16. History¶
16.1. Ver 3.9.0 (Dec 5, 2023)¶
- Incident-Level UIs:
New opening and incident management dialogs that are full screen.
New breadcrumb at top that you can always use for navigation
New Incident-level IOC search to search all artifact metadata
New advanced search that shows you all artifacts of a given type across all hosts in a given time range.
New notable items view that shows all bad items from all hosts, sorted by time.
- Collector:
The Collection Tool has been renamed the Collector, and therefore CyberTriageCollector.exe.
The Collector can now output to UNC paths
- Artifacts and Analytics
Scheduled Tasks are extracted from the registry in addition to files and are merged from other sources.
Collect Powershell and Bat files
Show deleted file based on recycle bin contents
Show MFT Milliseconds - useful for time stomping detection
Added timestamp to bad items table and report
Added ability to export selected source files
Propagate score to Data Accessed artifacts if docx/pdf is bad.
Do not keep good list in memory
Fix bug that reported local logins as remote
Added many heuristics
- Infrastructure
Added ability to communicate with PostgreSQL over TLS
Added ability to import a certificate for server / client communication
Added ability to import host data from the command line (Standard Pro and Team Only)
Changed how ‘net use’ was used so that the password is not passed as an argument
Fixed Timesketch report so that the header works
Confirmed that the latest versions of PsExec do not work with Windows XP.
Added the ability to select and copy text from all UI panels
- Security
Fixed Apache Commons Text vulnerability
Fix ActiveMQ vulnerability
Fix logback vulnerability
- Hashes:
SHA256 of ZIP: 6d80b7afbfd448a5174206b54854c871415bf51b488f2cf0197c36fd36c2d9ea
SHA256 of CyberTriageCollector.exe: b0b80a303768b8a93eadae47def8cd5b320238ac3853f20b94a991be777fa776
SHA256 of CyberTriageCollector_XP.exe: 104a1bc9716d0066fd29511dc754075eee78d432a2a183a642d3ad6781434d90
16.2. Ver 3.8.0 (Aug 29, 2023)¶
- New Features:
- Added Malware analysis features to prevent users from hitting limits:
New Flex tier provides 1,000 lookups/month to help finish a host
New Boost codes allow users to purchase additional lookups with a credit card
Display the historical average number of lookups per host required in the Malware Details panel.
Files are now uploaded to Cyber Triage API instead of ReversingLabs.
- Added ability to Standard and Standard Pro to export an incident so that it can be opened in Autopsy.
All files are accessible on a disk image.
Added a Yara rule to detect OneNote files with embedded executable content
- Notable Bug Fixes:
Password special character fix
Paid licenses will overrule the embedded evaluation license expiration
- Hashes:
SHA256 of ZIP: f087d8f8b31fb722b3dbe097de805eb634a263165314250af54fde1908856162
SHA256 of CyberTriageCLI.exe: b4bcc8b71aa0be4856eeb1c029c9582ddf8d8a7d04e3f09dba3b2f5583b17ebb
SHA256 of CyberTriageCLI_XP.exe: 92b4119ba017c4c7feaabf72a27f69c2f0e78a37b9710303d9ea1a67fd3cf140
16.3. Ver 3.7.0 (Jun 30, 2023)¶
- New Features
Custom File Collection Sets: Users can specify additional files that Cyber Triage should collect
- Propagate score to other instances of an item:
When a file is manually scored as bad, propagate the score to other hosts in the incident and future hosts.
Manually scored items can be exported as JSON for threat intel sharing.
Manually scored items can be imported as bad list items for threat intel sharing
Users can chose to suppress propagation of items that were previously incorrectly scored
Changed the “Other Occurrence Viewer” to differentiate exact match occurrences and fuzzy match.
- MITRE ATT&CK categorization is applied to automated analysis results.
Items will have a link to the MITRE ATT&CK page
HTML report will show which category an item belongs to
JSON report can be generated to import into ATT&CK Navigator
- New TLS certificate verification:
A new self-signed certificate is created for each installation.
The Collection Tool now requires –cert_hash to be given when connecting to a server. The argument must either be the server certificate hash or ‘nohash’ to skip verification.
Team Clients will prompt the user to confirm the server certificate when they first launch.
- Collect more artifacts:
Collect possible ransomware notes by looking for files in common locations with the same name and size.
Collect Sysmon, Powershell, and Windows Defender log files
Collect public facing IP
Expanded collection of downloaded files by looking for Zone.Identifier during full scan, always collecting its content, and also downloading Onenote files. Web artifacts are created from Zone.Identifier files.
Make processes from Run/RunOnce events
Parse LNK files on the Collection Tool and also collect the destination
- Scoring:
Flag services if they are cmd or powershell
Parse Microsoft-Windows-VHDMP-Operational.evtx and flag when ISO files are mounted
Flag processes that could be dumping LSASS memory or running mshta or wscript
Flag BITSJobs that use IPs
Flag Run keys that use LNK files
Flag LNK files not created on the local system
Flag artifacts that reference admin file shares
Made rescan more clear
Added process column to logons table
Expanded search to include Windows events
Added ability to provide in-app feedback
- Bug Fix
Updated file explorer UI to better identify files that were inferred by Cyber Triage to previously exist.
OS Accounts could sometimes have duplicates if they were not properly merged
- Hash of Zip:
SHA-256: 253fade3b94a51ff94750d168c0e6153661f1735e8204b136de17dd2b6c7bfa3
16.4. Ver 3.6.0 (Feb 20, 2023)¶
- New Features
- Process view was redesigned:
Includes artifacts from the Program Run view so that you can see current and past processes at the same time.
New search and grouping interface to make it easier to focus on certain types of processes.
Added a tree interface to allow users to navigate by hierarchy.
The Execution History tab on the bottom was removed and the Process tab now shows all past processes.
Added process tree diagram to bottom process tab.
Changed how scoring was applied and now each process instance gets its own score. This will cause higher counts when a false positive happens, but it gives more control.
Processes now store if they were running with elevated privileges.
- OS Accounts
Accounts are now created for “non-existent” users, which are created from failed logons.
Merged the concept of an “inferred” account with “unknown”. These accounts where a reference is found in a log, but it was not found in the registry, etc.
Updated the filters in the “Account” view.
Score accounts as suspicious if they were recently created and have admin privileges.
- User Logons
Parse more 4648 events for outbound logon details.
Collect log files (but not parse) from 3rd party remote logon applications. They are shown as “Source Files’’ in the Collection Details panel.
Bottom inbound logon panel will now show country of remote host
- OS Configuration:
Record log maximum sizes and rotation policy to detect if an attacker made them small to reduce evidence.
Record Windows PE (MiniNT) registry setting.
- Add Host Options:
Added the ability to import a local drive, which can be used when an image is locally mounted (for example if it was encrypted with BitLocker).
- Triggered Tasks:
Services are now created based on event log data that shows a service was installed.
Services that were recently created are scored as suspicious.
PsExec service will be scored as suspicious.
- Downloads:
Collect downloaded files from Temp folder based on Zone.Identifer ADS existence.
Collect content of more downloaded file types (LNK, ISO, etc.) if created within the past 6 months.
Recently downloaded ISO and LNK files are scored as suspicious.
- Search:
Panel was updated to make its capabilities more obvious. Same functionality.
- New Reports:
Export all files scored as bad as a ZIP file
Export all file hashes as a text file
Export all IP addresses as a text file
- Collection Details:
Files that were searched for, but not found are now listed.
Bitlocker detection is shown
- IP Addresses:
Mark IPs as suspicious if they are frequently by attackers for data exfiltration (such as mega)
Updated Dynamic DNS provider list
- Other:
The Host Information panel will now show what drives the host had mounted
Sources tab will show payload for Windows Events
New evaluation panel with reduced options and allows users to import their own system
Updated event log parser to use EVTX for disk images and logical file imports (https://github.com/omerbenamram/evtx)
- Bug Fixes: Many bug fixes are included, but notable ones from customer support issues include:
Very large NTFS folders are now detected and alerted versus exhausting memory.
Logical folder ingest works with long folder names.
- Hash of ZIP:
SHA-256: 8ddb62c4961f6fc7600aaa114a31f013487b421aced725f814eb6eef7094dccc
16.5. Ver 3.5.0 (Nov 21, 2022)¶
- New Features:
- New Collection Details panel
New panel which quickly shows you high-level informaton about your incident.
View all source files collected and the number of artifacts extracted from them.
New “Export All” button allows you to export all collected source files in one click.
- Data Accessed artifacts are now merged
Artifacts in this category are now merged if they come from the same event.
You can still view each individual data source in the “Sources” tab within the File Info Panel.
This change improves visual clarity when reviewing these artifacts.
- Updated Inbound and Outbound Logon Summary Panels
New Logon Histogram graphic shows a visual overview of logon activity on the host.
Updated widgets allow an examiner to see the dates and ranges of logons, without having to drill through the Logons Sessions tab.
Accounts panel was updated with more filters to make it easier to focus on relevant accounts.
Outbound Logons are created using data from Microsoft-Windows-TerminalServices-RDPClient/Operational log.
Mini-timeline can be minimized to save UI space.
Event log clearing is now scored based on existence of specific events.
GPO files are collected.
KAPE collections from Velociraptor are now supported (different naming conventions).
Links to cybertriage.com pages now exist in the “Sources” Panel for some Data Accessed types.
Files can be exported to a ZIP file with the “infected” password.
Times now use ISO 8601 format (YYYY-MM-DD HH:MM:SS).
- Bug Fixes:
OpenSaveMRU artifacts no longer sometimes show the user’s home directory in the path.
Google DNS is now used to resolve names and identify high flux domains.
Logon merging algorithm is now more accurate.
Recorded Future Sandbox results now display more data.
LNK file path parsing is improved.
Web artifacts show correct user when the user is admin.
Common Programs Run items from AppData (such as Windows Defender and OneDrive) are no longer scored as suspicious.
Program Run ‘File Content Available Only’ filter works in all scenarios.
DNS Cache now reliably shows countries.
HTML report columns no longer go off screen.
Recommendation Engine now comes up when Logon Sessions are scored.
Comments can be edited without causing an error.
Badlist rescans can now be performed.
Fixed an issue where the user showed as blank or unknown for a Logon Session when we only have the SID.
Back Button will now go back to the Logon Sessions instead of the Logon Search panel.
- Hash of ZIP:
SHA-256: 2e92de8b9801c347c55a664a0ef384b99a0d3e05fcac74d094b36d6df9ebe2fa
16.6. Ver 3.4.0 (Sep 26, 2022)¶
- New Features:
- Major update to logon sessions
New database schema that makes it possible to merge logon data from multple hosts and track logoff times.
Separate Inbound and Outbound Logon Session UIs to make it easier to focus on user activity versus lateral movement.
New UI concept with summary panels and search interfaces to make it easer to handle large data sets.
Events from Security and Terminal Services logs are automatically merged instead of the user having to know they are from the same session.
Logoff / Disconnect events are now parsed and stored.
New Logon Session related info panel (lower right) will show you what session was active when an item on top is selected.
- Recorded Future Sandbox Integration
Individual files can now be submitted to the new Recorded Future Sandbox (by right cliking on the file).
This feature is included in all current licenses for no extra cost.
- Collect Microsoft BITS Jobs
BITS Jobs are detected from the application database and event log files
Triggered Tasks are created for each job
Program Run entries are created for each notify command run
Added filter to Triggered Task area to allow user to focus on scheduled tasks, BITS, WMI, etc.
Processes now list the DLL files they loaded. Cyber Triage was previously collecting the files, but not associating them with a process.
- Bug Fixes:
Fixed a bug where Good/Bad list panel was not resetting.
Fixed a bug where Triggered Tasks were not showing up when ingesting old data.
Fixed a bug where the bottom “Host Info” panel was not populating in rare cases.
Fixed a bug where a user was unable to open a host that had an error from Batching mode.
Fixed a bug that caused an error while initializing the Postgres database in Team version.
Fixed a bug that where bad listed files were occasionally not flagging Programs Run or Data Accessed entries.
Fixed a bug that caused the “update version” dialogue box to appear even if a user was running the most current version of Cyber Triage.
Fixed a bug that caused a proxy failure while using Active Directory credentials.
Fixed a collection tool bug that caused a crash while opening up the file system during phase 2 collection.
Fixed a bug that sometimes caused the source file report to generate.
Fixed a bug that caused the active connections list to display the wrong number.
Multiple security fixes and updates.
- Hash of ZIP:
SHA-256: ec5f7003abdf40d60ec153b38472c1d001f672248fac8447a1e6e9d3d83a9ed6
16.7. Ver 3.3.1 (July 28, 2022)¶
- Bug Fixes:
Fixed a bug that involved proxies using Active Directory for authentication.
16.8. Ver 3.3.0 (July 13, 2022)¶
- New Features:
New Artifact Type: “Data Accessed”,a new Section to the UI Panel where you can view different types of artifacts that can shed insight into what data a particular user accessed.
Parsing of new Data Accessed artifacts from Office Recent Files, Shortct (LNK) Files, IE | Edge files and Open/Save MRU files.
Adobe PDF and Microsoft Office Dcouments are analyzed for suspicious actions and scripts to detect possible malware.
Logical files and folders can now be imported, including KAPE logical files.
Added the ability to collect source files (hives, logs, etc.) over 150MB.
Collect SHA-1 hashes in Collection Tool (in addition to MD5 and SHA-256).
Added SHA-1, SHA-256 to the Good and Bad Lists.
Added feature to automatically delete old JSONs.
Expanded the Live File batching feature to recurse one directory level to detect JSONs.
Updated to Java 17.
- Bug Fixes:
Fixed a bug where ‘No data collected for this type’ displayed when data was collected.
Fixed a bug where duplicate “Notable” entries were being recorded. .
Fixed a bug where Cyber Triage failed to shut down completely.
Fixed a bug where an incorrect error was thrown when parsing the IE history file.
Fixed a bug that caused a client error when the connection to Team Server was momentarily lost.
Fixed a bug that did not allow a user to load View File in Directory from a different host.
Fixed a bug that caused some malware heuristics to not flag all relevant files.
Fixed an inconsistency between the Good List and the Bad List.
Updated the error message when the application cannot start due to low disk space.
Fixed a bug where Recent Messages were being duplicated in the Team Server edition.
Fixed a bug where an error was not being shown when an ingested JSON was corrupted.
Fixed a bug where the Multi-Client Incident Name and Description failed to update between clients.
Fixed an error where Memory settings were not taking effect after rebooting Cyber Triage from the Options Panel.
Fixed a bug where the Memory Allocation panel occasionally showed blank in the Options Panel.
Fixed a bug where the user’s memory settings were not transferring over when switching from Client to Team Server mode.
16.9. Ver 3.2.0 (Apr 8, 2022)¶
- New Features:
Added ability to batch live files, disk images, and memory images for ingest and processing in Team and Standard Pro
Team server will no longer reject connections when it is at capacity. It will now save the data to disk and schedule them for processing.
Added ability to ingest KAPE VHD output for additional analysis
Added ability to export ‘source’ files (registry hives, event logs, etc.) to a local directory
Added a dialogue box to alert the user if a new version of Cyber Triage is available
Added a link within the application to the Cyber Triage User Guide
Calculate SHA-256 for collected files
First version to support Standard Pro license
- Bug Fixes:
Fixed an error where a program flagged for “ran from a non-standard path” was displaying twice in the analysis results
Fixed an error where occasionally selecting a single entry in the startup items and adding to the good list would cause other items to disappear from the table.
Native Image dll’s from .NET will now be given a score of “none” when unsigned to reduce false-positives
Fixed an issue in Team Server where the hosts panel could freeze if the connection to the server was lost
Fixed bug that prevented previous scores and comments from getting saved into correlation database
Fixed various bugs in Cyber Triage Lite and enabled web artifact extraction
Fixed a bug that caused the info panel to blank when a user right-clicked.
Various other minor bug fixes
- Version 3.2.0 Installer Hash:
SHA-256: 8d05492efbd86584e9d030c79d7ed1ee975f250e58867b77dbe7850de786bd3a
16.10. Ver 3.1.1 (Mar 14, 2022)¶
- Bug Fixes:
Collection tool is now signed (it was not in 3.1.0)
Fixed memory leak in main application
Fixed issue when collecting from hosts with non-ASCII characters in host name
- Known Issues:
If hostname has non-ASCII characters, then you should use the IP address instead of the hostname for “Live Automatic”
16.11. Ver 3.1.0 (Feb 10, 2022)¶
- New Features:
Added ability to keyword search all artifact metadata within a host.
- OS Configuration:
Expanded OS Configuration artifacts to have a group and be scored.
Collect more settings, such as RDP.
Flag if EventLog or Windows Defender are disabled.
Flag if EventLog or Windows Defender are enabled, but not running.
Provide more context about why OS Configuration settings are important
- Improved Program Run Performance:
Changed the UI so that specific run times are not shown on top.
Run times are shown at the bottom and paged.
When a “Program Run” is marked as suspicious or bad, only the first and last times will show up in the “mini-timeline”.
Improved User Login performance by decreasing memory requirements in pipelines.
Added ability to select multiple items and score or export them.
Collect PowerShell History Console and Windows UAL file
Added ability to add a logo to the HTML report.
Added Offline Mode that will not generate warnings each time that the Internet can’t be connected to.
Added feature to allow you to pick a timezone other than the current one or UTC.
New evaluation dashboard with list of options.
- Bug Fixes:
Reduced amount of WMI database processing to improve performance.
Encrypted archives are only flagged as suspicious if they are less than 3 months old (to reduce false positives).
Fixed false positives associated with Swedish OS Account names.
Various other minor bug fixes
NOTE: For quality assurance, this release will upload a subset of anonymized artifact metadata to a server to help identify and fix false positives. The data is sanitized and not stored in any way to associate it with where it came from.
16.12. Ver 3.0.2 (Nov 30, 2021)¶
- New Features:
Collect WofCompressedData files using native APIs.
Added creation time and file sizes to various UIs.
- Bug Fixes:
Fix ransomware note bug that could flag the wrong file (with the same name)
16.13. Ver 3.0.1 (Nov 10, 2021)¶
- New Features:
Flag Ransomware notes based on known names and heuristics
Flag commands that disable volume shadow and Windows backup
Added ability to filter OS Accounts based on their actions on the system
Detect and mark WOF compressed files (content is still not collected)
Added ability to collect only hashes instead of file content to the UI
- Bug Fixes:
Fixed issues with collection from IPv6 hosts
Fixed Google Object upload bug
Fixed bug about not being able to open Yara rule
Fixed issue when deleting multiple hosts.
Various other minor bug fixes
16.14. Ver 3.0.0 (Sep 13, 2021)¶
- New Feature:
The backend database was replaced with SQLite and PostgreSQL and the same schema as used by Autopsy. This results in better stability.
Added ability to delete incidents.
Added ability to soft delete hosts. They are not shown in the UI, but the actual data is still retained. This will be improved.
All collected data must now be part of an Incident.
Collection tool JSON schema changed and is not compatible with v2.
Renamed Session to Host.
Added host name to the top of each panel (user request)
Users are reported as being local or domain
- Team Changes:
More extensive REST APIs exist because clients now connect to the REST API instead of directly to the database
Clients must use a Server Key to connect to the REST API.
- Bug Fixes:
Fixed issue where a process would be collected twice
No longer create an inferred user from a failed login for an account that didn’t exist
16.15. Ver 2.14.5 (Jun 4, 2021)¶
- Fixes:
Fixed parsing error with WMI Databases
Updated URL to download evaluation data
16.16. Ver 2.14.4 (Apr 15, 2021)¶
- New Feature:
Collect Exchange files from wwwroot for WebShell detection
Distribute NSA-based Yara rules to detect web shells related to recent Exchange compromises
Added keyboard short cuts for scoring items.
Added
--skip_file_contents
and--skip_source_file_contents
command line arguments to collect only MD5s and not file content.
- Fixes:
Do not flag inferred accounts when there are no local logins. Inferred accounts come from event logs.
Support PsExec 2.3 and above
Fixed bug that prevents Server from stopping when it was run as a Windows server
16.17. Ver 2.14.3 (Mar 1, 2021)¶
- New Feature:
Temporary S3 Session Tokens can be used.
- Fixes:
Better deal with corrupt compressed JSONs
Better UI feedback while encrypted JSONs are being checked
Fixed bug that incorrectly reported local login as remote
Fixed bugs with parsing some startup items
Fixed bug with WMI Action heuristics
Fixed Bug showing WMI DB in timeline
Collection tool will use different output folder if run from SysWow (via EDR)
16.18. Ver 2.14.2 (Jan 25, 2020)¶
- New Features
DLLs of running processes are collected
Files can be rescanned by new Yara rules and bad lists after initial collection
Updated Volatility for Windows 10 19041 Profile
- Fixes
Improved event log parsing performance
Fixed bug that prevented S3 uploads on large JSON files
Allow new version of PsExec (2.3) to be used.
Fix UI refresh issues over RDP
Fixed memory issue with large encrypted JSONs
16.19. Ver 2.14.1 (Oct 28, 2020)¶
- New Features:
S3 Test button uses configured proxy
Collection tool can use proxy for S3 using configuration file
Added CSV and JSONL incident-level reporting
- Bug Fixes:
Changed JMX to not listen for remote connections and require TLS.
Fixed bug with Team options panel
Fixed HTML incident-level reporting
16.20. Ver 2.14.0 (Oct 7, 2020)¶
- New Features:
Collection Tool output can now be encrypted using AES
Collection Tool output is now compressed when saved to local file
Collection Tool output can be uploaded to S3 bucket
Yara rules are applied to memory images using Volatility
The Event Log Id is displayed in the UI
Session files are no longer deleted after they are imported
When evaluating, a session can be automatically created with evaluation data.
- Bug Fixes:
Faster processing of systems with a large number of user accounts and logins.
Fixed UI rendering issues from font scaling
Partial files are collected when read errors occur (most often occurs with event logs that use NTFS compression)