Forensic Environment Setup

📘 BTFM

This is an attempt to collect all the most frequently used commands for forensic analysis.

Collection and Analysis

There are numerous tools available for collecting and analysing artefacts and evidence. I will provide an overview, relevant links, or even comparison charts, depending on the tools.

Kansa and Autoruns

Run a tool to collect all the artefacts for this OS (for example, autorunc.exe for Windows) on the machines in question. I use CSV format as output whenever possible because it can be imported in a SIEM, TimeLine Explorer (Windows) or Numbers/Excel/Google Sheets. I prefer the last option because its pivoting functionality is much easier to deploy.

1. Open each file (if there are not too many)
2. Filter for untrusted or missing vendors. Such vendors as Google and Firefox might be used to trick the user. It would look like `(Not verified) Firefox.
3. Show those enabled ones (if applicable)
4. Look at the image path, and use the FindEvil SANS poster or your baseline system profile as a reference for known good to find what’s bad
5. Look at the hashes and check against known-good.
6. Check with a supernova, google Publishes and Description
7. Frequency analysis. What stands out? (see the following sections). Find possible suspicious or malicious things.
8. Check the triage files from other machines for the same IoCs (Select-String, grep etc).
9. Stacking (frequency-based outlier analysis)
10. Frequency analysis. What stands out?

🗒 If the file doesn’t have an image path (File not found), it’s likely it was moved/deleted and thus is not an active threat. What’s suspicious?

AWS Forensic Environment Setup

First of all, data that is collected for analysis within the cloud needs to be handled properly as well.

Forensic Frameworks

Here I will keep the list of useful tools for forensics, their advantages and disadvantages.

Forensics Machine Setup

This is about … .