Anomaly Detection on Drone Forensic Timeline with Sigma Rules

Drones, also known as UAVs (unmanned aerial vehicles), are unmanned devices that provide unique functionality, enabling area surveillance, inspections, and surveys. In recent years, the rapid growth of drones has also raised several security concerns related to illegal activities, making them a source of evidence. Therefore, it is very important for digital forensic examiners to have the ability to analyze the source of content stored on drones. If the drone encounters a problem or has an accident, it is necessary to carry out a forensic analysis of the device. In this paper, we build a drone forensic timeline using the log2timeline plaso. This timeline records all drone activities. We then propose to apply Sigma rules to detect anomalies in the drone timeline. With this technique, digital forensic examiners can detect anomalous activities that occur on drones.