Full Report
This blog dives into triangulation as a guiding concept during investigations and reporting.
Analysis Summary
# Best Practices: Investigative Triangulation
## Overview
These practices address the critical need for **veracity and credibility** in incident response (IR) and threat hunting reports. By transposing the social science concept of "triangulation" into cybersecurity, investigators can eliminate assumptions and provide evidence-driven conclusions that withstand executive and technical scrutiny.
## Key Recommendations
### Immediate Actions
1. **Adopt a Multi-Source Mandate:** Never rely on a single telemetry source (e.g., just EDR alerts) to confirm an incident. Always seek a secondary artifact (e.g., Prefetch, Shimcache, or Event Logs) to validate the finding.
2. **Defang Assumptions:** Review your current draft reports for phrases like "we believe" or "it seems." Replace these with evidence-backed statements such as "Telemetry from [Source A] corroborated by [Source B] indicates..."
3. **Validate Lateral Movement Tools:** Specifically audit for the use of **PsExec** or other administrative tools, as these are common vectors for lateral movement that require multi-source validation to distinguish from legitimate admin activity.
### Short-term Improvements (1-3 months)
1. **Develop an Artifact Map:** Create a matrix that links common attacker behaviors (e.g., persistence, lateral movement) to at least two specific forensic artifacts available in your environment.
2. **Standardize Reporting Templates:** Update incident report templates to include a mandatory "Evidence Correlation" section for every major finding to ensure triangulation is performed consistently.
3. **Enhance Windows Event Logging:** Ensure granular logging is enabled for process creation (Event ID 4688) and service installation (Event ID 7045) to provide the telemetry needed for triangulation.
### Long-term Strategy (3+ months)
1. **Automated Correlation Logic:** Work toward SIEM/SOAR configurations that automatically surface related artifacts (e.g., matching a process execution alert with a corresponding MFT entry) to speed up the triangulation process.
2. **Cultural Shift toward Peer Review:** Implement a "First-Layer Peer-Reviewer" mindset where every investigator attempts to disprove their own hypothesis using alternative data sources before finalizing a report.
## Implementation Guidance
### For Small Organizations
- **Focus on Free Tools:** Utilize Sysinternals and built-in Windows Event logs. Even with limited tooling, triangulation can be achieved by comparing local logs against suspicious file timestamps.
- **Focus on High-Impact Artifacts:** Prioritize learning Prefetch and UserAssist for quick evidence of execution.
### For Medium Organizations
- **Cross-Reference EDR with Logs:** Use EDR telemetry as the primary source, but require analysts to verify critical alerts against centralized log management (SIEM) data.
- **Actionable Findings:** Ensure reports don't just state "malware found" but explain the *context* of its arrival and execution using at least two data points.
### For Large Enterprises
- **Institutionalize Triangulation:** Make triangulation a requirement in the Standard Operating Procedures (SOPs) for the SOC.
- **Formalized Training:** Train investigators in digital forensics (DFIR) to ensure they can hunt for "silent" artifacts like the Master File Table (MFT) or Registry hives when standard logs are cleared by an adversary.
## Configuration Examples
While the article focuses on the conceptual framework, a practical configuration for triangulation involves:
- **Registry Monitoring:** Monitoring `HKLM\SYSTEM\CurrentControlSet\Services` to triangulate with **Event ID 7045** (New Service Created) when investigating persistence.
- **Prefetch Analysis:** Correlating a `bitsadmin.exe` execution alert with the presence of a `.pf` file in `C:\Windows\Prefetch` to confirm the execution time and frequency.
## Compliance Alignment
- **NIST SP 800-61 Rev. 2 (Incident Handling Guide):** Directly supports the "Analysis" phase by ensuring findings are based on correlated evidence.
- **ISO/IEC 27035:** Aligns with the "Lessons Learned" and "Reporting" requirements by increasing the reliability of incident documentation.
- **CIS Controls:** Supports Control 08 (Audit Log Management) by emphasizing the necessity of diverse log sources for validation.
## Common Pitfalls to Avoid
- **Confirmation Bias:** Looking only for evidence that supports your initial theory while ignoring data that contradicts it.
- **Over-Reliance on EDR:** Assuming that if an EDR didn't trigger, an event didn't happen. Use manual forensic artifacts to fill the gaps.
- **Vague Reporting:** Providing "bare minimum" reports that lack the context needed for stakeholders to make informed remediation decisions.
## Resources
- **Huntress Blog (Tradecraft):** [huntress[.]com/blog](https://www.huntress.com/blog)
- **Sysinternals (PsExec & Tools):** [learn[.]microsoft[.]com/en-us/sysinternals/](https://learn.microsoft.com/en-us/sysinternals/)
- **MITRE ATT&CK Framework:** [attack[.]mitre[.]org](https://attack.mitre.org/)