Navigator
- New TLS certificate verification:
  
  A new self-signed certificate is created for each installation.
  
  The Collection Tool now requires –cert_hash to be given when connecting to a server. The argument must either be the server certificate hash or ‘nohash’ to skip verification.
  
  Team Clients will prompt the user to confirm the server certificate when they first launch.
- Collect more artifacts:
  
  Collect possible ransomware notes by looking for files in common locations with the same name and size.
  
  Collect Sysmon, Powershell, and Windows Defender log files
  
  Collect public facing IP
  
  Expanded collection of downloaded files by looking for Zone.Identifier during full scan, always collecting its content, and also downloading Onenote files. Web artifacts are created from Zone.Identifier files.
  
  Make processes from Run/RunOnce events
  
  Parse LNK files on the Collection Tool and also collect the destination
- Scoring:
  
  Flag services if they are cmd or powershell
  
  Parse Microsoft-Windows-VHDMP-Operational.evtx and flag when ISO files are mounted
  
  Flag processes that could be dumping LSASS memory or running mshta or wscript
  
  Flag BITSJobs that use IPs
  
  Flag Run keys that use LNK files
  
  Flag LNK files not created on the local system
  
  Flag artifacts that reference admin file shares
  
  Made rescan more clear
- Added process column to logons table
- Expanded search to include Windows events
- Added ability to provide in-app feedback
Bug Fix
- Updated file explorer UI to better identify files that were inferred by Cyber Triage to previously exist.
- OS Accounts could sometimes have duplicates if they were not properly merged
Hash of Zip:
- SHA-256: 253fade3b94a51ff94750d168c0e6153661f1735e8204b136de17dd2b6c7bfa3

12.2. Ver 3.6.0 (Feb 20, 2023)¶

New Features
- Process view was redesigned:
  
  Includes artifacts from the Program Run view so that you can see current and past processes at the same time.
  
  New search and grouping interface to make it easier to focus on certain types of processes.
  
  Added a tree interface to allow users to navigate by hierarchy.
  
  The Execution History tab on the bottom was removed and the Process tab now shows all past processes.
  
  Added process tree diagram to bottom process tab.
  
  Changed how scoring was applied and now each process instance gets its own score. This will cause higher counts when a false positive happens, but it gives more control.
  
  Processes now store if they were running with elevated privileges.
- OS Accounts
  
  Accounts are now created for “non-existent” users, which are created from failed logons.
  
  Merged the concept of an “inferred” account with “unknown”. These accounts where a reference is found in a log, but it was not found in the registry, etc.
  
  Updated the filters in the “Account” view.
  
  Score accounts as suspicious if they were recently created and have admin privileges.
- User Logons
  
  Parse more 4648 events for outbound logon details.
  
  Collect log files (but not parse) from 3rd party remote logon applications. They are shown as “Source Files’’ in the Collection Details panel.
  
  Bottom inbound logon panel will now show country of remote host
- OS Configuration:
  
  Record log maximum sizes and rotation policy to detect if an attacker made them small to reduce evidence.
  
  Record Windows PE (MiniNT) registry setting.
- Add Host Options:
  
  Added the ability to import a local drive, which can be used when an image is locally mounted (for example if it was encrypted with BitLocker).
- Triggered Tasks:
  
  Services are now created based on event log data that shows a service was installed.
  
  Services that were recently created are scored as suspicious.
  
  PsExec service will be scored as suspicious.
- Downloads:
  
  Collect downloaded files from Temp folder based on Zone.Identifer ADS existence.
  
  Collect content of more downloaded file types (LNK, ISO, etc.) if created within the past 6 months.
  
  Recently downloaded ISO and LNK files are scored as suspicious.
- Search:
  
  Panel was updated to make its capabilities more obvious. Same functionality.
- New Reports:
  
  Export all files scored as bad as a ZIP file
  
  Export all file hashes as a text file
  
  Export all IP addresses as a text file
- Collection Details:
  
  Files that were searched for, but not found are now listed.
  
  Bitlocker detection is shown
- IP Addresses:
  
  Mark IPs as suspicious if they are frequently by attackers for data exfiltration (such as mega)
  
  Updated Dynamic DNS provider list
- Other:
  
  The Host Information panel will now show what drives the host had mounted
  
  Sources tab will show payload for Windows Events
  
  New evaluation panel with reduced options and allows users to import their own system
  
  Updated event log parser to use EVTX for disk images and logical file imports (https://github.com/omerbenamram/evtx)
Bug Fixes: Many bug fixes are included, but notable ones from customer support issues include:
- Very large NTFS folders are now detected and alerted versus exhausting memory.
- Logical folder ingest works with long folder names.
Hash of ZIP:
- SHA-256: 8ddb62c4961f6fc7600aaa114a31f013487b421aced725f814eb6eef7094dccc

12.3. Ver 3.5.0 (Nov 21, 2022)¶

New Features:
- New Collection Details panel
  
  New panel which quickly shows you high-level informaton about your incident.
  
  View all source files collected and the number of artifacts extracted from them.
  
  New “Export All” button allows you to export all collected source files in one click.
- Data Accessed artifacts are now merged
  
  Artifacts in this category are now merged if they come from the same event.
  
  You can still view each individual data source in the “Sources” tab within the File Info Panel.
  
  This change improves visual clarity when reviewing these artifacts.
- Updated Inbound and Outbound Logon Summary Panels
  
  New Logon Histogram graphic shows a visual overview of logon activity on the host.
  
  Updated widgets allow an examiner to see the dates and ranges of logons, without having to drill through the Logons Sessions tab.
- Accounts panel was updated with more filters to make it easier to focus on relevant accounts.
- Outbound Logons are created using data from Microsoft-Windows-TerminalServices-RDPClient/Operational log.
- Mini-timeline can be minimized to save UI space.
- Event log clearing is now scored based on existence of specific events.
- GPO files are collected.
- KAPE collections from Velociraptor are now supported (different naming conventions).
- Links to cybertriage.com pages now exist in the “Sources” Panel for some Data Accessed types.
- Files can be exported to a ZIP file with the “infected” password.
- Times now use ISO 8601 format (YYYY-MM-DD HH:MM:SS).
Bug Fixes:
- OpenSaveMRU artifacts no longer sometimes show the user’s home directory in the path.
- Google DNS is now used to resolve names and identify high flux domains.
- Logon merging algorithm is now more accurate.
- Recorded Future Sandbox results now display more data.
- LNK file path parsing is improved.
- Web artifacts show correct user when the user is admin.
- Common Programs Run items from AppData (such as Windows Defender and OneDrive) are no longer scored as suspicious.
- Program Run ‘File Content Available Only’ filter works in all scenarios.
- DNS Cache now reliably shows countries.
- HTML report columns no longer go off screen.
- Recommendation Engine now comes up when Logon Sessions are scored.
- Comments can be edited without causing an error.
- Badlist rescans can now be performed.
- Fixed an issue where the user showed as blank or unknown for a Logon Session when we only have the SID.
- Back Button will now go back to the Logon Sessions instead of the Logon Search panel.
Hash of ZIP:
- SHA-256: 2e92de8b9801c347c55a664a0ef384b99a0d3e05fcac74d094b36d6df9ebe2fa

12.4. Ver 3.4.0 (Sep 26, 2022)¶

New Features:
- Major update to logon sessions
  
  New database schema that makes it possible to merge logon data from multple hosts and track logoff times.
  
  Separate Inbound and Outbound Logon Session UIs to make it easier to focus on user activity versus lateral movement.
  
  New UI concept with summary panels and search interfaces to make it easer to handle large data sets.
  
  Events from Security and Terminal Services logs are automatically merged instead of the user having to know they are from the same session.
  
  Logoff / Disconnect events are now parsed and stored.
  
  New Logon Session related info panel (lower right) will show you what session was active when an item on top is selected.
- Recorded Future Sandbox Integration
  
  Individual files can now be submitted to the new Recorded Future Sandbox (by right cliking on the file).
  
  This feature is included in all current licenses for no extra cost.
- Collect Microsoft BITS Jobs
  
  BITS Jobs are detected from the application database and event log files
  
  Triggered Tasks are created for each job
  
  Program Run entries are created for each notify command run
  
  Added filter to Triggered Task area to allow user to focus on scheduled tasks, BITS, WMI, etc.
- Processes now list the DLL files they loaded. Cyber Triage was previously collecting the files, but not associating them with a process.
Bug Fixes:
- Fixed a bug where Good/Bad list panel was not resetting.
- Fixed a bug where Triggered Tasks were not showing up when ingesting old data.
- Fixed a bug where the bottom “Host Info” panel was not populating in rare cases.
- Fixed a bug where a user was unable to open a host that had an error from Batching mode.
- Fixed a bug that caused an error while initializing the Postgres database in Team version.
- Fixed a bug that where bad listed files were occasionally not flagging Programs Run or Data Accessed entries.
- Fixed a bug that caused the “update version” dialogue box to appear even if a user was running the most current version of Cyber Triage.
- Fixed a bug that caused a proxy failure while using Active Directory credentials.
- Fixed a collection tool bug that caused a crash while opening up the file system during phase 2 collection.
- Fixed a bug that sometimes caused the source file report to generate.
- Fixed a bug that caused the active connections list to display the wrong number.
- Multiple security fixes and updates.
Hash of ZIP:
- SHA-256: ec5f7003abdf40d60ec153b38472c1d001f672248fac8447a1e6e9d3d83a9ed6

12.5. Ver 3.3.1 (July 28, 2022)¶

Bug Fixes:
- Fixed a bug that involved proxies using Active Directory for authentication.

12.6. Ver 3.3.0 (July 13, 2022)¶

New Features:
- New Artifact Type: “Data Accessed”,a new Section to the UI Panel where you can view different types of artifacts that can shed insight into what data a particular user accessed.
- Parsing of new Data Accessed artifacts from Office Recent Files, Shortct (LNK) Files, IE | Edge files and Open/Save MRU files.
- Adobe PDF and Microsoft Office Dcouments are analyzed for suspicious actions and scripts to detect possible malware.
- Logical files and folders can now be imported, including KAPE logical files.
- Added the ability to collect source files (hives, logs, etc.) over 150MB.
- Collect SHA-1 hashes in Collection Tool (in addition to MD5 and SHA-256).
- Added SHA-1, SHA-256 to the Good and Bad Lists.
- Added feature to automatically delete old JSONs.
- Expanded the Live File batching feature to recurse one directory level to detect JSONs.
- Updated to Java 17.
Bug Fixes:
- Fixed a bug where ‘No data collected for this type’ displayed when data was collected.
- Fixed a bug where duplicate “Notable” entries were being recorded. .
- Fixed a bug where Cyber Triage failed to shut down completely.
- Fixed a bug where an incorrect error was thrown when parsing the IE history file.
- Fixed a bug that caused a client error when the connection to Team Server was momentarily lost.
- Fixed a bug that did not allow a user to load View File in Directory from a different host.
- Fixed a bug that caused some malware heuristics to not flag all relevant files.
- Fixed an inconsistency between the Good List and the Bad List.
- Updated the error message when the application cannot start due to low disk space.
- Fixed a bug where Recent Messages were being duplicated in the Team Server edition.
- Fixed a bug where an error was not being shown when an ingested JSON was corrupted.
- Fixed a bug where the Multi-Client Incident Name and Description failed to update between clients.
- Fixed an error where Memory settings were not taking effect after rebooting Cyber Triage from the Options Panel.
- Fixed a bug where the Memory Allocation panel occasionally showed blank in the Options Panel.
- Fixed a bug where the user’s memory settings were not transferring over when switching from Client to Team Server mode.

12.7. Ver 3.2.0 (Apr 8, 2022)¶

New Features:
- Added ability to batch live files, disk images, and memory images for ingest and processing in Team and Standard Pro
- Team server will no longer reject connections when it is at capacity. It will now save the data to disk and schedule them for processing.
- Added ability to ingest KAPE VHD output for additional analysis
- Added ability to export ‘source’ files (registry hives, event logs, etc.) to a local directory
- Added a dialogue box to alert the user if a new version of Cyber Triage is available
- Added a link within the application to the Cyber Triage User Guide
- Calculate SHA-256 for collected files
- First version to support Standard Pro license
Bug Fixes:
- Fixed an error where a program flagged for “ran from a non-standard path” was displaying twice in the analysis results
- Fixed an error where occasionally selecting a single entry in the startup items and adding to the good list would cause other items to disappear from the table.
- Native Image dll’s from .NET will now be given a score of “none” when unsigned to reduce false-positives
- Fixed an issue in Team Server where the hosts panel could freeze if the connection to the server was lost
- Fixed bug that prevented previous scores and comments from getting saved into correlation database
- Fixed various bugs in Cyber Triage Lite and enabled web artifact extraction
- Fixed a bug that caused the info panel to blank when a user right-clicked.
- Various other minor bug fixes
Version 3.2.0 Installer Hash:
- SHA-256: 8d05492efbd86584e9d030c79d7ed1ee975f250e58867b77dbe7850de786bd3a

12.8. Ver 3.1.1 (Mar 14, 2022)¶

Bug Fixes:
- Collection tool is now signed (it was not in 3.1.0)
- Fixed memory leak in main application
- Fixed issue when collecting from hosts with non-ASCII characters in host name
Known Issues:
- If hostname has non-ASCII characters, then you should use the IP address instead of the hostname for “Live Automatic”

12.9. Ver 3.1.0 (Feb 10, 2022)¶

New Features:
- Added ability to keyword search all artifact metadata within a host.
- OS Configuration:
  
  Expanded OS Configuration artifacts to have a group and be scored.
  
  Collect more settings, such as RDP.
  
  Flag if EventLog or Windows Defender are disabled.
  
  Flag if EventLog or Windows Defender are enabled, but not running.
  
  Provide more context about why OS Configuration settings are important
- Improved Program Run Performance:
  
  Changed the UI so that specific run times are not shown on top.
  
  Run times are shown at the bottom and paged.
  
  When a “Program Run” is marked as suspicious or bad, only the first and last times will show up in the “mini-timeline”.
- Improved User Login performance by decreasing memory requirements in pipelines.
- Added ability to select multiple items and score or export them.
- Collect PowerShell History Console and Windows UAL file
- Added ability to add a logo to the HTML report.
- Added Offline Mode that will not generate warnings each time that the Internet can’t be connected to.
- Added feature to allow you to pick a timezone other than the current one or UTC.
- New evaluation dashboard with list of options.
Bug Fixes:
- Reduced amount of WMI database processing to improve performance.
- Encrypted archives are only flagged as suspicious if they are less than 3 months old (to reduce false positives).
- Fixed false positives associated with Swedish OS Account names.
- Various other minor bug fixes
NOTE: For quality assurance, this release will upload a subset of anonymized artifact metadata to a server to help identify and fix false positives. The data is sanitized and not stored in any way to associate it with where it came from.

12.10. Ver 3.0.2 (Nov 30, 2021)¶

New Features:
- Collect WofCompressedData files using native APIs.
- Added creation time and file sizes to various UIs.
Bug Fixes:
- Fix ransomware note bug that could flag the wrong file (with the same name)

12.11. Ver 3.0.1 (Nov 10, 2021)¶

New Features:
- Flag Ransomware notes based on known names and heuristics
- Flag commands that disable volume shadow and Windows backup
- Added ability to filter OS Accounts based on their actions on the system
- Detect and mark WOF compressed files (content is still not collected)
- Added ability to collect only hashes instead of file content to the UI
Bug Fixes:
- Fixed issues with collection from IPv6 hosts
- Fixed Google Object upload bug
- Fixed bug about not being able to open Yara rule
- Fixed issue when deleting multiple hosts.
- Various other minor bug fixes

12.12. Ver 3.0.0 (Sep 13, 2021)¶

New Feature:
- The backend database was replaced with SQLite and PostgreSQL and the same schema as used by Autopsy. This results in better stability.
- Added ability to delete incidents.
- Added ability to soft delete hosts. They are not shown in the UI, but the actual data is still retained. This will be improved.
- All collected data must now be part of an Incident.
- Collection tool JSON schema changed and is not compatible with v2.
- Renamed Session to Host.
- Added host name to the top of each panel (user request)
- Users are reported as being local or domain
Team Changes:
- More extensive REST APIs exist because clients now connect to the REST API instead of directly to the database
- Clients must use a Server Key to connect to the REST API.
Bug Fixes:
- Fixed issue where a process would be collected twice
- No longer create an inferred user from a failed login for an account that didn’t exist

12.13. Ver 2.14.5 (Jun 4, 2021)¶

Fixes:
- Fixed parsing error with WMI Databases
- Updated URL to download evaluation data

12.14. Ver 2.14.4 (Apr 15, 2021)¶

New Feature:
- Collect Exchange files from wwwroot for WebShell detection
- Distribute NSA-based Yara rules to detect web shells related to recent Exchange compromises
- Added keyboard short cuts for scoring items.
- Added --skip_file_contents and --skip_source_file_contents command line arguments to collect only MD5s and not file content.
Fixes:
- Do not flag inferred accounts when there are no local logins. Inferred accounts come from event logs.
- Support PsExec 2.3 and above
- Fixed bug that prevents Server from stopping when it was run as a Windows server

12.15. Ver 2.14.3 (Mar 1, 2021)¶

New Feature:
- Temporary S3 Session Tokens can be used.
Fixes:
- Better deal with corrupt compressed JSONs
- Better UI feedback while encrypted JSONs are being checked
- Fixed bug that incorrectly reported local login as remote
- Fixed bugs with parsing some startup items
- Fixed bug with WMI Action heuristics
- Fixed Bug showing WMI DB in timeline
- Collection tool will use different output folder if run from SysWow (via EDR)

12.16. Ver 2.14.2 (Jan 25, 2020)¶

New Features
- DLLs of running processes are collected
- Files can be rescanned by new Yara rules and bad lists after initial collection
- Updated Volatility for Windows 10 19041 Profile
Fixes
- Improved event log parsing performance
- Fixed bug that prevented S3 uploads on large JSON files
- Allow new version of PsExec (2.3) to be used.
- Fix UI refresh issues over RDP
- Fixed memory issue with large encrypted JSONs

12.17. Ver 2.14.1 (Oct 28, 2020)¶

New Features:
- S3 Test button uses configured proxy
- Collection tool can use proxy for S3 using configuration file
- Added CSV and JSONL incident-level reporting
Bug Fixes:
- Changed JMX to not listen for remote connections and require TLS.
- Fixed bug with Team options panel
- Fixed HTML incident-level reporting

12.18. Ver 2.14.0 (Oct 7, 2020)¶

New Features:
- Collection Tool output can now be encrypted using AES
- Collection Tool output is now compressed when saved to local file
- Collection Tool output can be uploaded to S3 bucket
- Yara rules are applied to memory images using Volatility
- The Event Log Id is displayed in the UI
- Session files are no longer deleted after they are imported
- When evaluating, a session can be automatically created with evaluation data.
Bug Fixes:
- Faster processing of systems with a large number of user accounts and logins.
- Fixed UI rendering issues from font scaling
- Partial files are collected when read errors occur (most often occurs with event logs that use NTFS compression)