Skip to content

Latest commit

 

History

History
443 lines (348 loc) · 34.9 KB

README.md

File metadata and controls

443 lines (348 loc) · 34.9 KB

Blue - DFIR: Digital Forensics and Incident Response

DFIR: Digital Forensics and Incident Response is a hugely important important sector of cyber security, where your everyday security analysis is take to the next level. While most security analysts will work out of a SIEM or SOAR platform, Incident Responders and Forensic analysts typically work directly with a potentially compromised device. With this, they are required to not only be familiar with a larger array of tools for analysis, but also a much stricter set of process and procedures as their actions are often subject to legal requirements.

DFIR Resource Collections

Incident Response

{% tabs %} {% tab title="Guides and Resources" %}

{% tab title="IR Report Writing" %}

{% tab title="Misc" %}

{% endtab %}

{% tab title="Training" %}

{% endtab %} {% endtabs %}

IR/Malware Scanners

{% tabs %} {% tab title="Frameworks/Collections" %}

  • Kansa (Powershell) - A modular incident response framework in Powershell. It uses Powershell Remoting to run user contributed, ahem, user contri- buted modules across hosts in an enterprise to collect data for use during incident response, breach hunts, or for building an environmental baseline.
  • Windows Forensic Toolchest - The Windows Forensic Toolchest™ (WFT) is designed to provide a structured and repeatable automated Live Forensic Response, Incident Response, or Audit on a Windows system while collecting security-relevant information from the system.
  • Veliciraptor - A tool for collecting host based state information.
  • Meerkat - Meerkat is collection of PowerShell modules designed for artifact gathering and reconnaisreconnaissanceance of Windows-based endpoints without requiring a pre-deployed agent.
  • https://www.cadosecurity.com/cado-community-edition/ - The Cado Community Edition leverages the scale and speed of the cloud to simplify deep-dive investigations. With the free community edition, data can be processed in minutes compared to days when using traditional methods. Stop wasting time, money, or effort. Achieve forensic-level detail without forensic-level effort. Only Cado empowers the security community to investigate and respond at cloud speed. {% endtab %}

{% tab title="Malware/AV Scanners" %}

  • MalwareBytes IR Scanner

  • ClamAV - ClamAV is an open source antivirus engine for detecting trojans, viruses, malware & other malicious threats. Can be used with a USB for portable scanning of devices.

  • Microsoft Safety Scanner - Microsoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. Simply download it and run a scan to find malware and try to reverse changes made by identified threats.

  • hashlookup-forensic-analyser - Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/

  • Redline by Fireeye - Redline®, FireEye's premier free endpoint security tool, provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile.

  • https://www.herdprotect.com/ - herdProtect is a second line of defense malware scanning platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection. As a second line of defense anti-malware solution, herdProtect is designed to run with any existing anti-virus program already installed on a user's PC. herdProtect is a free service to help user's find and remove malicious software.

  • Windows Defender Scan

    "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File C:\Users\[username]\AppData\Local\Temp

    Note: Types are as follows

    • 1: Quick scan
    • 2: Full system scan
    • 3: File and directory custom scan

    Check Windows Defender for excluded files and default actions 

    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions'
Get-MpPreference | Select Exclusion*
Get-MpPreference | Select *DefaultAction

  • Crowdstrike's CrowdResponse Scanner - Static Host Data Collection Tool

CrowdResponse -v -i config.txt -o out.xml

{% tab title="Yara Scanners" %} {% content-ref url="yara.md" %} yara.md {% endcontent-ref %}

yara32.exe -d filename=[file defined in ruleset.yar] [ruleset.yar] [file to scan]
yara32.exe -d filename=[svchost.exe] [ruleset.yar] -r [directory to scan]
yara64.exe yararule.yar -r C:
yara64.exe yararule.yar -r C: -f 2> $null
  • Yara Linux
    • Note: -s shows matching yara strings.
yara rule.yara malware.exe -s
yara rule.yara [Directory] -s
  • https://www.nextron-systems.com/thor/ - IR scanner with more than 12,000 handcrafted YARA signatures, 400 Sigma rules, numerous anomaly detection rules and thousands of IOCs.
    • Loki Scanner - The free and open IOC scanner using YARA rules.
    • Fenrir - Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for Indicators of Compromise (IOCs).
  • Binalyze IREC Tactical - Standalone evidence collector for traditional DFIR situations. Can scan target with set YARA rules
IREC.exe --triage-memory
IREC.exe -ad "\\MACHINE\IREC-DIR" --triage-ruleset MyYaraRules --triage-memory

{% endtab %}

{% tab title="Scanning Utilities" %}

{% endtab %} {% endtabs %}

DFIR Commands

{% content-ref url="interact-with-remote-machine.md" %} interact-with-remote-machine.md {% endcontent-ref %}

{% content-ref url="windows-system-enumeration.md" %} windows-system-enumeration.md {% endcontent-ref %}

{% content-ref url="windows-process-information.md" %} windows-process-information.md {% endcontent-ref %}

{% content-ref url="windows-dfir-checks.md" %} windows-dfir-checks.md {% endcontent-ref %}

{% content-ref url="windows-dfir-check-by-mitre-tactic.md" %} windows-dfir-check-by-mitre-tactic.md {% endcontent-ref %}

{% content-ref url="windows-event-logs.md" %} windows-event-logs.md {% endcontent-ref %}

{% content-ref url="windows-remediation-commands.md" %} windows-remediation-commands.md {% endcontent-ref %}

{% content-ref url="ir-event-log-cheatsheet.md" %} ir-event-log-cheatsheet.md {% endcontent-ref %}

{% content-ref url="linux-dfir-commands.md" %} linux-dfir-commands.md {% endcontent-ref %}

{% content-ref url="macos-dfir-commands.md" %} macos-dfir-commands.md {% endcontent-ref %}

Forensics

{% tabs %} {% tab title="Guides and Resources" %}

{% tab title="Forensic OS/VM" %}

{% endtab %}

{% tab title="Forensic Frameworks" %}

{% file src="../.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0 (1) (1).pdf" %} {% endtab %} {% endtabs %}

{% tabs %} {% tab title="Extraction Tools" %}

  • bulk-extractor - bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures.
  • dumpzilla - Dumpzilla application is developed in Python 3.x and has as purpose extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers to be analyzed.
  • regripper - RegRipper is an open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis.
  • safecopy - safecopy tries to get as much data from SOURCE as possible, even resorting to device specific low level operations if applicable.

{% endtab %}

{% tab title="Browser Tools" %}

  • galleta - Galleta is a forensics tool that examines the content of cookie files produced by Microsoft Internet Explorer (MSIE). It parses the file and outputs a field separated that can be loaded in a spreadsheet.
  • pasco - Pasco is a forensic tool that examines the content of cache files (index.dat) produced by Microsoft Internet Explorer.

{% endtab %}

{% tab title="Misc Utility" %}

  • XOR Tool - A tool to do some xor analysis: Guess the key length (based on count of equal chars) and Guess the key (base on knowledge of most frequent char)
  • forensics-colorize - forensics-colorize is a set of tools to visually compare large files, as filesystem images, creating graphics of them. It is intuitive because the produced graphics provide a quick and perfect sense about the percentage of changes between two files.
  • dislocker - Dislocker has been designed to read BitLocker encrypted partitions under a Linux system
  • mac-robber - mac-robber is a digital investigation tool (digital forensics) that collects metadata from allocated files in a mounted filesystem. This is useful during incident response when analyzing a live system or when analyzing a dead system in a lab.
  • testdisk - TestDisk checks the partition and boot sectors of your disks. It is very useful in forensics, recovering lost partitions.
  • unhide - Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp. {% endtab %} {% endtabs %}
File Carving/Recovery
  • Foremost: Foremost is a console program to recover files based on their headers, footers, and internal data structures.
  • ext4magic - ext4magic can extract the information from the journal and restore files in an entire directory tree, if the information in the journal are sufficient.
  • ext3grep - ext3grep is a simple tool intended to aid anyone who accidentally deletes a file on an ext3 filesystem, only to find that they wanted it shortly thereafter.
  • extundelete - extundelete uses the information stored in the partition’s journal to attempt to recover a file that has been deleted.
  • magicrescue - Magic Rescue scans a block device for file types it knows how to recover and calls an external program to extract them.
  • myrescue - myrescue is a program to rescue the still-readable data from a damaged harddisk, CD-ROM, DVD, flash drives, etc. It is similar in purpose to dd_rescue (or ddrescue), but it tries to quickly get out of damaged areas to first handle the not yet damaged part of the disk and return later.
  • recoverdm - recoverdm recover disks with bad sectors. You can recover files as well complete devices. In case it finds sectors which simply cannot be recovered, it writes an empty sector to the output file and continues.
  • recoverjpeg - recoverjpeg tries to recover JFIF (JPEG) pictures and MOV movies from a peripheral. This may be useful if you mistakenly overwrite a partition or if a device such as a digital camera memory card is bogus.
  • rifiuti2 - Rifiuti2 analyses recycle bin files from Windows. Analysis of Windows recycle bin is usually carried out during Windows computer forensics.
  • scalpel - scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files.
  • scrounge-ntfs - Scrounge NTFS is a data recovery program for NTFS filesystems. It reads each block of the hard disk and try to rebuild the original filesystem tree into a directory.
  • undbx - UnDBX is a tool to extract, recover and undelete e-mail messages from MS Outlook Express .dbx files
  • RDP Cache Recovery
Forensic Imaging
  • FTK Imager by AccessData - Create forensic images of local hard drives, CDs and DVDs, thumb drives or other USB devices, entire folders, or individual files from various places within the media.
ftkimager --list-drives
ftkimager \\.\PHYSICALDRIVE0 "[Location]\Case" --e01
ftkimager [source] [destination]
ftkimager \\.\PHYSICALDRIVE0 "[Location]\Case" --e01 --outpass securepasswordinsertedhere
  • DD utility - Unix disk manipulation tool
    • dc3dd - dc3dd is a patched version of GNU dd with added features for computer forensics
    • dcfldd - Enhanced version of dd for forensics and security
    • ddrescue - Data recovery and protection tool
dd.exe --list
dd.exe if=/dev/<drive> of=Image.img bs=1M
dd.exe if=\\.\<OSDrive>: of=<drive>:\<name>.img bs=1M --size --progress
(LINUX) sudo dd if=/dev/<OSDrive> of=/mnt/<name>.ddimg bs=1M conv=noerror,sync
  • X-ways Imager - Forensic disk imaging tool. Stripped down version of the X-Ways Forensics computer forensics software with just the disk imaging functionality and little more
  • guymager - The forensic imager contained in this package, guymager, was designed to support different image file formats, to be most user-friendly and to run really fast.

{% content-ref url="memory-forensics/" %} memory-forensics {% endcontent-ref %}

USB Analysis
MacOS

Malware Analysis

In incident response, phishing, or security monitoring scenarios, you will encounter potentially malicious files that will require in depth analysis to certify the nature of the file. These files can be as overt as an executable labeled "virus.exe" or as covert as "resume.doc". There will be instances where even after all of your analysis, you still cannot verify the nature of the document, and therefore should be considered malicious until proven otherwise.

Malware Analysis Toolsets and multi-engine scanners
Resources

{% content-ref url="sandboxing.md" %} sandboxing.md {% endcontent-ref %}

Outside of sandboxing, there are a host of other tools available that can perform different types of analysis on malware. There are even a few virtual machine distributions that are dedicated to malware analysis. The foremost of them are Flare-VM and Remnux. These will usually include sandboxing tools like cuckoo, code analysis tools like Snyk and Ghidra, and a host of other handy options.

{% hint style="info" %} Remember: it is always advised to perform your malware analysis on a virtual machine, in order to prevent unwanted accidents. {% endhint %}

{% content-ref url="file-analysis.md" %} file-analysis.md {% endcontent-ref %}

Reverse Engineering

{% content-ref url="binary-analysis-reverse-engineering.md" %} binary-analysis-reverse-engineering.md {% endcontent-ref %}