Advertising infrastructure is increasingly being repurposed as a surveillance channel that can profile internet users and track their movements across sensitive locations, according to research from TrendAI. Investigators identified an operation, referred to as SHADOW-EARTH-79, that made unusual ad purchases and used a reconstructed software interface, suggesting its primary purpose is intelligence gathering rather than […]
The USN Journal is one of the most useful forensic artifacts on an NTFS volume, but it can also be extremely noisy.
From Raw Data to Actionable Findings
CQUSNDeepAnalyzer processes the raw $J stream and can optionally use the MFT for full path reconstruction.
It also includes built-in YARA rules, behavioral detection, and enrichment from EVTX and Prefetch data.
In the demo, we run the tool against a real journal dump and immediately uncover several interesting findings:
1. More than 1,500 rename records in a burst.
2. Nearly 50,000 file deletions.
3. Fifteen new file extensions appearing only in the last part of the timeline.
4. Search for known cryptominer binaries.
5. Nearly 400 related events across 53 files.
The combination of mass renames, mass deletes, and newly appearing extensions is especially interesting because it can be associated with early-stage ransomware activity.
Interactive Forensic Analysis
The tool deals with huge amounts of records and presents the findings in an interactive HTML report.
Instead of manually reviewing thousands of raw entries, investigators can explore:
1. An activity timeline.
2. Severity-ranked findings.
3. Reason flags over time.
4. An hour-by-day heatmap.
5. A Sankey diagram connecting reasons, file extensions, and paths.
6. File extension statistics.
7. A path treemap showing where suspicious activity occurred.
Every underlying record remains searchable and filterable, and the results can be exported to CSV for further analysis.
Why It Matters
During investigation, the biggest challenge is often not collecting forensic data, but finding the important activity hidden inside it.
CQUSNDeepAnalyzer helps transform a raw USN Journal into a structured timeline that makes suspicious file operations, malware indicators, and behavioral patterns much easier to investigate. From a raw journal blob to an investigation-ready timeline. That is CQUSNDeepAnalyzer.
If you’re reading this article, use the discount code CQBLOG_AMSC27_HACKS85 at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.
Want a sneak peek at our AMSC course?
Join our FREE live webinar:
Secure Users: Designing Workstations for Threat Resistance
Workstation security depends on how privileged access, authentication, endpoint configuration, and monitoring work together.
Join Paula Januszkiewicz, Sami Laiho, and Artur Kalinowski for a practical session on designing and deploying Privileged Access Workstations (PAWs), implementing passkeys securely, and identifying workstation and identity misconfigurations that weaken security.
Through practical demonstrations, discover how to strengthen workstation defenses, identify the authentication events and security changes that matter, and connect endpoint and identity activity to actionable detections. You will also learn how to validate that security evidence is collected and alerts trigger as expected.
Leave with an actionable checklist for PAW design, passkey deployment, workstation hardening, configuration reviews, and monitoring validation.
Event ID 4624 is one of the most important Windows events for monitoring successful logons.
We start by enabling detailed logon auditing on the Domain Controller and then generate several different logon scenarios, including:
1. Workstation unlocks, Logon Type 7
2. Local interactive logons, Type 2
3. Network authentication, Type 3
4. New logon session with alternate credentials for network connections, Type 9
5. RDP sessions, Types 7 and 10
6. Service logons, Type 5
We also demonstrate how SMB activity from Kali Linux appears on the Domain Controller and which fields are most useful during analysis, including:
1. Logon Type
2. Logon Process
3. Authentication Package
4. Source Network Address
The key takeaway is that Event ID 4624 becomes most valuable when you correlate its fields and understand the context behind the logon.
A single Type 3, Type 7, or Type 9 event may be completely legitimate. But when you combine the logon type with the account used, source IP address, authentication package, and surrounding activity, it becomes much easier to distinguish normal behavior from activity worth investigating. That is why Event ID 4624 is such a valuable source for Windows authentication analysis, threat hunting, and lateral movement investigations.
After restoring Bob’s original UPN, the certificate is used for authentication and is mapped by the KDC to the real Administrator account. This allows us to obtain an Administrator TGT and recover the Administrator NT hash.
With Domain Admin privileges, the demonstration concludes with DCSync, retrieving the krbtgt account hash.
The attack highlights why AD CS configuration, certificate mapping settings, and permissions to modify identity attributes such as userPrincipalName should all be carefully reviewed. A seemingly small certificate configuration issue can become part of a complete domain compromise.
Want to learn more?
Join our FREE live webinar:
Uncovering New Identity Theft Vectors and How to Mitigate Them
Discover how identity theft no longer begins and ends with a stolen password.
Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.
ESC16 occurs when a Certificate Authority is configured not to include the SID security extension in issued certificates. This extension provides a strong binding between a certificate and the Active Directory account for which it was issued. If the extension is absent and the Domain Controller permits weak certificate mapping, certificate identities such as the UPN can potentially be used to map the certificate to another account.
In the demonstration, a low-privileged user named bob is able to modify his userPrincipalName. We temporarily change his UPN to Administrator and request a standard user certificate. Because the CA does not add the SID security extension, the issued certificate contains the Administrator UPN without being strongly bound to Bob’s SID.
After restoring Bob’s original UPN, the certificate is used for authentication and is mapped by the KDC to the real Administrator account. This allows us to obtain an Administrator TGT and recover the Administrator NT hash.
With Domain Admin privileges, the demonstration concludes with DCSync, retrieving the krbtgt account hash.
The attack highlights why AD CS configuration, certificate mapping settings, and permissions to modify identity attributes such as userPrincipalName should all be carefully reviewed. A seemingly small certificate configuration issue can become part of a complete domain compromise.
Want to learn more?
Join our FREE live webinar:
Uncovering New Identity Theft Vectors and How to Mitigate Them
Discover how identity theft no longer begins and ends with a stolen password.
Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.
Conditional Access decides which device platforms it trusts based on the User-Agent, a value the client controls. Windows, Linux, iPhone all get blocked. So, we try something the policy never accounted for: Xbox Series X. The result is a Microsoft Graph access token, issued without ever triggering MFA.
With that token we go straight to Graph, enumerating users, groups and roles with GraphRunner, completely bypassing the portal restrictions. A custom script then scans directory objects for secrets and finds a clear-text password sitting in a group description. It belongs to a break-glass account with Global Administrator.
One policy gap and one badly stored secret, chained into a full tenant compromise.
Blocking the admin portal is not enough. Conditional Access has to cover the underlying APIs and token acquisition paths, security decisions must not rely on client-controlled signals like the User-Agent, MFA belongs on every sensitive path, and secrets must never live in directory attributes a standard user can read.
Want to learn more about Attack Reconstruction & Defense Evasion?
Join our FREE live webinar:
Close the Attack Visibility Gap: Detecting Defense Evasion and Reconstructing Attacks in Microsoft Environments
Discover how attackers create gaps in security visibility and how defenders can reconstruct what happened from fragmented evidence across Microsoft environments.
Paula Januszkiewicz and Amr Thabet will look at the challenge from both sides, from reconstructing attacks and finding the evidence attackers leave behind to understanding how modern defense evasion techniques can make malicious activity harder to detect.
A deadman’s switch can be very powerful defensive weapon. A deadman’s switch is only triggered if the human being holding is dead. Hence, the name. This can be powerful weapon if one’s life is threatened. You set up a deadman’s switch to trigger some powerful event (emails, data exposure, videos, graphics) if you are dead and can not maintain the switch. This might save you life someday!
As you know, Mr. Robot is my favorite TV show because of its realistic depiction of hacking. Nearly all of the hacks in the show are real, although the time frame may be compressed (real hacking is not like a TikTok video).
In the first season, Elliot’s “girlfriend”, Shayla, has been kidnapped and held as hostage by the psychopathic drug dealer, Vera. Vera has been arrested and is sitting in jail waiting for trial. He insists that Elliot get him out of jail by some sort of elaborate hack in 24 hours! For more of the prison hack, see my tutorial here and my David Bombal YouTube video here.
Elliot goes to the jail to visit Vera and explain the difficulties of hacking him out jail in 24 hours. Vera insists. Elliot explains that he has all the evidence from Vera’s brothers cellphone (he hacked it over the LAN in his apartment probably using the shellshock vulnerability) to put Vera and his brother away forever. When Vera threatens him, he explains that if anything happens to him, a deadman’s switch will be triggered and send all the evidence to law enforcement, thereby guaranteeing his safety,
Deadman’s switch is not a new concept. It has a long and storied history in its many physical forms. A deadman’s switch is simply a safety mechanism that triggers if there is NO user action. This means that if the owner or holder of the switch is dead or otherwise incapacitated, an action is triggered. They have long been used within industrial society to stop machines if the operator is “dead” such as locomotives, amusement rides, and aircraft refueling, among many applications. It has also been used by to preserve the operator’s life. Imagine a person wearing a suicide vest. They often hold a deadman’s switch that triggers the explosive should they be killed. You have probably seen this in many TV shows and movies.
Elliot is using this strategy to preserve his life from Vera’s assassins except that here he creates a digital deadman’s switch. If he is dead, the program triggers and notifies law enforcement with all the digital evidence against Vera and his brother.
Let’s see whether we can create such a digital deadman’s switch in Python, the favorite language of cybersecurity and artificial intelligence.
Step # 1: Getting Started
A deadman’s switch is a safety mechanism that triggers an action if the user fails to perform a periodic task (like pressing a key or sending a signal) within a certain time frame. In our script, we will wait to get receive an ENTER from the user. If you user does not hit ENTER within a specified period of time, we assume they a are dead and execute the action, in this case send an SMS message.
To develop our deadman’s switch, we will need;
code or a function to send the message when the user is dead
some code or function to track the time and determined time is exhausted
a main function to take user input on the desired time out and determine when that time has exhausted and trigger the action function
Let’s get started by importing the modules necessary:
import threading
The threading module in Python allows your program to run multiple operations concurrently within the same process by using threads.
Wait for input or other blocking operations (like in your deadman’s switch).
Perform background tasks while the main program continues (e.g., downloading a file while updating a UI).
import requests
The requests module in Python is a simple and powerful library for making HTTP requests — it lets your program talk to websites or APIs over the internet
Step # 2: Create a function named action to send an SMS Message If the User is Dead
Now that we have all the necessary modules, let’s create a function called action. In this function, we will use the requests.post command to send a SMS message through textbelt.com (we have used this service before with the sending a fake SMS message here). This function executes if the action indicating life (hitting ENTER) is not completed within specified amount of time entered by the user in the main function below. So, to simplify, the user defines the amount of time and if no action is detected within that time period, the switch is triggered.
In this function, we named wait_for_input, we use the threading module to create a timer.
def wait_for_input(timeout):
“””
Waits for user input with a timeout.
Returns True if input received, False if timeout occurs.
“””
timer = threading.Timer(timeout, deadman_action)
timer.start()
try:
input(f”Press Enter within {timeout} seconds to reset the deadman’s switch: “)
timer.cancel()
return True
except Exception:
timer.cancel()
return False
Step 4: Create a main function
Here, we create our main function. In this function, we prompt the user for the number of seconds to wait and convert it into integer, then print the timeout for the user to see and another print statement simply telling the user that the switch is activated and they must press enter to keep it alive.
def main():
timeout = int(input(“Enter the length of timeout in seconds: “)) # seconds
print(“Deadman’s switch activated. Press Enter regularly to keep it alive.”)
while True:
if not wait_for_input(timeout):
break # Deadman’s switch triggered, exit loop or take other action
Step # 5
In this section, we use a python convention that ensures that some code only runs when the file is executed directly, not when it’s imported as a module in another script.
As you already know;
name is a special built-in variable in Python.
When a file is run directly, name == “__main__” is True.
When a file is imported, name is set to the module’s name, not “__main__”.
Now, we only need to give ourselves execute permissions;
kali > sudo chmod 755 deadmans_script.py
Now, if Vera’s thugs kill Elliot, the deadman’s switch will be triggered and law enforcement will be notified with all the evidence on Vera’s brother’s phone!
How It Works
The program waits for the user to press Enter within the timeout.
If the user presses Enter in time, the timer is canceled, and the loop continues.
If the user fails to press Enter before the timer expires, the action() function is called.
You can customize action() to perform any critical task (e.g., email, alerting, shutting down, encrypting files, etc.).
Summary
Mr. Robot is a fascinating TV show that demonstrates many of the realistic hacks we all use but in compressed time frames. In this tutorial, we demonstrated how you can use the hacker’s favorite scripting language, Python, to create a Deadman’s Switch that will only be triggered if the user fails to do the required action in the required time frame.
For more on Python, check out my upcoming book, Python Basics for Hackers!
Login
