• Threat Hunting on Linux

    Show sys­tem files which were changed after installation. dpkg --verify Check var­i­ous secu­ri­ty relat­ed issues: checksecurity Tools

  • Linux incidence response

    Note: See many, many com­mands from the Lin­ux privesc post. Analyze logs On sys­tems: Browse through the /var/log files. On new­er sys­tems with systemd: Note: If you have an image, you can also ana­lyze logs from a mount­ed image like journalctl --root /mnt/hdd23 -t ssh ... Analyze startup services On SysVinit: Browse through /etc/init.d/ On…

  • Detecting Malware

    Windows Detect­ing PE/DLL injection:

  • Goal: See on a sys­tem if some spe­cif­ic exe­cute­able was executed.

  • Windows Forensic

    Registry Windows Event Logging File system analysis See the NTFS arti­cle about logging.

  • Dissec

    Dis­sect is a foren­sic tool for file sys­tem images,

  • Use cas­es Tools Stan­dard unix tools like awk can also been used with a cat of a flow file. nfdump SiLK argus

  • CAINE can be used as a live sys­tem to per­form foren­sic stud­ies of a sys­tem (e.g. after a Incident).

  • General tools Imaging tools dd, of course. Note that it makes sense to set the prop­er block size (some­times 4k, but most hard dri­ves are using 512), so that, when an error occued, the exact sec­tor is shown which can after­wards be skipped. dd if=/dev/sda of=/external/file.md5 bs=512 ewfacquire sudo ewfac­quire /dev/sda Advan­tages: aff4 advanced forensic…

  • Memory dump

    After­wards: See Ana­lyz­ing memory Linux Prozess memory dump Find out which mem­o­ry seg­ments are used by an appli­ca­tion via its PID: cat /proc/<pid>/maps Dump the used mem­o­ry from an appli­ca­tion: (cred­it) #!/bin/bash grep rw-p /proc/$1/maps \ | sed -n 's/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p' \ | while read start stop; do \ gdb --batch --pid $1 -ex \…