Proxy / Web Filter Logs
Location
Web proxy appliance logs (Zscaler, Squid, Blue Coat/Symantec, McAfee Web Gateway)Description
HTTP/HTTPS proxy logs recording the full URL requested, HTTP method, response code, content type, bytes transferred, user identity (if authenticated), user agent string, and category classification.
Forensic Value
Proxy logs are the richest source for tracing web-based attacks. Full URLs reveal the exact phishing page or exploit kit landing page visited during initial compromise. User-agent strings identify attacker tools (e.g., Python-urllib, curl) versus legitimate browsers. Outbound POST requests with large content lengths to cloud storage or paste sites indicate data exfiltration. HTTPS inspection logs expose encrypted C2 channels that would otherwise be opaque.
Tools Required
Used in Procedures
Related Blockers
No EDR Agent on Compromised Hosts
The affected endpoints do not have an EDR agent installed or the agent was disabled prior to the incident. Without endpoint telemetry you lose process trees, command-line logging, and real-time containment capability.
BitLocker/Encrypted Drives Preventing Forensic Imaging
Full-disk encryption (BitLocker, FileVault, LUKS) prevents mounting or imaging the drive without the recovery key. Without decryption you cannot access the filesystem for artifact collection.
Compromised Systems Powered Off or Disconnected
Key systems have been powered off by users, IT, or as part of a premature containment action. Volatile data (running processes, network connections, memory-resident malware) is lost. Remote collection tools cannot reach the host.
Shared Cloud Environment Complicates Isolation
The compromised workload runs in a multi-tenant cloud environment (shared subscription, Kubernetes cluster, or PaaS) where isolation actions may impact other tenants or business-critical services sharing the same infrastructure.
Systems Already Rebooted -- Volatile Data Lost
The affected systems have already been rebooted (by users, IT, or automated patch processes) before memory could be captured. Running processes, network connections, injected code, and encryption keys that existed only in RAM are no longer recoverable.
Backups May Be Compromised -- Cannot Trust for Recovery
Backup integrity is uncertain. The attacker may have been present in the environment long enough to have compromised backup copies, planted persistence mechanisms in backup images, or encrypted/deleted backup repositories.