Authors: Desire Abdoul Kader Bonzi, Tetsutaro UEHARA

DFRWS APAC 2026

Abstract

A privileged account may be entitled to access a critical system while still reaching it through an unauthorized route. Reconstructing that route normally requires analysts to pivot manually across network flows and Windows authentication records. This is slow work that is difficult to repeat and vulnerable to unsupported correlations.

This hands-on workshop introduces a small, deterministic reconstruction pipeline that turns matched network and authentication evidence into supported pivot steps, composes them into an identityreachability timeline and compares the observed route with an approved administrative path. Participants investigate one controlled incident involving a workstation, an application server and a critical asset, working from controlled synthetic PCAP-derived flow records and Windows Security event records. They also examine an ambiguous credential transition and record the result as unknown rather than guessing.

The workshop is designed for practical use by DFIR teams, including smaller organizations that need an explainable method without machine-learning training, a live SIEM or Internet access. The implementation is a working proof of concept with a clearly defined scope; it is not a production forensic engine or a real-time detection system.

Learning Objectives

By the end of the session, participants will be able to:

  1. Reconstruct an identity-reachability timeline from network and authentication artifacts
  2. Apply session-join rules across Windows events 4624, 4672 and 4648 to avoid unsupported pivot claims.
  3. Distinguish identity entitlement from route authorization when evaluating access to a critical asset.
  4. Recognize insufficient evidence, record uncertainty explicitly and produce a reproducible, evidence-referenced finding.

Target Experience Level

Intermediate. The workshop is intended for threat hunters, security analysts and researchers. Basic familiarity with Windows Security logs and comfort reading Python are helpful. Prior detection-engineering experience is not required.

Workshop Description

Participants investigate a single administrative-path scenario from beginning to end. A privileged identity moves from a workstation through an application server toward a critical asset, bypassing the approved jump-host route. The session applies established policy concepts, including Microsoft’s tier model, the Enterprise Access Model and privileged access workstations, to the route supported by the observed evidence rather than to the identity’s entitlement alone.

Using the supplied flow records, Windows Security events and route-policy context, participants materialize supported pivot steps, build the observed path and classify the result. A comparison exercise shows how a loose same-user-and-time correlation can create a false pivot, while the stricter method leaves an unsupported transition unconfirmed. The session concludes with a short, evidence referenced reconstruction report and guidance for adapting the workflow to authorized case material.

Hands-on Proof Controls

Two-Hour Program

Preparation Details

  • Bring a laptop with Python 3.11 or later, permission to create a virtual environment and free disk space as stated in the preparation guide.
  • Download the versioned workshop bundle and complete the installation check before arriving. A removable-storage copy will be available on site.
  • No administrator rights, lab network, Internet access, or Elastic stack are required during the workshop.
  • Bring a power adapter. Participants work locally with the supplied artifacts, worksheet and
    answer checkpoints.

All supplied artifacts are controlled synthetic records prepared for teaching. The workshop does not require participants to interact with a live target or to collect data from any system they do not own or administer.

 

Biography

Desire Abdoul Kader, Bonzi Desire Abdoul Kader BONZI is a cybersecurity researcher and recent Master of Engineering graduate from Ritsumeikan University where he completed his Master of Engineering research in the Cyber Security Laboratory. His work develops FIRE, an identity-reachability framework for lateral movement detection and forensic reconstruction across on-premises and cloud environments. A related paper was presented at IEEE QRS/CFSE 2026. Before graduate study, he spent approximately five years working as an IT officer in mining environments. His work emphasizes transparent and reproducible methods suitable for resource-constrained organizations. The underlying research is supervised by Prof. Tetsutaro UEHARA, who is a co-author of the accepted workshop proposal.
Tetsutaro UEHARA, Ph.D., is a Professor in the College of Information Science and Engineering at Ritsumeikan University. His professional activities span cybersecurity, information security, digital forensics, cryptographic technology, and cybercrime countermeasures. He serves as Chairman of the Institute of Digital Forensics and advises several Japanese law-enforcement organizations on cybersecurity and cybercrime. He previously held academic positions at Kyoto University and Wakayama University and served at Japan’s Ministry of Internal Affairs and Communications.

 

Downloads

Participants_materials.zip (Other)