Person
person:andrew
Also: ANDREW
District Forensics and Incident Response Consultant who describes the investigation.
District Forensics and Incident Response Consultant who describes the investigation.
“I’m a District Forensics and Incident Response Consultant.”
Early PPP team member mentioned as a source of assembly-language practice questions.
“one of my friends, Andrew, who is one of the first people on the team”
Microsoft colleague and MSRC engineer who confirmed the previously unknown Windows vulnerability.
“I walked over to the office of Andrew.”
“He said I found a vulnerability.”
College developer who was recruited to impersonate Connor, rejected the activity on ethical grounds, and provided Connor with related communications and screenshots.
“The e-mail was from a guy named Andrew”
“He just leaked a bunch of information to me”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | incident response | Explicit | 11 |
| outgoing | USES | digital forensics | Explicit | 11 |
| outgoing | USES | remediation | Explicit | 11 |
| outgoing | MEMBER_OF | Plaid Parliament of Pwning | Explicit | 43 |
| incoming | DISCOVERED_BY | MS08-067 | Explicit | 57 |
| incoming | INVOLVES | Connor Tumbleson identity impersonation | Explicit | 133 |
Andrew USES incident response
Andrew works on a team that performs incident response and participates in incident-response engagements.
Explicit Confidence 97% · Jack Rhysider EP 11 Details
“Andrew works on a team that does incident response.”
“We spun it up to – the company that I work for spun it up to a follow incident response engagement.”
Andrew USES digital forensics
Andrew participates in digital-forensics work during the engagement.
Explicit Confidence 99% · Andrew EP 11 Details
“I came in as part of the team that was doing some of the forensics work”
Andrew USES remediation
Andrew is scheduled to perform remediation to remove the threat from the client environment.
Explicit Confidence 91% · Andrew EP 11 Details
“I was sitting in the airport waiting to fly out”
“He’s scheduled to do the remediation in just two days.”
Andrew MEMBER_OF Plaid Parliament of Pwning
Andrew is described as one of the first people on the team.
Explicit Confidence 98% · Jack Rhysider EP 43 Details
“my friend, Andrew, who is one of the first people on the team”
Andrew identified the previously unknown vulnerability after analyzing the crash report and related code.
Explicit Confidence 98% · John Lambert EP 57 Details
“He said I found a vulnerability”
Connor Tumbleson identity impersonation INVOLVES Andrew
Andrew discovered the impersonation scheme, declined to pretend to be Connor, and provided Connor with evidence.
Explicit Confidence 99% · Connor Tumbleson EP 133 Details
“Andrew just ends up leaving and taking a bunch of information with him”