Hunter —
The Insider Threat
Investigation

The Case: Illegal Port Scanning From Inside the Network

The SOC team was alerted to illegal port scanning activity originating from an employee's system. When confronted, the employee — identified only as Hunter — claimed to have no knowledge of the activity and suggested the system may have been compromised by malware.

The investigation tells a very different story. A disk image of Hunter's Windows 8.1 Enterprise machine was acquired and handed to us for analysis. What we found was not malware. It was a deliberate, methodical insider threat operation — an employee who had recently been denied a salary raise, who sought outside help, and who was building capability to exfiltrate sensitive data while actively covering their tracks.

Mounting the Image & Establishing Ground Truth

The disk image was provided in .ad1 format — FTK Imager's proprietary format. We mounted it using FTK Imager as a logical drive, then loaded it into Autopsy 4.22.1 as a local disk data source for full artifact ingestion.

With the image mounted, the first step was establishing system context — who is this machine, what OS, when was it last active — using Registry Explorer against the SYSTEM and SOFTWARE hives.

Nmap + Zenmap — The Trigger That Started It All

The SOC alert was triggered by port scanning activity. Autopsy's Run Programs analysis confirmed two suspicious programs were executed — Nmap and its GUI frontend Zenmap — both installed and run deliberately.

The Scan Results — nmapscan.xml

Recent Documents analysis in Autopsy revealed the existence of nmapscan.xml on Hunter's Desktop — the output file from the completed network scan. Analyzing its contents revealed the full scope of the scanning activity:

backup.pst — The Smoking Gun

Autopsy's email analysis module parsed backup.pst — an Outlook PST file found in Hunter's Outlook Files directory — and recovered 47 email messages. What they revealed confirmed this was no malware infection. Hunter was actively coordinating with an external attacker.

The External Contact

A series of emails between Hunter (ehptmsgs@gmail.com) and an outside contact (linux-rul3z@hotmail.com, Skype: linux-rul3z) documented the full collaboration:

Further investigation revealed Hunter had also sent network design diagrams to the outsider — and later deleted them after the outsider warned they might get caught. This deliberate deletion is a significant anti-forensics indicator.

What Was on Hunter's Machine

Autopsy's filesystem analysis revealed Hunter's Desktop and Downloads directory contained a concerning collection of offensive security tools — far beyond what any normal employee would have installed.

Desktop Contents

Downloads Directory

Documents Directory

How Hunter Planned to Get the Data Out

The Exfil Folder

Autopsy's Shell Bags analysis revealed Hunter had created a dedicated staging folder with a name that left nothing to the imagination:

Pictures.7z — Email Exfiltration Attempt

Cross-referencing the email evidence with filesystem artifacts confirmed Hunter attempted to exfiltrate data by archiving staged files into a password-protected 7z archive named Pictures.7z and sending it as an email attachment — with the password communicated separately over Skype to avoid leaving it in email logs.

The XSS Payload — Hidden in an Image

The Recycle Bin contained an unusual artifact — a file masquerading as a .jpg image. Extracting the text content revealed it was not a normal image:

Covering the Tracks — BCWipe & Deleted Evidence

Perhaps the most damning evidence of intent: Hunter didn't just exfiltrate data — they actively tried to destroy evidence of what they were doing.

BCWipe — File Shredder

BCWipe by Jetico is a professional-grade file wiping and disk shredding tool. Finding it on an employee's machine is a major red flag in any insider threat investigation. Autopsy confirmed it was not only installed but actively used:

USB Devices — Data Exfiltration via Physical Media

Autopsy's USB device analysis combined with SYSTEM registry hive lookup revealed two USB storage devices had been connected to Hunter's machine:

Reconstructing What Hunter Did

Techniques Observed

Evidence Recovered

What This Investigation Teaches Us

Insider Threats Are Human Stories

Every other investigation in this series involved external attackers. Hunter is different — this is someone who sat at a desk, had a salary conversation that didn't go their way, and made a series of deliberate decisions over weeks. The artifacts don't lie: the rejection, the outside contact, the tools, the staging folder named "Exfil". The motive is written into every artifact.

Anti-Forensics Leaves Its Own Footprint

BCWipe run 5 times. Files deleted after the outsider warned of discovery risk. Ironically, these actions are themselves evidence. The act of trying to destroy evidence proves consciousness of guilt. Prefetch files recorded every BCWipe execution. Shell bags recorded every folder accessed including the Exfil staging directory. The very tools used to hide the activity became part of the evidence trail.

Disk Forensics Recovers What People Think Is Gone

Hunter deleted the network diagrams. The Recycle Bin still had artifacts. Prefetch still recorded execution history. Shell bags still showed folder access. Registry hives still held USB serial numbers. Disk forensics reconstructs the full picture even when the suspect believes they've cleaned up — because the OS keeps records in more places than most people realize.

No Setup Installer = Outside Hands

The absence of a Nmap setup executable in the prefetch — combined with Nmap being fully installed and running — was a key indicator that someone more technically skilled was involved. Forensic absence of evidence is itself evidence. When something that should exist doesn't, that's a finding.