DATA SCIENCE THE DFIR OUT OF THIS! John Lukach blog.4n6ir.com - PowerPoint PPT Presentation

I’M GONNA HAVE TO DATA SCIENCE THE DFIR OUT OF THIS! John Lukach blog.4n6ir.com @jblukach

AGENDA • DATA SOURCE • CLEAN DATA • ADD CONTEXT • VISUALIZATION

SYSMON System Monitor is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time. https://technet.microsoft.com/en-us/sysinternals/sysmon

SYSMON System Monitor does not provide collection or analysis of the events it generates, nor does it attempt to protect or hide itself from attackers. Sysmon64.exe -accepteula -i -h md5 -n -l -r

SYSMON-DFIR Michael Hagg has compiled a great list of Sysmon resources! https://github.com/MHaggis/sysmon-dfir

EVENT IDS

PROCESS CREATION

NETWORK CONNECTION

NO BLIND SPOTS A Transparent Proxy has the ability to intercept connections between clients and servers without being visible using Web Cache Communication Protocol (WCCPv2).

PYTHON-EVTX Willi Ballenthin released a pure Python parser for Windows Event Log files providing programmatic access to the File and Chunk headers, record templates and event entries. pip3 install python-evtx https://github.com/williballenthin/python-evtx

LOG VOLUME

SEARCHABLE

EXPLORE

PROCESS EXPLORER

PROCESS-FOREST Willi Ballenthin released a Python script that builds historical process hierarchies from process auditing and Symon event logs. https://github.com/williballenthin/process-forest

PYRAMID OF PAIN http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

SYSMON-FOREST.PY https://github.com/jblukach/sysmon-forest

HELP

CLEAN DATA --sqlite is the path to the SQLite database location --evtx is the path to the Sysmon Event Log location --insert is the flag to add events to the database

STATISTICS --stats on the number of processes, connections and etc.

ADD CONTEXT --dns is the path to a text file with a list of domains --hash is the path to a text file with a list of hashes --ip is the path to a text file with a list of ip addresses --meta is the path to a text file with a list of meta data

THIRD PARTY --maxmind is the path to the GeoLite2 City database pip3 install geoip2 http://dev.maxmind.com/geoip/geoip2/geolite2/ --rfc1918 flags private non-routable IP addresses pip3 install IPy

VISUALIZATION --tree builds historical structure of processes, connections & etc.

COLORS --bad --blah --evil --good --known --mark --unknown

DETAILS --detail display specifics on a process by unique identifier

DEMO

CLEAN DATA python3 sysmon-forest.py --sqlite Cerber.SQLite --evtx Cerber.evtx --insert

CLEAN DATA

STATISTICS python3 sysmon-forest.py --sqlite Cerber.SQLite --stats

STATISTICS

STATISTICS

STATISTICS

RFC1918 python3 sysmon-forest.py --sqlite Cerber.SQLite --rfc1918 --blah

RFC1918

CONTEXT

CONTEXT python3 sysmon-forest.py --sqlite Cerber.SQLite --meta input.txt --bad

CONTEXT

VISUALIZATION python3 sysmon-forest.py --sqlite Cerber.SQLite --tree

VISUALIZATION

DETAIL python3 sysmon-forest.py --sqlite Cerber.SQLite --detail {596b7bab-706f- 586a-0000-00108cba1c00}

DETAIL

BONUS

CERBER

CERBER

CERBER