A Smattering of Links and Other Stuff
Registry
Well, 2014 ended with just one submission for the WRA 2/e Contest. That's unfortunate, but it doesn't alter my effort in updating the book in any way. For me, this book will be something to look forward to in 2015, and something I'm pretty excited about, in part because I'll be presenting more information about the analysis processes I've been using, processes that have led to some pretty interesting findings regarding various incidents and malware.
In other Registry news, Eric Zimmerman has created an offline Registry parser (in C#) and posted it to GitHub. Along with Eric's Shellbag Explorer tool, it really seems as if his interest in the Windows Registry is burgeoning, which is great. Hopefully, this will generate some of the same interest in others.
Tools
Willi has a new tool available called process-forest, which parses event ID 4688 records within the Security.evtx file to develop a process tree. If you have the necessary auditing enabled, and have increased the default size of your Security Event Log, this tool will provide you with some great data!
Tool Updates
Speaking of the Registry, I've made some updates to several of my tools. One was to extend the inprocserver.pl plugin by creating a RegRipper plugin (fileless.pl) that could be used to scan any hive file for indications of "fileless" malware, such as Phasebot or Poweliks. My testing of this plugin was limited, but it works for other search criteria.
I've also made some minor updates to other tools.
Widening the Aperture through Sharing
I was doing some reading recently regarding attribution as a result of DFIR analysis, which included Richard's recent post. From there, I followed the link to Rid and Buchanan paper (PDF), which was fascinating reading. I took a lot of what I read and applied it to my thinking on threat intel in general, and not just to attribution. One of the things I've been noodling over is how to widen the aperture on the indicators that we initially collect/have access to, and how that relates to the incident response process.
One of the big things that immediately jumped into my head was "sharing".
Secureworks Research Blog post
Speaking of sharing, this article (titled "Sleeper Agents") was published recently on the Dell Secureworks Research Blog. It's a great example of something seen in the wild, and
Sharing Indicators
Continuing with the sharing theme, @binaryz0ne posted an article to his blog regarding artifacts of user account creation, looking at differences between the use of the command line and GUI for creating local accounts on a system (i.e., not AD accounts).
A couple of things to point out...
First, this testing is for account creation. The accounts are being created, but profiles are not created until someone logs in using the credentials, as mentioned by Azeem.
Second, if you were interested in just account creation information, then collecting ALL available timeline information might be time consuming. Let's say you found the event log record for account creation and wanted to focus on just that aspect of analysis. Using the "Sniper Forensics" principles, you could create a timeline from just the Windows Event Logs (Security, LocalSessionManager, RemoteConnectionManager, maybe even TaskScheduler, just in case...), the SAM Registry hive (samparse_tln.pl RegRipper plugin), prefetch files (if available), and the user's (account collected from Windows Event Log record) NTUSER.DAT and USRCLASS.DAT.
I've seen instances of both (use of CLI and GUI to create accounts...) in the wild, and it's great to see someone putting in the effort to not only test something like this, but to also share their findings. Thanks, Ali!
I've been doing some testing of Powershell, and have been using a .ps1 file to create a user and add it to the local Administrators group, and finding some truly fascinating artifacts.
Python
One of the things I've been working on (well, working off and on...) is learning to program in Python. I do plan to maintain my Perl programming, but learning Python is one of those things I've laid out as a goal for myself. I've already written one small program (destlist.py) that I do use quite often for parsing the DestList streams out of automaticDestination Jump Lists, including adding that information to a timeline. I don't expect to become an expert programmer, but I want to become more proficient, and the best way to do that is to start developing projects.
Not long ago, I was doing some reading and ran across this ISC post that mentions the impacket library (from CoreLabs), and I thought that was pretty interesting. Not long after, I was reading Jon Glass's blog and ran across another mention of the impacket library, and solutions Jon has been looking at for parsing the IE10+ WebCacheV01.dat history database (part 3 of which can be found here). I've been pretty successful using the NirSoft ESE Database Viewer so far, but like Jon, I may reach the point where I'd like to have something that I can extend, or better yet, provide output in a format that I can easily incorporate into my analysis processes.
In other Registry news, Eric Zimmerman has created an offline Registry parser (in C#) and posted it to GitHub. Along with Eric's Shellbag Explorer tool, it really seems as if his interest in the Windows Registry is burgeoning, which is great. Hopefully, this will generate some of the same interest in others.
Tools
Willi has a new tool available called process-forest, which parses event ID 4688 records within the Security.evtx file to develop a process tree. If you have the necessary auditing enabled, and have increased the default size of your Security Event Log, this tool will provide you with some great data!
Tool Updates
Speaking of the Registry, I've made some updates to several of my tools. One was to extend the inprocserver.pl plugin by creating a RegRipper plugin (fileless.pl) that could be used to scan any hive file for indications of "fileless" malware, such as Phasebot or Poweliks. My testing of this plugin was limited, but it works for other search criteria.
I've also made some minor updates to other tools.
Widening the Aperture through Sharing
I was doing some reading recently regarding attribution as a result of DFIR analysis, which included Richard's recent post. From there, I followed the link to Rid and Buchanan paper (PDF), which was fascinating reading. I took a lot of what I read and applied it to my thinking on threat intel in general, and not just to attribution. One of the things I've been noodling over is how to widen the aperture on the indicators that we initially collect/have access to, and how that relates to the incident response process.
One of the big things that immediately jumped into my head was "sharing".
Secureworks Research Blog post
Speaking of sharing, this article (titled "Sleeper Agents") was published recently on the Dell Secureworks Research Blog. It's a great example of something seen in the wild, and
Sharing Indicators
Continuing with the sharing theme, @binaryz0ne posted an article to his blog regarding artifacts of user account creation, looking at differences between the use of the command line and GUI for creating local accounts on a system (i.e., not AD accounts).
A couple of things to point out...
First, this testing is for account creation. The accounts are being created, but profiles are not created until someone logs in using the credentials, as mentioned by Azeem.
Second, if you were interested in just account creation information, then collecting ALL available timeline information might be time consuming. Let's say you found the event log record for account creation and wanted to focus on just that aspect of analysis. Using the "Sniper Forensics" principles, you could create a timeline from just the Windows Event Logs (Security, LocalSessionManager, RemoteConnectionManager, maybe even TaskScheduler, just in case...), the SAM Registry hive (samparse_tln.pl RegRipper plugin), prefetch files (if available), and the user's (account collected from Windows Event Log record) NTUSER.DAT and USRCLASS.DAT.
I've seen instances of both (use of CLI and GUI to create accounts...) in the wild, and it's great to see someone putting in the effort to not only test something like this, but to also share their findings. Thanks, Ali!
I've been doing some testing of Powershell, and have been using a .ps1 file to create a user and add it to the local Administrators group, and finding some truly fascinating artifacts.
PythonOne of the things I've been working on (well, working off and on...) is learning to program in Python. I do plan to maintain my Perl programming, but learning Python is one of those things I've laid out as a goal for myself. I've already written one small program (destlist.py) that I do use quite often for parsing the DestList streams out of automaticDestination Jump Lists, including adding that information to a timeline. I don't expect to become an expert programmer, but I want to become more proficient, and the best way to do that is to start developing projects.
Not long ago, I was doing some reading and ran across this ISC post that mentions the impacket library (from CoreLabs), and I thought that was pretty interesting. Not long after, I was reading Jon Glass's blog and ran across another mention of the impacket library, and solutions Jon has been looking at for parsing the IE10+ WebCacheV01.dat history database (part 3 of which can be found here). I've been pretty successful using the NirSoft ESE Database Viewer so far, but like Jon, I may reach the point where I'd like to have something that I can extend, or better yet, provide output in a format that I can easily incorporate into my analysis processes.