Defensive methodology

Forensics (DFIR)

Collecting and analysing the traces left on a machine to answer three questions: how the attacker got in, what they did, and what they took. With one golden rule: never alter the evidence.

DefensiveVolatilityKAPEEric Zimmerman's tools

Principles

  • Integrity: work on a copy, never on the original; compute the hash before and after.
  • Chain of custody: record who handled the evidence, when and why.
  • Reproducibility: document every tool, every version, every command.

Order of volatility

Collect what disappears fastest first (RFC 3227).

  1. CPU registers and cache
  2. Memory: processes, network connections, ARP table, decrypted content
  3. Temporary files and swap
  4. Disk
  5. Remote logs and monitoring data
  6. Backups and archives

Memory analysis with Volatility 3

vol -f mem.raw windows.info
vol -f mem.raw windows.pslist
vol -f mem.raw windows.pstree
vol -f mem.raw windows.cmdline
vol -f mem.raw windows.netscan
vol -f mem.raw windows.malfind
What to look forA process with the wrong parent or the wrong path, an almost-correct name (scvhost.exe), outbound connections, injected executable memory regions (malfind).

Windows artefacts

ArtefactWhat it reveals
PrefetchPrograms executed, run count and run times.
Amcache / ShimcacheEvidence that binaries were present or executed, with hashes (Amcache).
UserAssist, RecentDocsPrograms launched and files opened by a user.
ShellBagsFolders browsed in Explorer, even if since deleted.
LNK and Jump ListsRecently opened files, including on removable media.
$MFT, $UsnJrnlFile creation, modification and deletion on NTFS.
SRUMNetwork usage per application: useful for exfiltration.
Run keys, services, tasksPersistence mechanisms.
.evtx logsSee the Windows logs page.

Linux artefacts

  • /var/log/auth.log or /var/log/secure: logons, sudo, SSH.
  • ~/.bash_history: commands typed (unless wiped).
  • /etc/crontab, /etc/cron.*, systemd timers: persistence.
  • ~/.ssh/authorized_keys: added keys.
  • /etc/passwd, /etc/shadow: accounts created or modified.
  • /tmp, /dev/shm: temporary file drops.

Building the timeline

  1. CollectKAPE or Velociraptor to gather the key artefacts.
  2. ParseEric Zimmerman's tools (MFTECmd, PECmd, EvtxECmd…).
  3. MergeA single timeline (Timeline Explorer, Plaso).
  4. PivotStart from the suspicious time and look around it.

Collection checklist

  • Photograph / note the machine's state and system time
  • Capture memory
  • Collect volatile artefacts (connections, processes) if memory capture is impossible
  • Take a disk image or a targeted collection
  • Compute the hash of every collected item
  • Fill in the chain-of-custody form
  • Store the evidence safely, read-only