TermData

Log date

The moment the infostealer collected data from the device; it shows how fresh the stolen data is.

Flow

1Written at infection
2Travels with the log
3Sets the priority

Related families: —
MITRE ATT&CK: T1082 · System Information Discovery
Sources: 3 sources

Overview

The log date shows when the infection happened, not when the log appeared on a market or channel. The same log may be shared again months or years later. Google Cloud (Mandiant)

In fresh logs, session cookies are more likely to still be valid; in old logs, unchanged passwords carry the risk. MITRE ATT&CK

How it works

1
Written at infection
The infostealer writes the date and time it ran, with the time zone, to the system information file. MITRE ATT&CK
2
Travels with the log
The date stays inside the archive even when the log is repackaged and resold.
3
Sets the priority
A recently dated log requires more urgent response for disabling accounts and revoking sessions.

Real-world examples

Snowflake: logs going back to 2020

Mandiant reported that some credentials used in the Snowflake attacks came from infections dating back to 2020 and still worked because they had never been changed. Google Cloud (Mandiant)

How to detect it

Compare the log date with the account’s last password change: if the password has not changed since then, the account is still exposed. Google Cloud (Mandiant)

What to do

Treat all passwords and open sessions set before the log date as invalid. MITRE ATT&CK

MITRE ATT&CK

T1082System Information Discovery T1539Steal Web Session Cookie

Related terms

Terms

Stealer logs Leak impact analysis Dark web monitoring

Sources

1System Information Discovery (T1082) · MITRE ATT&CK
2Steal Web Session Cookie (T1539) · MITRE ATT&CK
3UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024