Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
BRIMOR LABS LIVE RESPONSE COLLECTION
or…
How to Leverage Incident Response
Experience for FREE!!
Brian Moran
Digital Strat...
A Brief List of Topics
• Introduction
• Glance into the life of an incident responder
• “Wonder if I can do this better, f...
The Introductory Introduction
• Hello, my name is Brian Moran
– Hi Brian!
• 13+ years Air Force Active Duty
– 10 years mob...
The Introductory Introduction
• Hello, my name is Brian Moran
– Hi Brian!
• 13+ years Air Force Active Duty
– 10 years mob...
Funny Picture
• I didn’t “officially” work here, but this is one of
my favorite Photoshop creations! 
BriMor Labs - 2015
Funny Picture
BriMor Labs - 2015
The Life of an Incident Responder
• Digital Forensics/Incident Response (DFIR) is
how I decided to pay the bills.
• First ...
BriMor Labs - 2015
The Life of an Incident Responder
• For example, clients typically see Incident
Responders like this
BriMor Labs - 2015
The Life of an Incident Responder
BriMor Labs - 2015
The Life of an Incident Responder
• Or this
BriMor Labs - 2015
The Life of an Incident Responder
The Life of an Incident Responder
• So we are immediately held to high
expectations.
• Then the client describes their pro...
BriMor Labs - 2015
The Life of an Incident Responder
• How the client makes their network
infrastructure sound.
BriMor Labs - 2015
BriMor Labs - 2015
• Actual undoctored photo of network
infrastructure
BriMor Labs - 2015
BriMor Labs - 2015
The Life of an Incident Responder
• This leads to most DFIR professionals feeling
like this.
BriMor Labs - 2015
The Life of an Incident Responder
BriMor Labs - 2015
The Life of an Incident Responder
• But I digress, a glimpse into my life is not the
reason for this br...
Can We Build This? Yes We Can!
• Many times we have to collect data from multiple
systems, as quickly as we can.
• Some to...
Live Response Collection
• A single, downloadable .zip file that can be run from
any location
– Administrative privileges ...
Windows Live Response
• Collection of built-in system commands and
freely available tools
– Automated memory dump, gateway...
Windows Live Response
• Six options to choose from:
– Secure Complete
– Secure Memory Dump
– Secure Triage
– Complete
– Me...
Windows Live Response
• Six options to choose from:
– Secure Complete
– Secure Memory Dump
– Secure Triage
– Complete
– Me...
Complete option
• Complete performs the following items:
– Memory Dump (using Belkasoft RAM Capture)
– Volatile data (usin...
Memory Dump option
• Memory dump performs the following items:
– Memory Dump (using Belkasoft RAM Capture)
– Volatile data...
Triage option
• Triage performs the following items:
– Volatile data (using variety of tools)
• Uses a combination of buil...
“Secure” options
• Secure option is used when you want to protect
collected data (Complete, Memory Dump, Triage)
– Randoml...
Script output
• Script saves data to a folder with the computer
name and date/time stamp under the folder from
where the s...
Script output
BriMor Labs - 2015
COMPUTERNAME_YYYYMMDD_
HHMMSS_File_Hashes.txt
• Text file containing the MD5 and SHA256 of
every collected/generated file ...
COMPUTERNAME_YYYYMMDD_
HHMMSS_File_Hashes.txt
• Text file containing the MD5 and SHA256 of
every collected/generated file ...
COMPUTERNAME_YYYYMMDD_
HHMMSS_Processing_Details.txt
• “Logging” text file containing each command
that was run by the scr...
BriMor Labs - 2015
“ForensicImages” folder
• Location where forensic images are stored
– “DiskImage” – location of disk images created by
the...
“ForensicImages” folder
• Location where forensic images are stored
– “DiskImage” – location of disk images created by
the...
“ForensicImages/DiskImage”
folder
• The “Complete” option will store created
image(s) in this folder
– Uses AccessData’s F...
“ForensicImages/DiskImage”
folder
• This system had a “C” and “E” drive that was
imaged
BriMor Labs - 2015
“ForensicImages/Memory” folder
• The “Complete” and “MemoryDump” option will
store created memory dump in this folder
– Us...
“ForensicImages/Memory” folder
• The “Complete” and “MemoryDump” option will
store created memory dump in this folder
– Us...
“LiveResponseData” folder
• Contains a total of five subfolders
– “BasicInfo” – Various types of system Information
– “Cop...
“LiveResponseData” folder
• Contains a total of five subfolders
– “BasicInfo” – Various types of system Information
– “Cop...
BriMor Labs - 2015
“LiveResponseDataBasicInfo”
folder
• Contains primarily system information,
including:
– Alternate Data...
BriMor Labs - 2015
“LiveResponseDataBasicInfo”
folder
• Contains primarily system information,
including:
– Alternate Data...
BriMor Labs - 2015
“LiveResponseDataCopiedFiles”
folder
• Contains files copied from the system, including:
– Web browser ...
BriMor Labs - 2015
“LiveResponseDataCopiedFiles”
folder
• Contains files copied from the system, including:
– Web browser ...
BriMor Labs - 2015
“LiveResponseDataNetworkInfo”
folder
• Contains primarily network related
information including:
– ARP
...
BriMor Labs - 2015
“LiveResponseDataNetworkInfo”
folder
• Contains primarily network related
information including:
– ARP
...
“LiveResponseDataPersistence
Mechanisms” folder
• Contains information related to persistence
mechanisms on the system inc...
“LiveResponseDataPersistence
Mechanisms” folder
• Contains information related to persistence
mechanisms on the system inc...
“LiveResponseDataUserInfo”
folder
• Contains information related to users of the
system, including:
– Logons
– Listing of ...
“LiveResponseDataUserInfo”
folder
• Contains information related to users of the
system, including:
– Logons
– Listing of ...
What you see is what you get
• Script output is plain-text or html. No unique
obfuscation attempts or proprietary file
for...
Examples of gathered data
• ZeroAccess and POS RAM scraper present in
CurrentVersionRun output from autoruns
BriMor Labs -...
Examples of gathered data
• ZeroAccess and POS RAM scraper present in
CurrentVersionRun output from autoruns
BriMor Labs -...
Examples of gathered data
• ZeroAccess using Alternate Data Streams on a
Windows XP system
BriMor Labs - 2015
Examples of gathered data
BriMor Labs - 2015
Examples of gathered data
• Another POS RAM scraper, using running as a
service as the persistence mechanism
– “Funny” sto...
Examples of gathered data
BriMor Labs - 2015
Examples of gathered data
• Poweliks malware present in autoruns output
– Malware is stored entirely in registry key, it d...
Examples of gathered data
BriMor Labs - 2015
Short Case Study
• A user complains their system is running slow
• IT admin runs “Complete” version of the Live
Response C...
Short Case Study
• First stop is “autorunsc.txt” file. Strange entry
noted under the “CurrentVersionRun” path.
BriMor Labs...
Short Case Study
• First stop is “autorunsc.txt” file. Strange entry
noted under the “CurrentVersionRun” path.
BriMor Labs...
Short Case Study
• “msofficeservice” kind of seems legitimate
• Hmm..maybe not, since the company is
“Google Labs”
BriMor ...
Short Case Study
• “msofficeservice” kind of seems legitimate
• Hmm..maybe not, since the company is
“Google Labs”
BriMor ...
Short Case Study
• “msofficeservice” kind of seems legitimate
• Hmm..maybe not, since the company is
“Google Labs”
• Since...
BriMor Labs - 2015
Short Case Study
• File detected as malicious by virustotal
– 23/45 back in 2012
BriMor Labs - 2015
Short Case Study
BriMor Labs - 2015
Short Case Study
• Since we have the disk image, let’s check out
the folder where the executable resides
Short Case Study
• We can mount the image using FTK Imager
Lite (included in the Live Response Collection)
• Browse to
“Wi...
Short Case Study
• We can mount the image using FTK Imager
Lite (included in the Live Response Collection)
• Browse to
“Wi...
Short Case Study
• Select “File”
BriMor Labs - 2015
Short Case Study
• Select “File”
BriMor Labs - 2015
Short Case Study
• Select “Add Evidence Item”
BriMor Labs - 2015
Short Case Study
• Select “Add Evidence Item”
BriMor Labs - 2015
Short Case Study
• Select Source box pops up
BriMor Labs - 2015
Short Case Study
• Select Source box pops up
BriMor Labs - 2015
BriMor Labs - 2015
Short Case Study
• Select “Image File”
BriMor Labs - 2015
Short Case Study
• Select “Image File”
BriMor Labs - 2015
Short Case Study
• Click “Next >”
BriMor Labs - 2015
Short Case Study
• Click “Next >”
Short Case Study
• Select File box pops up
BriMor Labs - 2015
Short Case Study
• Select File box pops up
BriMor Labs - 2015
Short Case Study
• Click “Browse” and browse to source path
– Be sure to select E01 file, not E01.txt file
BriMor Labs - 2...
Short Case Study
• Click “Browse” and browse to source path
– Be sure to select E01 file, not E01.txt file
BriMor Labs - 2...
BriMor Labs - 2015
Short Case Study
• Click “Finish”
BriMor Labs - 2015
Short Case Study
• Click “Finish”
BriMor Labs - 2015
Short Case Study
• Navigate to path of interest
• “C:Documents and
SettingsAdministratorLocal
SettingsA...
BriMor Labs - 2015
Short Case Study
• Navigate to path of interest
• “C:Documents and
SettingsAdministratorLocal
SettingsA...
Short Case Study
• Two files
– msofficeservice.exe
– winrnfsl32.dll
• Maybe the dll is needed by the exe. We can
look at i...
Short Case Study
BriMor Labs - 2015
Short Case Study
• Uh oh!! That looks a lot like a log file of key
strokes and window interactions
– HINT: It is exactly t...
BriMor Labs - 2015
Short Case Study Summary
• We identified a strange file thanks to the
output of autoruns
• Searching fo...
BriMor Labs - 2015
Short Case Study Summary
• We identified a strange file thanks to the
output of autoruns
• Searching fo...
BriMor Labs - 2015
Checklists for each OS!
• A checklist is included for each operating
system
– Creates starting place fo...
BriMor Labs - 2015
BriMor Labs - 2015
Why free?!?!
• Initial data gathering can help you reveal
problems without needing external consulting
– Saves your busine...
Why free?!?! (cont.)
• Scripts collect data from “common” areas
incident responders/digital forensic analysts look
at firs...
Questions?
Contact Us!
Email: brian@brimorlabs.com
Phone: 443.834.8280
Website: www.brimorlabs.com
Blog: www.brimorlabsblo...
Upcoming SlideShare
Loading in …5
×

Live Response Collection Overview

2,333 views

Published on

Bsides Charm Windows Live Response Collection Overview. Originally presented at Bsides Charm on April 12, 2015

Published in: Technology
  • Be the first to comment

Live Response Collection Overview

  1. 1. BRIMOR LABS LIVE RESPONSE COLLECTION or… How to Leverage Incident Response Experience for FREE!! Brian Moran Digital Strategy Consultant- BriMor Labs Millersville, Maryland 12 APR 2015
  2. 2. A Brief List of Topics • Introduction • Glance into the life of an incident responder • “Wonder if I can do this better, faster, stronger?” – (all right, you got me…not stronger. Just in an easier way) • Overview of Live Response Collection • Questions/comments/etc.? BriMor Labs - 2015
  3. 3. The Introductory Introduction • Hello, my name is Brian Moran – Hi Brian! • 13+ years Air Force Active Duty – 10 years mobile exploitation/DFIR experience • Co-winner: Unofficial Forensic 4Cast Awards 2012 -- Best Photoshop of Lee Whitfield • Worked here…. BriMor Labs - 2015
  4. 4. The Introductory Introduction • Hello, my name is Brian Moran – Hi Brian! • 13+ years Air Force Active Duty – 10 years mobile exploitation/DFIR experience • Co-winner: Unofficial Forensic 4Cast Awards 2012 -- Best Photoshop of Lee Whitfield • Worked here…. BriMor Labs - 2015
  5. 5. Funny Picture • I didn’t “officially” work here, but this is one of my favorite Photoshop creations!  BriMor Labs - 2015
  6. 6. Funny Picture BriMor Labs - 2015
  7. 7. The Life of an Incident Responder • Digital Forensics/Incident Response (DFIR) is how I decided to pay the bills. • First rule of incident response is always expect the EXACT opposite of what a client tells you BriMor Labs - 2015
  8. 8. BriMor Labs - 2015 The Life of an Incident Responder • For example, clients typically see Incident Responders like this
  9. 9. BriMor Labs - 2015 The Life of an Incident Responder
  10. 10. BriMor Labs - 2015 The Life of an Incident Responder • Or this
  11. 11. BriMor Labs - 2015 The Life of an Incident Responder
  12. 12. The Life of an Incident Responder • So we are immediately held to high expectations. • Then the client describes their problem  BriMor Labs - 2015
  13. 13. BriMor Labs - 2015 The Life of an Incident Responder • How the client makes their network infrastructure sound.
  14. 14. BriMor Labs - 2015
  15. 15. BriMor Labs - 2015 • Actual undoctored photo of network infrastructure
  16. 16. BriMor Labs - 2015
  17. 17. BriMor Labs - 2015 The Life of an Incident Responder • This leads to most DFIR professionals feeling like this.
  18. 18. BriMor Labs - 2015 The Life of an Incident Responder
  19. 19. BriMor Labs - 2015 The Life of an Incident Responder • But I digress, a glimpse into my life is not the reason for this briefing
  20. 20. Can We Build This? Yes We Can! • Many times we have to collect data from multiple systems, as quickly as we can. • Some tools exist to do this, but I wanted something that was – Repeatable – Portable – Customizable – Easy to use – And most importantly….FREE!!! BriMor Labs - 2015
  21. 21. Live Response Collection • A single, downloadable .zip file that can be run from any location – Administrative privileges allows more collection of data, but not necessary • Major operating systems are currently covered – Windows (XP, Vista, 7, 8, Server 2003, 2008, 2012) – OS X – Unix/Linux • Development on all platforms is always continuing • http://www.brimorlabs.com/Tools/LiveResponse.zip BriMor Labs - 2015
  22. 22. Windows Live Response • Collection of built-in system commands and freely available tools – Automated memory dump, gateway ARP correlation, Registry entries, Sysinternals, etc. • The executable presents an easy to understand GUI, so ANYONE can use it! BriMor Labs - 2015
  23. 23. Windows Live Response • Six options to choose from: – Secure Complete – Secure Memory Dump – Secure Triage – Complete – Memory Dump – Triage • GUI is an HTML application, so you can customize the batch scripts (not the names) and the GUI will still work! BriMor Labs - 2015
  24. 24. Windows Live Response • Six options to choose from: – Secure Complete – Secure Memory Dump – Secure Triage – Complete – Memory Dump – Triage • GUI is an HTML application, so you can customize the batch scripts (not the names) and the GUI will still work! BriMor Labs - 2015
  25. 25. Complete option • Complete performs the following items: – Memory Dump (using Belkasoft RAM Capture) – Volatile data (using variety of tools) – Disk imaging (using FTK command line) • Disk imaging images all mounted drives, with the exception of network shares – Images will only be created if tool is run from an external (non- OS) drive (ie Can’t run it from C: ) – Also performs destination free space check prior to each imaging iteration Processing time depends on number and size of drives BriMor Labs - 2015
  26. 26. Memory Dump option • Memory dump performs the following items: – Memory Dump (using Belkasoft RAM Capture) – Volatile data (using variety of tools) • Memory dump can be created using other tools too, but I prefer Belkasoft RAM Capture Processing time depends on size of memory (15-30 minutes usually) BriMor Labs - 2015
  27. 27. Triage option • Triage performs the following items: – Volatile data (using variety of tools) • Uses a combination of built-in Windows commands and third party tools to gather data Processing time depends on amount of data to be collected (5 - 15 minutes usually) BriMor Labs - 2015
  28. 28. “Secure” options • Secure option is used when you want to protect collected data (Complete, Memory Dump, Triage) – Randomly generated 16 character password – Uses 7zip to compress and encrypt the data – Sdelete used to securely delete data – makes data recovery very difficult (*I will never say impossible) Remember to copy the password. Without the password, brute forcing the data is the only way in! BriMor Labs - 2015
  29. 29. Script output • Script saves data to a folder with the computer name and date/time stamp under the folder from where the script was run • Two folders and two text files – “ForensicImages” – “LiveResponseData” – COMPUTERNAME_YYYYMMDD_HHMMSS_File_Hashe s.txt – COMPUTERNAME_YYYYMMDD_HHMMSS_Process_D etails.txt BriMor Labs - 2015
  30. 30. Script output BriMor Labs - 2015
  31. 31. COMPUTERNAME_YYYYMMDD_ HHMMSS_File_Hashes.txt • Text file containing the MD5 and SHA256 of every collected/generated file and the full path to that file – Excludes “DiskImage” folder – But does include memory dump, if created BriMor Labs - 2015
  32. 32. COMPUTERNAME_YYYYMMDD_ HHMMSS_File_Hashes.txt • Text file containing the MD5 and SHA256 of every collected/generated file and the full path to that file – Excludes “DiskImage” folder – But does include memory dump, if created BriMor Labs - 2015
  33. 33. COMPUTERNAME_YYYYMMDD_ HHMMSS_Processing_Details.txt • “Logging” text file containing each command that was run by the script and (if present) any error messages from running that command BriMor Labs - 2015
  34. 34. BriMor Labs - 2015
  35. 35. “ForensicImages” folder • Location where forensic images are stored – “DiskImage” – location of disk images created by the script (or manually) – “Memory” – location of memory dumps created by the script (or manually) BriMor Labs - 2015
  36. 36. “ForensicImages” folder • Location where forensic images are stored – “DiskImage” – location of disk images created by the script (or manually) – “Memory” – location of memory dumps created by the script (or manually) BriMor Labs - 2015
  37. 37. “ForensicImages/DiskImage” folder • The “Complete” option will store created image(s) in this folder – Uses AccessData’s FTK Imager command line to create an E01 image, with a compression level of “4” and fragment size of 4096M (4GB) – Built-in checks to prohibit automated imaging of the OS drive to itself – Images ALL mounted drives (except network shares) • Will not image the destination drive – Built-in checks to ensure destination drive has enough free space for image BriMor Labs - 2015
  38. 38. “ForensicImages/DiskImage” folder • This system had a “C” and “E” drive that was imaged BriMor Labs - 2015
  39. 39. “ForensicImages/Memory” folder • The “Complete” and “MemoryDump” option will store created memory dump in this folder – Uses Belkasoft’s RamCapture to create a memory dump – Filename: “COMPUTERNAME_YYYYMMDD_HHMMSS_mem.dmp” • You can customize and use other tools if you like, but I’ve had the best experience with Belkasoft BriMor Labs - 2015
  40. 40. “ForensicImages/Memory” folder • The “Complete” and “MemoryDump” option will store created memory dump in this folder – Uses Belkasoft’s RamCapture to create a memory dump – Filename: “COMPUTERNAME_YYYYMMDD_HHMMSS_mem.dmp” • You can customize and use other tools if you like, but I’ve had the best experience with Belkasoft BriMor Labs - 2015
  41. 41. “LiveResponseData” folder • Contains a total of five subfolders – “BasicInfo” – Various types of system Information – “CopiedFiles” – Files copied from the system – “NetworkInfo” – Network information about the system – “PersistenceMechanisms” – Ways that items can persist on the system (cough cough malware) – “UserInfo” – User information BriMor Labs - 2015
  42. 42. “LiveResponseData” folder • Contains a total of five subfolders – “BasicInfo” – Various types of system Information – “CopiedFiles” – Files copied from the system – “NetworkInfo” – Network information about the system – “PersistenceMechanisms” – Ways that items can persist on the system (cough cough malware) – “UserInfo” – User information BriMor Labs - 2015
  43. 43. BriMor Labs - 2015 “LiveResponseDataBasicInfo” folder • Contains primarily system information, including: – Alternate Data streams – Hashes of files in %Temp% (User and System) and System32 folder – Last Activity View – PsLoglist – Running Processes – Possible Unicode files/directories
  44. 44. BriMor Labs - 2015 “LiveResponseDataBasicInfo” folder • Contains primarily system information, including: – Alternate Data streams – Hashes of files in %Temp% (User and System) and System32 folder – Last Activity View – PsLoglist – Running Processes – Possible Unicode files/directories
  45. 45. BriMor Labs - 2015 “LiveResponseDataCopiedFiles” folder • Contains files copied from the system, including: – Web browser (Internet Explorer, Firefox, Chrome) – Event Logs – Logfile – MFT – Prefetch – Registry Hives – USNJrnl NOTE: Files copied into folder associated with the type of file that was copied
  46. 46. BriMor Labs - 2015 “LiveResponseDataCopiedFiles” folder • Contains files copied from the system, including: – Web browser (Internet Explorer, Firefox, Chrome) – Event Logs – Logfile – MFT – Prefetch – Registry Hives – USNJrnl NOTE: Files copied into folder associated with the type of file that was copied
  47. 47. BriMor Labs - 2015 “LiveResponseDataNetworkInfo” folder • Contains primarily network related information including: – ARP – Cports – Internet Settings – Netstat – Routing table
  48. 48. BriMor Labs - 2015 “LiveResponseDataNetworkInfo” folder • Contains primarily network related information including: – ARP – Cports – Internet Settings – Netstat – Routing table
  49. 49. “LiveResponseDataPersistence Mechanisms” folder • Contains information related to persistence mechanisms on the system including: – Autoruns – Loaded drivers – Scheduled tasks NOTE: More often than not, if you have an infected system, you will find the evidence in here BriMor Labs - 2015
  50. 50. “LiveResponseDataPersistence Mechanisms” folder • Contains information related to persistence mechanisms on the system including: – Autoruns – Loaded drivers – Scheduled tasks NOTE: More often than not, if you have an infected system, you will find the evidence in here BriMor Labs - 2015
  51. 51. “LiveResponseDataUserInfo” folder • Contains information related to users of the system, including: – Logons – Listing of users – Current User BriMor Labs - 2015
  52. 52. “LiveResponseDataUserInfo” folder • Contains information related to users of the system, including: – Logons – Listing of users – Current User BriMor Labs - 2015
  53. 53. What you see is what you get • Script output is plain-text or html. No unique obfuscation attempts or proprietary file formats – Memory dump, disk image(s), and copied files are obvious exceptions • Can write/create your own parsing mechanism BriMor Labs - 2015
  54. 54. Examples of gathered data • ZeroAccess and POS RAM scraper present in CurrentVersionRun output from autoruns BriMor Labs - 2015
  55. 55. Examples of gathered data • ZeroAccess and POS RAM scraper present in CurrentVersionRun output from autoruns BriMor Labs - 2015
  56. 56. Examples of gathered data • ZeroAccess using Alternate Data Streams on a Windows XP system BriMor Labs - 2015
  57. 57. Examples of gathered data BriMor Labs - 2015
  58. 58. Examples of gathered data • Another POS RAM scraper, using running as a service as the persistence mechanism – “Funny” story about this malware…ask me after the presentation! BriMor Labs - 2015
  59. 59. Examples of gathered data BriMor Labs - 2015
  60. 60. Examples of gathered data • Poweliks malware present in autoruns output – Malware is stored entirely in registry key, it does not “write itself to disk” in a typical fashion BriMor Labs - 2015
  61. 61. Examples of gathered data BriMor Labs - 2015
  62. 62. Short Case Study • A user complains their system is running slow • IT admin runs “Complete” version of the Live Response Collection…just in case • Events (sort of) occur in real time BriMor Labs - 2015
  63. 63. Short Case Study • First stop is “autorunsc.txt” file. Strange entry noted under the “CurrentVersionRun” path. BriMor Labs - 2015
  64. 64. Short Case Study • First stop is “autorunsc.txt” file. Strange entry noted under the “CurrentVersionRun” path. BriMor Labs - 2015
  65. 65. Short Case Study • “msofficeservice” kind of seems legitimate • Hmm..maybe not, since the company is “Google Labs” BriMor Labs - 2015
  66. 66. Short Case Study • “msofficeservice” kind of seems legitimate • Hmm..maybe not, since the company is “Google Labs” BriMor Labs - 2015
  67. 67. Short Case Study • “msofficeservice” kind of seems legitimate • Hmm..maybe not, since the company is “Google Labs” • Since we have the hashes, lets do a quick Google search BriMor Labs - 2015
  68. 68. BriMor Labs - 2015 Short Case Study • File detected as malicious by virustotal – 23/45 back in 2012
  69. 69. BriMor Labs - 2015 Short Case Study
  70. 70. BriMor Labs - 2015 Short Case Study • Since we have the disk image, let’s check out the folder where the executable resides
  71. 71. Short Case Study • We can mount the image using FTK Imager Lite (included in the Live Response Collection) • Browse to “Windows_Live_ResponseFTK_Imager_Lite_3 .1.1” and run “FTK Imager.exe” BriMor Labs - 2015
  72. 72. Short Case Study • We can mount the image using FTK Imager Lite (included in the Live Response Collection) • Browse to “Windows_Live_ResponseFTK_Imager_Lite_3 .1.1” and run “FTK Imager.exe” BriMor Labs - 2015
  73. 73. Short Case Study • Select “File” BriMor Labs - 2015
  74. 74. Short Case Study • Select “File” BriMor Labs - 2015
  75. 75. Short Case Study • Select “Add Evidence Item” BriMor Labs - 2015
  76. 76. Short Case Study • Select “Add Evidence Item” BriMor Labs - 2015
  77. 77. Short Case Study • Select Source box pops up BriMor Labs - 2015
  78. 78. Short Case Study • Select Source box pops up BriMor Labs - 2015
  79. 79. BriMor Labs - 2015 Short Case Study • Select “Image File”
  80. 80. BriMor Labs - 2015 Short Case Study • Select “Image File”
  81. 81. BriMor Labs - 2015 Short Case Study • Click “Next >”
  82. 82. BriMor Labs - 2015 Short Case Study • Click “Next >”
  83. 83. Short Case Study • Select File box pops up BriMor Labs - 2015
  84. 84. Short Case Study • Select File box pops up BriMor Labs - 2015
  85. 85. Short Case Study • Click “Browse” and browse to source path – Be sure to select E01 file, not E01.txt file BriMor Labs - 2015
  86. 86. Short Case Study • Click “Browse” and browse to source path – Be sure to select E01 file, not E01.txt file BriMor Labs - 2015
  87. 87. BriMor Labs - 2015 Short Case Study • Click “Finish”
  88. 88. BriMor Labs - 2015 Short Case Study • Click “Finish”
  89. 89. BriMor Labs - 2015 Short Case Study • Navigate to path of interest • “C:Documents and SettingsAdministratorLocal SettingsApplication Datamsofficemsofficeservice.exe”
  90. 90. BriMor Labs - 2015 Short Case Study • Navigate to path of interest • “C:Documents and SettingsAdministratorLocal SettingsApplication Datamsofficemsofficeservice.exe”
  91. 91. Short Case Study • Two files – msofficeservice.exe – winrnfsl32.dll • Maybe the dll is needed by the exe. We can look at it in the hex editor pane in FTK Imager BriMor Labs - 2015
  92. 92. Short Case Study BriMor Labs - 2015
  93. 93. Short Case Study • Uh oh!! That looks a lot like a log file of key strokes and window interactions – HINT: It is exactly that BriMor Labs - 2015
  94. 94. BriMor Labs - 2015 Short Case Study Summary • We identified a strange file thanks to the output of autoruns • Searching for the hash determined the file was malicious • A quick check of the folder reveals not only is the file malicious, it is actually a key logger
  95. 95. BriMor Labs - 2015 Short Case Study Summary • We identified a strange file thanks to the output of autoruns • Searching for the hash determined the file was malicious • A quick check of the folder reveals not only is the file malicious, it is actually a key logger
  96. 96. BriMor Labs - 2015 Checklists for each OS! • A checklist is included for each operating system – Creates starting place for “what” to collect • You can put your company logo at the top… • …And you now have an incident response collection plan for each operating system!
  97. 97. BriMor Labs - 2015
  98. 98. BriMor Labs - 2015
  99. 99. Why free?!?! • Initial data gathering can help you reveal problems without needing external consulting – Saves your business time, money, and resources – Saves DFIR consultant time, money, and resources • If you want external help, providing already gathered data can expedite incident response lifecycle – Saves your business time, money, and resources – Saves DFIR consultant time, money, and resources BriMor Labs - 2015
  100. 100. Why free?!?! (cont.) • Scripts collect data from “common” areas incident responders/digital forensic analysts look at first – Saves your business time, money, and resources – Saves DFIR consultant time, money, and resources • If scripts can help DFIR consultant remotely diagnose issue remotely, no need to pay travel, lodging, incidentals, etc. costs – Saves your business time, money, and resources – Saves DFIR consultant time, money, and resources BriMor Labs - 2015
  101. 101. Questions? Contact Us! Email: brian@brimorlabs.com Phone: 443.834.8280 Website: www.brimorlabs.com Blog: www.brimorlabsblog.com Twitter: @brimorlabs @brianjmoran BriMor Labs - 2015

×