- Since Windows 11, hard drive encryption can be applied automatically if Windows detects that the requirements are met. Users could not be aware that their storage may be encrypted.
- CAINE can be used for first analysis
- Schrödinger’s Incident — we know if it is an incident now before we’ve looked into it.
- Terminology:
- Incident Analysis
- Impact analysis
- Incident Response
- Immediate reactions
- Mandia et al. 2003 and “The investigative process” by Casey, 2004
- Incident Handling
- Controlling/Management
- FPC Full Packet Captures
- PSTR Packet Strings (Log only from strings of network packets)
- Incident Analysis
- Chain of custody — documentation of all steps and insights and where and how they were retrieved. Important when it goes to court.
- Types of data
- Persistent data
- Volatile Data
- Very Volatile Data
- (!) After pachting for a zero day, you should also check if the systems were already compromised.
- Specialized malware types:
- Scareware — Malicous software which threatens a user. For example, it is claiming an infection, the relase of sensible data, … And it offers a path to pay something to not realize the threat.
- Adware — Malicous software which loads advertisement so that ad platforms register traffic.
- Spyware — Malicious software which only collects and distributes sensitive data.
- Timezones are imporant to consider when documenting incidents. Make sure that you are using only one time zone and check which time zone tools are using.
- There are Emoji-Domains
- Search also for base64 patterns
- Network package data can be very useful, but to store it for a longer time period is very ressource intensive, obviously.
- Flow data can be a compromise, to only log for some time which systems talked to which other systems.
- Logs should be protected like backups, also after an successful attack.
- GitHub — redcanaryco/atomic-red-team: Small and highly portable detection tests based on MITRE’s ATT&CK. Atomic Red Team test library
- Suricata — network analyzing tool
- CFReDS Portal is a page for image which can be analyzed with filesystem forensic.
- With GitHub — fox-it/dissect: Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group). you can scan images for interesting files
- See Forensic site with tools to learn
- Most malware wants to persist itself. Therefore, it is a good idea to search the possible persistence vectors.
- Tip: When handeling with files, change the suffix to prevent accidently execution. E.g. bla.exe_
Leave a Reply
You must be logged in to post a comment.