Finding and Querying Document Metadata

TCIP T0 USA, AUS, CAN, GER, NZLH20291123 . -Focument Metadata Bunz ?illen Hamiltnn Sigth Develnpment i EIGIHT Technical Analysis April 21309 . TOP SECRETHCOMINTHREL TO USA, Aus, CAN, GER, NZLH20291123

SECRETHCUMINTHHEL TU USA, AUS, CAN, "ocument Metadata no: Why to Query on Document Metadata How to Find Document Metadata - e.g. File - Properties - Google How to Create Queries in XKS - XKEYSCORE Document Metadata and PDF Metadata TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

To usi? (aim, mg a .{33o'cum nt etad halysi .. r- What?: Use non-traditional selectors to find and track targets sending/receiving documents of interest How? It targets documents by Author, Organization, or embedded images (logos) Why? We don?t always know WHO is sending the documents, but they are ?guilty-by-association? if they send/receive the document. 80, who are TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Finding ocument Metadal- We find ?Document Metadata? in File 8 Prnperties Harms-Mntents Custeml ?ttieyecere Terme EU I-- - I General ale-bi Term-5.11m: Mir: reeuft Ward 5 Edit Eiuw luulz- ?il IIJLIW ?ulp ?qu IL 31-3 Ctrl+e I I if I impact: ?ese 3 4 I: gave [Ema . anther: Jee Eagge?enuts Save as Web 1 l. I Save ?at-lager: Flue-move: Hidden Data. .. EEI?ldian Categew: -. I wee-e Heme.- If unlque, these Document Page - Lg: ewe, emte, EMS-4, multi ?ta can be targeted a bengle I- Hyperlink I Preperttee ll ham: 1_ a . .IEHETECGRE and Tr iIJteCruz-55 Training-jet . Ll EDEIEI OE I Cam-Lumen and . 3 . a . den: 2 LI . .tlwaleenber'g, Garril: True-:3 dc?: TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, "Document Metadata Anall How do you find document metadata? - Passive Collection: Collected Documents already contain data - Active Collection: CNE ?Categorized Collection? from TUNINGFORK Data or Pinwale Queries on - Open Source: Google Hacking TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Finding Document Metadat ID Te Frem CI EH: Dete Subject 4E: gem:- :dee'e?d?e?lmt 5H SEEDS 5:31:35 PM ARRIUAGE DIESEL 1Ei "Target Cree-'3? 51151313? 9:35:13 PM Cen?rmetien: Terget Certi 2 51 5H SEEDS 11 214232 PM 1 teltr'ntml 41 "eleu zubeer eljre i'L {el?q?yw Er'1 EEDDEE 313525 PM Lee 1u'illee ele Duleei epplieetienreetet?etre "it "Si-ti? ?ew. - - - '11 :1521 Lit El] epplieetienirnewerti '4 EH PM 452 epplieetienrrnewerti epplieetienrrnewerd Diepley eriginel I Flew] header I I31 ?ier @12-21ej?itree. Category Company Hidden Slide?eunt Lin e?e unt 2E1 Lin keUpTeDete Felee Manager MMDIipCeunt 2E1 NeteCeunt 2E1 Peregreph?eunt 8 Scale?rep Pelee Slide?eunt 8 A A 10.0 {Author GeGe Cher 1 35%: Demmente DeteCreeted 5H EIEUDEE 3:131:11] ere SeeurityLeuel nene ??wde? . Lemme TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Finding ooument Active Collection: CNE ?Categorized Collection? from TUNINGFORK Data TUNINGFORK Collection I NC, ED Uger inf?rmati?? f?u?dl Microsoft Multimedia Mollt??} 1, Inst Mommy, Raw Protect Detai a[53115 only] ASHE: . . H-CE ilenamo Col 't 3 zooa oa 29 Ugh?wpat mmwas llsted]: 2003032? Bleub mherm?mm 21 2903-0 F-19 Puwenmimtm ild?EotfloiidESQEE- Emma?DH? 388 {12} Collectioo 0:652? EDGE-D343 I 1b b?nc?dnragrr i? wooed Collection To find Document Metadata in TUNING-FORK, you must View each Document in Categorized Collection (manual intensive) TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Finding ocument ta Using XKEYSCORE to query on CNE data Fields 1' .Ifnd'wanced Features I Shaw Hidden Search Fields Clear Search tl'alues Fielc-ad Last Search tialues Search: Decument Metaclata This query in XKS Input Snuree: cur Selected implant esfils frern active cellectien Filenarne Extensien Auther Title Input Seurce System Atlmin clec User WEI- C??eeumel?s antl Settings'l?ue Center Fer Encelenee {Micreseft Wertl - 131]? 13411343133613 C??ecuments antl iccns'grementraciti user WERE antl [lee results sch-?1' sweat-?tie W12 TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL ocument Metan Finding Open Source: Google Hacking at? ?d?ranced?earch SearchTip Help [Bungle Search Search by domains - ?site:comsats.net.pk" Search by file types - ?filetype:pdf? or ?filetype:doc" filetypextle file?ypapdf TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

TU USA, AUS, CAN. GER.- NZL I [El Document Metadata Anal How to find Document Metadata when you have NEVER collected a document Liel: TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

TU USA, AUS, CAN. GER.- NZL I [El Document Metadata Anal Take Client?s (Active User) IP address and query on it in XKEYSCORE Search: Dncument Metadata - Active USEFI IP address: Either I AC gm . _era1wce Ee- 39.? TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL Targeting Document Metadat Use XKEYSCORE to Find Who Else is sending the files? TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Document Metadata Analysis Take ?File Properties? information and fillin qu Search: [Jeeurnent Metadata Pruperlies General Summary Statistics Cunt-ants Cueternl Curmptedj, Iitle: Elietrs cere Terms FHEH Elma: impact: Enteneign: anther: Jge ElaggaDenutS *5 h- Eta: 1e manager *Creatign Tin'teH?: EMFFI. Eendian MFAI Modified Time*: Category: *LJnigue I fulltetit]: Sewer-15: ?utl?igr: Jge EleggeDgnute gemmente: Last ?gthe r: Organization: Elwl??h Eendien llerit Hyperlink Title: Template: Hermeln?el: Language: El Seie preview *Cemment* [fullte Ht]! File-?Embedded Irnage Hash [fLilItet-st]: ,i I Cencel Metaelata Marne: Metagata Value [fLilIte Ht]: TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Document Metadata Analysie Semple Query Sample Query: . . Search: Deeument Metadata Organization PTCL TefFrern Country Pakistan Drganiaatign: Title: Language: *Cmvnent?? [fullteet]: FilefEmt-edcled Image Haeh [fullteet]: Metadata Marne: Metagata Ualue [fullteet]: ?3 Te Part: it Part: Te Cguntry: lF'kI Errth TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL I Document Metadata Analysis Sample Query (ResultS) Previous Slide produces these results Filename ?rganizatiun Instructinns tz-tI-z midwifery. Instructiz-ti-zns tz-ti-z Hunar TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Embedded Images Turn a logo into a selector .. I77 SIGINT VALUE Trims}: of Yin i TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL Embedded Images XKEYSCORE parses out logos from within documents (PDFs, DOCs, Outlook Emails, etc) embedded as images [grf?mc"; Yeme Tha Gateway of ?i?aman it Logoflmage 32?oharaoter hash can be parsed out and p??ml L3,qu queried. :taa Lia taLaIaLi-gattaii mgr-lull ulj'?dl Mamba-Hp initial w?nll all .aumstai Mi Mi groom MB: L2 [in Chip Cache oer Processor MUS Strata-m Controller Card Eolaria oaros HWI ?oatation; Erystom Proinstalledn- Sittirt Flil?E W??i?l - TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Embedded Images TLLI I?'l ABEL inn .934. Le .-..J.I Step 1: Identify if a document HAS an image in it w?r?ilel Il?i" ITE. 3: Muhammad TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA. ALIS, CAN, GER. NZL Embedded Images - . I. Detetime Case Hetetien Frem 1F 15:54:51 Sessinn Heeder??j Attethments??j Met-3(3) I I .. .- Fe r'Quick [?icks I Retrieving Step 2: Open ettechmente . Sgt-{5mm Document and click i . . I en SESSION deeumeanete end 5 unknewn I text I decumenLt-edit-UI' L: ?Elimege i I??ef?ee BEECH Ec??eeuments and Find epeesite 5ii: e et -3. ID iFinI: Mere [lees with Sen-it. i TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, AUS, CAN, GER, NZL Embedded Images a? - 'r Session Header (3) ii-Attachmentst?j 'n ?153' - 's'cr' p' Quick Clicks Maegan? 3K n: El 3K Attachments i - a 33 sigth 33g Using IMAGE farma image_sumrnary_m-_ 53M ducumeaneta I and i3] 2' unknown text ducurnenLhuclyeJ-II 5'5de EC?Deeuments andE Step 3: In left-side menu bar, select an - Kline-?ick image and eepyipaste the 32?cherecter i3 sir-its side Bf name (without the extension) TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL Embedded Images Step 4: Paste the 32-cheraeter name inte the ?FilefEmbedded Image Hash? Field in the Document Metadata query El Fields 1 advanced Features 1' Hidden Search Fields Clear Search tlelues Relded Last Search values eeF end wet-Mar Metedete mm Search: Decument Meta-date 2: Elleu:l:EIerr'lf CHE Call Lass Z: Categng DHI Hesh [tulltest]. Celluler DHI Deeumerrt Meta-date El F'Inrhl Irma-rd Step 5: Select all of your good eelleetien eites Search Databageg nustrelian sites BARE-UT EARDAMUH [Clear Cheeks] [Reset Cheeks] [Submit] [Cancel] TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

SECRETHCUMINTHHEL TU USA, ALIS, CAN, GER, NZL Embedded Images . Header .IflttathmentsliE.) Wm:- Iv You can one-click query to create a newr query Quick Elitlrs [Ell Jul-'? EIFKdooLlrnenLrneta Search: Document Metadata and settings_usuarii El unknown Query Mame: on document heeh:f-4oEii353 El tertt Jugti?catign: [fine?elicit aeeroh to find more doournen?ia witi Elof'Fioe a?wwd additional Justification: Miranda Nurnloer: El Find opposite side of session - 1'3 I El Find More Does with San-re hash - *C?mm9?t* [lelltEl-lt]! . FileIEmhedded Irnade hdeEIo-il Hash [fullteet]: El Find email address - i TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

To usA, HEEL. 513Embedd ed Imag 1 Stand-alone files can be uploaded into XKS and images parsed out - Useful for TAO collection that didn?t get into XKS (non United Rake) giilasrit) This system is an: CLASSIFICATIDH: TIDI IZILI can upload SDTF and tilas.l as Imall as just random files {.dadl .ppt_. etc.) Lit-load Filal ll Upload This system is an: CLASSIFIEATIDN: TDI To task the hex values for images in CADENCE or Query in PINWALE contact The Xtreme Target Pursuit Team -32 7 and?S3114 TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL

TU USA, AUS, CAN. GER.- NZL I [El Embedded Images Questions on any of these tools or techniques, contact: TDP SEGHETHCUMIHTHRELTD USA, AUS, CAN, GER, NZL