This walkthrough provides a complete, evidence-driven forensic examination of an insider threat investigation. Unlike an external intrusion, where the analyst hunts for a foreign implant, this case requires proving or disproving intent on the part of a legitimate, authorized user - a fundamentally different investigative problem that hinges on reconstructing user-driven activity from host artifacts rather than malware telemetry.
The scenario opens with a SOC alert for unauthorized port-scanning traffic originating from an employee workstation. The employee denies responsibility and attributes the activity to malware acting on their behalf. Management, however, suspects deliberate misconduct: the employee's behavior changed markedly after a rejected salary raise, and the working theory holds that they are being coached by an outsider, despite possessing only weak technical skills. The IR team captured a full logical image of the system, and it now falls to us to arbitrate between these two competing narratives using nothing but the artifacts on disk.
The investigation demonstrates a core DFIR principle: malware leaves execution artifacts, but a human being leaves intent artifacts. A scanner launched by a trojan produces prefetch entries and network connections. A scanner launched by a person also produces shellbags showing folder navigation, jump lists showing GUI double-clicks, saved output files written to the Desktop, chat logs negotiating the operation, and staging folders built by hand. Throughout this lab, that distinction is what converts a suspicion into a finding.
Key characteristics of this case include: