-2

While studying Digital Forensic, I am getting puzzled between different types of evidence, especially circumstantial and corroborative evidence.

Hypothetical scenario:

  • An IDS alert is generated due to a signature of a known malware
  • The extraction of malware was found on Proxy Server
  • An alert was found on OSSEC IDS of a host
  • An URL was blocked by NGFW which was requested from the possibly infected host.

Now, which one of these are the Best evidence, Direct Evidence, Circumstantial evidence and Corroborative evidence of malware infection?

  • Can you figure out what type of information you would get from the different detection systems? A suspicious URL could be a typo by someone, malware extracting data could not etc... – J.A.K. May 20 '18 at 10:11
  • J.a.k I said hypothetical scenario. This question is not about detection accuracy but placing the findings with proper evidence tag. Assume all the detection are accurate. – Muhammad May 20 '18 at 10:17
1

The question does not specify an order in which the evidence was uncovered, which makes the scenario confusing. I will put this in an order chosen by me so that it makes the most sense:

Circumstantial evidence:

"An IDS alert is generated due to a signature of a known malware" - this is evidence, but sometimes IDS generates false positive alerts, e.g. due to a user or program doing legitimate activities that look like what the malware does to the IDS, or a bug in the IDS that catches more types of behaviour than intended.

Corroborative evidence:

"An alert was found on OSSEC IDS of a host" (seems like the same thing as the above?!)

"An URL was blocked by NGFW which was requested from the possibly infected host." - the fact that the IDS and the firewall both detected malware-like activity and the host matches, means the circumstantial evidence has been corroborated. However, again this could theoretically be a false positive, as e.g. a security professional might be accessing a compromised website with wget or curl to check what is on it. It's still not direct evidence!

Direct evidence and best evidence:

"The extraction of malware was found on Proxy Server" - this means the actual malware was found. This is direct evidence, and irrefutable proof of (attempted or actual) malware infection. Since from the other evidence we can see it was running, it must have been an actual malware infection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.