📘 Manual

Can be hard (no consistency). Are they different by accident or from malicous intent. Baseline reference (what the settings should be). Configs have only one place to set thing. Attacker motivation:

• Get access
• Avoid detection
• Make the response harder
• Make malware to work

Getting Access

1. has the remote access been enabled?
2. file sharing enabled?
3. config to launch different progs?

Avoiding detection

Common anti-forensic techniques.

prevent detection (disable firewalls, anti-virus). Rootkits are in malware section.

1. have any prevention tools been disabled?
2. installed mal certificates to trick prevention tools?
3. have many detection tools been disabled?

Read more about the above techniques: Wipe the drive! Stealthy Malware Persistence - Part 1 and Wipe the drive! Stealthy Malware Persistence - Part 2.

Response

Response harder (disable endpoint visibility, accounts (or reduce privs), reduce or disable logs, backups, volume shadow)

1. Were any accs disabled?
2. Visibility tools disabled?
3. Settings to record less data
   1. audit settings changed?
   2. logs cleared
   3. Backup disabled?

Malware Assist

Changes needed by malware? Change exe path, lib path, hosts file.

👣 On a Windows machine. Registry, Congif files (app specific or OS).

👣 On a macOS machine. Plists

Escalation

Reference

[1] Practical Malware Analysis, M. Silkorski, A. Honig

[2] SANS cheatsheet on malware analysis

[3] SANS tips on malware analysis