Disk

Question 1

How should you run Kape?

Answer 1

from a USB drive, it’s self contained

Question 2

provides the ability to forensically extract files from a mounted drive, including hidden or locked system files. (Free)

Answer 2

Kape

Question 3

Average breakout time in 2017

Answer 3

~2 hrs

Question 4

Primary purpose of IR

Answer 4

Cyber threat intelligence. What is happening? Otherwise, they will come back. Qualifying what the adversary wants and does will stop future attacks.

Primary output of the exercise.

Question 5

What is the containment phase of IR?

Answer 5

Preventing additional adversary actions while monitoring activity. Active defense.

Not pulling the plug while creating cyber threat intelligence.

Question 6

Manual and automated scanning looking for evil

Answer 6

Hunting

Question 7

Why is baselining important to hunting?

Answer 7

Have to be able to establish what “normal” looks like before you can see what abnormal is.

Question 8

How does threat intelligence get to the SOC?

Answer 8

Generated by HFS/NFS/CFS as part of Hunt/Incident detection, signatures created are put into intelligence as a product, fed back to the SOC.

Question 9

Proper threat intelligence team will arm a hunt team with:

Answer 9

Where to look, based on APT type activity
What to look for: signatures. Reg keys, malware footprints, IP/domains, hashes, utilities used, TTPs…
Likelihood of attack

Question 10

Hunt teams should have, at a minimum

Answer 10

Trusted visibility into endpoints and networks across the org. (Ability to use powershell or an EDR tool to sweep the entire enterprise)

Question 11

Remediation should, at minimum:

Answer 11

Deny adversary access to the environment
Eliminate the ability for the adversary to impact remediation efforts
Remove presence of adversary from the environment
Degrade the future ability of adversary to return

Question 12

Atomic Indicators

Answer 12

Pieces of data that are indicators of adversary activity all on their own, such as emails, IPs, strings from C2 channnels, FQDN, etc.

Question 13

Computed Indicators

Answer 13

Hashes of malicious files, data included decoded C2 protocols, some IDS signatures

Question 14

Behavior indicators

Answer 14

A profile of behaviors. Bad guy likes to tunnel traffic through think tanks, use macros for word documents, targets these types of targets, and uses these types of specific computed and atomic indicators. Like a CrowdStrike profile.

Question 15

How many stages is the MITRE tactic categories, and where was it derived from?

Answer 15

10 stages, derived from the 7 stage Kill Chain.

Control, Maintain, and Execute are broken out from the latter stages of the Kill Chain.

Question 16

What is STIX?

Answer 16

Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence (CTI). STIX is open source and free allowing those interested to contribute and ask questions freely.

Question 17

The equivalent of narrowing down a human suspect through identifying characteristics, but for adversaries

Answer 17

IOCs.

Question 18

Open sourced community driven standard format for IoC’s

Answer 18

STIX

Question 19

Tool aimed at (but not limited to) helping Malware researchers identify and classify malware samples. Create descriptions of malware families based on textual or binary patterns>

Answer 19

YARA

Question 20

What is a YARA rule?

Answer 20

A description of strings/boolean values that help determine a Malware variant.

Question 21

Tools for making IoC rules

Answer 21

YARA, STIX, OpenIOC

Question 22

Mandiant tool for standardizing IOC’s

Answer 22

OpenIOC

Question 23

an antivirus signature that you can control, basically

Answer 23

an IOC

Question 24

Free tool that provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile.

Answer 24

FE Redline

Question 25

Finding fileless malware should start with

Answer 25

….looking for the evidence of its execution when it RUNS.

Question 26

Malware that is not active but is dormant is harder to find because

Answer 26

We can’t detect the malware in memory

Question 27

How should you structure finding evil, from broad too specific?

Answer 27

Automated enterprise wide sweeps that can be signature based should start early, and then using targeted EDR data and triage data should be spent only on narrowed hosts that are suspicious, as they are time consuming. More manual processes should be used sparingly.

Question 28

Mechanisms for detecting compromise of systems w/o malware on them

Answer 28

Program execution, File opening, File knowledge, event logs, browser usage

Question 29

where malware hides, and names

Answer 29

Like to name it svchost, explorer.exe, win.,exe; app data folders (where outlook and explorer drop stuff)

Likes to hide in temp folders, windows folders, and internet files, system volume files….

They’ll often pack it, run it through python or after converting it to text, etc….obfuscating it

Question 30

Best way to combat processes masquerading as legit

Answer 30

whitelisting

Question 31

Malware uses services such as ______ to hide in plain sight

Answer 31

frequent compilation, packing, and armoring. It will mimic known good services and normal windows services.

Question 32

Most frequent hallmarks of malware evasion

Answer 32

Probably create a new service (scheduler @ cmd)
replace an existing service, like the wireless zero config service
register as an outrun process in memory
process injection

Question 33

To obtain a commercial software certification (to conduct code signing) you usually need ____ at a minimum, but often ______

Answer 33

Passport/phone bill (something to prove identity)

a Dun and Broadstreet rating (Level of financial standing/stability); shows that your org is a stable business.

Question 34

Examples of code-signing certs being manipulated

Answer 34

Stuxnet
opera browser manipulation that allowed access to private keys
adobe key signing cert stolen

Question 35

When did MSFT start doing code signing, and on what code?

Answer 35

Server 2008, Drivers

Question 36

Drivers give you access to what level of the O/S?

Answer 36

Kernel

Question 37

When did MSFT start enforcing code signing for executables?

Answer 37

On servers: Server 2016
Workstations: windows 10

You have to turn on executable signing!

Question 38

difference between corporate and business code signing cert

Answer 38

For corporate, you need to have a Dun financial rating (Dun and Broadstreet) Shows you have a stable business.

Question 39

% of malware that’s signed

Answer 39

around 3.5%; higher % for nation state attacks

Question 40

Downside to signed malware

Answer 40

If you revoke the signing cert (add it to the CRL) it would put a beacon on any version of that code in the wild. Makes rapid re-development/redeployment of code hard

Question 41

How to downselect code that’s signed for investigations

Answer 41

You can usually ignore code signed by well known sources such as MSFT, google, apple, etc.

Question 42

Finding evil in process starts with

Answer 42

Identifying normal processes and their locations. (Lsass.exe, taskhostw.exe, winlogon) Cross check that it lives in the correct directory/location. (such as %SystemRoot%\System32\smss.exe)

Question 43

What is sigcheck?

Answer 43

Checks for signed code, upload to VT

Question 44

What is density scout?

Answer 44

Checks for possible obfuscation and packing of a file. File will receive a score; this score can be used to identify whether a set of files is worth investigation.

Question 45

What is pescan?

Answer 45

command line tool to scan portable executable (PE) files to identify how they were constructed. Various metadata is displayed, identifying items such as:

Compile timestamp
MACB timestamp
File size and type of executable
Target OS and whether binary is 32 or 64 bit
Linker version used
Entry point address and desired image base address
Whether an X509 certificate was used and who the author is
Whether there is a checksum present and does it match the binary
Optional analysis of the PE internals to generate an abormality score which compares the internal construction to the standard operating system files. Higher scores equate to larger differences.
Optional MD5 and/or SHA1 hashes of the file can be generated as part of the scan.

Question 46

Built in windows command to query service configurations

Answer 46

sc

Question 47

Places to look for evidence of program execution

Answer 47

Prefetch, Shimcache, userassist registry keys, and jump lists.

Question 48

Places to look for evidence of program execution

Answer 48

Prefetch, Shimcache, userassist registry keys, and jump lists.

Question 49

Indications of odd behavior from seemingly normal OS artifacts could include

Answer 49

cmd.exe exeuction
Sysinternals tools usage (psexec, procdump, psloggedon)
at.exe or schtasks.exe execution (Persistence)
wmic.exe, Powershell.exe, or winrm.vbs execution
net.exe use, used for mapping drives or lateral movement
reg.exe or sc.exe (addition of run keys or services)
mount points2 registry key: records shares such as C$, Temp$, etc
.job files in C:\Windows\Tasks: odd application tasks executed

Question 50

Where would you see an adversary adding new run keys or services?

Answer 50

Use of reg.exe or sc.exe

Question 51

Where are some MSFT native tools an adversary might use for persistence or lateral movement?

Answer 51

Sysinternals tools (psexec, procdump, psloggedon) or net.exe (network)

Question 52

When looking for malicious processes, some anomalous characteristics might include?

Answer 52

starting with wrong parent process
image executable in wrong path
misspelled processes
incorrect sid (starting from wrong account)
Processes with unusual boot times
Unusual command line parameters
packed executables

Question 53

How does density scout work?

Answer 53

tries to compress a file; parts of the file that are obfuscated or encrypted won’t compress. Finds parts of files that have high frequency letters (usually encrypted) content or high entropy. (randomly generated)

You can usually compress standard EXEs very well (50%+) anything less than 10% compression represents concern.

Question 54

What Is temporal analysis?

Answer 54

fancy term for “time lining”

Question 55

How to use google post density scout to further check executables with low compression rates?

Answer 55

Look to see how common they are. Google/VT; put the full path into google. (If there’s zero hits, or even a recommendation, it will have a hit)

Question 56

Technique that obfuscates or encrypts data or software and encapsulates it into a file along with a program to perform decryption/deobfuscation

Answer 56

packing. a “packed executable” is a piece of software with an unpacking program.

Question 57

PEscan looks for what?

Answer 57

Code anomalies. Will present why it thinks the executable is weird, in the notes, and providing a rating. Compile data can be interesting….as is the CPU type. (32-bit code is unusual)

Question 58

Where does 32 bit programs run from?

Answer 58

Syswow64, if they’re standard windows processes

Question 59

Where do 64 bit programs run from?

Answer 59

System32==

Question 60

Verifies that images are digitally signed, provided the root certificate store is updated.

Answer 60

Sigcheck

Question 61

Checks VT detections while verifying code signing

Answer 61

sigcheck

Question 62

Two hives that autoruns most often usually live in, and when are they usually executed?

Answer 62

NTUSER and Software; executed when a user logs on

Question 63

How does an adversary manipulate the userinit registry key?

Answer 63

This key (in the Software hive) is used by Winlogon to execute explorer.exe and userinit.exe, at startup.

Question 64

Greatest hits for places to stick persistence mechanisms (WADSSS)

Answer 64

W-MI Event Consumers
A-utostart locations
A: GPO, MS-Office add-ins, BIOS.
D-LL's (DLL hijacking)
S-ervice creation/replacement
S-ervice failure/recovery
S-cheduled taskss

Question 65

What are runkeys?

Answer 65

AEPs. Autostart Execution Points. Things that start with the O/S. Frequently abused.

Question 66

File system location that (and those like it) that can be used to launch attacks, not requiring admin credentials.

Answer 66

%AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Question 67

Tool used for evaluating registry runkeys for maliciousness

Answer 67

RegRipper

Question 68

How to get malware to execute from a software link in user space (where to put it)

Answer 68

%AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup; shortcuts in here will link and execute to representative binaries

Question 69

How are MSFT services used as persistence mechanisms?

Answer 69

They replace unused services with malware, or modify an auto-start to include a new binary, or manipulate service recovery features (like dr. Watson)

Question 70

How are MSFT services used as persistence mechanisms?

Answer 70

They replace unused services with malware, or modify an auto-start to include a new binary, or manipulate service recovery features (like dr. Watson)

Question 71

What is DLL Search order hijacking?

Answer 71

Putting a DLL with the same name in the directory of a core DLL, so it launches ahead of the existing DLL.

Traditionally, search-order hijacking attacks
utilize an executable file’s DLL search path to load
spoofed DLLs through the known DLLs record.

Question 72

What is phantom DLL hijacking?

Answer 72

Inserting a DLL into a place where it would normally exist, but doesn’t. List of “known” DLLs for all the windows variants kept at KnownDLLs, and will include DLLS not found in that version. IE, for Windows 2016 R2 server, inserting a DLL that would normally be there but isn’t turned on/used for that build; when windows sees that DLL exists at startup, it will launch it.

Great example is replacing the FaxDLL (fxsst.dll) in the system32 folder.

Question 73

What is DLL side-loading?

Answer 73

Getting a new version of a legit-DLL loaded into the system. Part of the dynamic update features of Windows, just like a Web 2.0 AJAX style query.

DLL side-loading, in contrast to search order hijacking, utilizes the WinSxSn assembly to load the malicious DLL from the SxS listing, which is located in the following registry key:

%TEMP%\RarSFX%\%ALLUSERS PROFILE%\SXS\ or
%TEMP%\RarSFX%\%ALLUSERS PROFILE%\WinSxS\

Question 74

What does the Sysinternals Autoruns tool do?

Answer 74

Easy means to collect and analyze services on a system. Similar to SC. Will also collect currently scheduled jobs.

Question 75

What can schedule tasks on remote systems?

Answer 75

both at.exe and schtasks.exe

Question 76

How does a WMI event work?

Answer 76

1. Create an event filter, that “triggers” based on an event occuring (for example, run every 20 seconds)
2. Once triggered, an event consumer is added to the system with a script and/or executable to run (run this PS script to beacon to a backdoor)
3. Finally, tie the event and consumer together as a “binding” and enter it in the WMI repository

Question 77

File used to register new object classes into the WMI registry

Answer 77

MOF file (managed object format)

Question 78

Where was the first big WMI based attack? How was it executed?

Answer 78

Stuxnet

A zero day (print spooler service) was exploited to deliver an EXE and an MOF file. The MOF file was auto-compiled by the system, creating a WMI event and consumer that immediately executed the malicious executable.

Question 79

Native way to interrogate WMI for suspicious behavior

Answer 79

Powershell:

Get-wmi-object

Question 80

Command line tool to look at windows malware persistence mechanisms?

Answer 80

autorunsc.exe; goes through and analyzes, like sigcheck,. (doesn’t do dll hijacking or service failure)

Question 81

What does I E X indicate in memory?

Answer 81

Something to be concerned about. IEX is the “Invoke Expression” cmdlet, which takes the argument of a script and executes it. Often used to download the malicious script, which then gets passed in to PS. Evades many A/V tools.

Question 82

What does I E X indicate in memory?

Answer 82

Something to be concerned about. IEX is the “Invoke Expression” cmdlet, the underlying .net command is
“Net-Object.System.Net.WebClient) which takes the argument of a script and executes it. Often used to download the malicious script, which then gets passed in to PS. Evades many A/V tools.

Question 83

What is a download cradle?

Answer 83

A download cradle is a single line command for download and code execution. … A download cradle can also be part of a persistence mechanism, tooling or execution at other attack stages when an attacker attempts to download capability or run fileless

Question 84

Can be used to interrogate local and remote systems for processes, network configs, etc

Answer 84

WMI + WMIC

Question 85

How does WMI authenticate?

Answer 85

Non-interactively. (Network logons)

Question 86

What’s the problem with many EDR platforms?

Answer 86

Doesn’t do historical well; mostly live, in place. (The LR functionality is FE using Redline for the historical)

Question 87

Should you turn off Powershell remoting in your environment?

Answer 87

If you do, you’re likely using something less secure. (PSEXEC) It’s no more dangerous than RDP/RPC. Powershell remoting is MUCH more secure.

Question 88

Powershell commands are based on?

Answer 88

.NET framework objects, which mean the objects carry multiple aspects or properties of the command. (Cmdlets)

Question 89

How does Powershell handle command output?

Answer 89

By encapsulating it in objects, which can be passed to other cmdlets for additional processing. One cmdlet might make an array of objects for computers, files, network objects, the next might groom out the files, next might perform actions on those files.

Question 90

What is a Powershell provider?

Answer 90

how Powershell abstracts collections of items into containers. For example, “Get-ChildItem HKLM:Software” would abstract all the registry keys in that hive to an object.

Question 91

Windows alternative to Secure Shell

Answer 91

PSSession: ps for secure remoting

Question 92

PS command used as one-to-many option for executing one command on multiple remote systems

Answer 92

Invoke-Command (E I X)

Sends commands without an interactive session being established.

Question 93

Why PS is more secure than RDP/PSexec

Answer 93

It doesn’t cache credentials; only vulnerability is to things like ticket attacks

Question 94

How do you use PS to send a series of commands remotely?

Answer 94

invoke-command, then use a -scriptblock parameter, or -filpath to have it run from a local file.

Doesn’t need to set an array to loop through data.

Question 95

Why is Invoke-Command better than looping through an array of systems on the server running it?

Answer 95

The former uses the resources of the target to execute the commands, the latter relies on the processes/power of the invoker.

Question 96

Why do we avoid CredSSP in Powershell?

Answer 96

It caches the credentials so that it can pass them to a 3rd party/system that requires it; similar to SSO.

Creds aren’t cached otherwise, so Mimikatz/Incognito can’t steal them.

Question 97

How does Kansa work?

Answer 97

Organized collection of scripts andl modules and scripts into a framework for IR purposes. Much of it PS, but can execute anything. Uses PS for remoting.

Question 98

two prereqs for Kansa

Answer 98

your account must have admin privs on the remote host
windows remoting (WinRM) enabled.

Question 99

All the plugins that Kansa runs are located where?

Answer 99

./Modules folder

Question 100

All the analytics that Kansa can run on collected data is found where? How does it work?

Answer 100

./Analysis

All of the ways that it will crunch that data produced by the Modules in Kansa are listed in individual Analysis scripts. You can enable and disable ones you want it to run at the end of a pull, or run them ad-hoc.

Question 101

Why should you look at when a potential C2 domain was registered?

Answer 101

If it’s been around a long time, it’s less likely to be used as C2 unless the adversary is just holding it for a long time. (Infoblox will block recently registered domains tho, so smart bad guys will hold them past that time)

Question 102

What are Kansa analysis features that have “stack” in the name?

Answer 102

It’s the stackable feature of Kansa. If you see 30 hosts that have a specific run key, it will provide a “counter” for that occurrence across the environment.

Frequency analysis scripts.

Question 103

how to use 3rd party binaries with Kansa, and where it needs to be told to run it

Answer 103

Put the binaries you want to run in the .\Modules\bin and when executing, push with -pushbin. Remove them after with -rmbin

Must add the tool as a BINARY DEPENDENCY #BINDEP in the collector script. Even commented, it will run

Question 104

How to bring memory analysis into Kansa (to try to get

Answer 104

Get-RekalPsList.ps1

Question 105

What is WMI for?

Answer 105

Windows Management Instrumentation. Deeply invasive control of the underlying Windows architecture, meant for administrative tasks in a large environment

Question 106

Why is WMI traffic hard to detect?

Answer 106

It exists for uses in every stage of the kill chain
It’s largely only in memory
Windows native, minimal logging of actively
evades whitelists
scripts can be obfuscated when run through it
encrypted
runs over standard PScom/WinRM pipes

Question 107

WMi for recon

Answer 107

List user accounts, groups, netuse lists, list of fixes and patches installed, etc

Question 108

Why is WMI the real fear, not PS?

Answer 108

Powershell has history and logging. WMI is often the underlying commands being run, and usually silently.

There’s no automatic logging for WMIC commands by default

Question 109

Examples of WMI for priv esc

Answer 109

Powershell Empire has multiple WMI tools for finding services running in the wrong directories or with elevated privs, that could be manipulated. Also looks for services that have a space and aren’t quoted, where you could inject other services.

Question 110

WMI process for lateral movement

Answer 110

WMI Process Call Create: used by NotPetya and BadRabbit uses to execute code remotely

Question 111

How does rundll.exe let you avoid whitelisting restrictions?

Answer 111

It’s the valid app that calls DLLs; if you want to run a malicious DLL, you could invoke this manually to call another DLL, thus skipping some whitelist controls.

Question 112

WMI persistence mechanism

Answer 112

Creation of Event Consumer Backdoors. (Embedded in WMI database) is there an event/trigger condition (MOF file) that doesn’t belong?

Question 113

Ways to create entries in WMI database for persistent attacks

Answer 113

Use PowerShell or mofcomp.exe

Question 114

NotPetya uses ______ to spread it’s payload

Answer 114

Direct RCE for systems accessible via WMI Process Call Create.

Also uses Remote shares accessible via NetEnum/Netadd to spread its payload

Question 115

Ways to identify WMI commands for cyber reconstruction efforts (how to catch WMI attacks)

Answer 115

Enable Event logs (will fill up your logs QUICK)
Sysmon has its OWN event log (better)
Use PowerShell to discover suspicious events
Commercial EDR tools (Carbon Block, Tanium, HX) (best)

Question 116

3 things PS can be used to look at to find malicious use of WMI

Answer 116

Looking at:

1. event filters (Trigger)
2. EventConsumer (Script or executable to run)
3. FilterToConsumerBinding (binding, storage, persistence)

Question 117

3 Tool for exploring WMI database

Answer 117

WMI explorer tool (wmie2)
Mandiant WMI-Flare tool (Offline parsing)
Mandiant PyWMIPersistenceFinder
WMI forensics scripts

Question 118

Two WMI events to search for first

Answer 118

ActiveScriptEventConsumer - execute a predefined script
CommandLineEventConsumer - Launch an arbitrary process (more common: launch a download cradle)

Focus on consumers!

Question 119

What is a MOF File?

Answer 119

Think of it as text file representing the WMI definitions and instances.

Used for rebuilding and recovering the WMI database. Found in WMI repository.

Question 120

Why is Mofcomp.exe dangerous?

Answer 120

Can use it to create WMI objects from anywhere; doesn’t NEED to reside in the WMI repo or even on the same computer. (-N to add remote machine names)

Can use it to rebuild WMI from another machine with arbitrary events/consumers. In this scenario, the residue isn’t even on disk, but in memory.

Question 121

Student use of WMI?

Answer 121

You can send a MOF file to the Print Spooler, which will compile it and import it into the WMI repo. (Was just a windows service, not an exploit)

Anything you wrote in there was written in as an admin account to the backend.

Question 122

Method to remote write to a WMI DB?

Answer 122

mofcomp -N \machinename\root\subscription test.mof

have to delete the #PRAGMA from the first line of the file

Question 123

Do you need a MOF file to write into the WMI db?

Answer 123

No. Can write directly into it using .NET code (like PS)

Question 124

When you run a MOF file from a non-standard location, it writes an artifact to:

Answer 124

HKLM registry, WBEM auto recover key

Question 125

Seeing unusual WMI processes running

Answer 125

Consumer portion
look for wmipvrse (especially on non-servers)
Look for wmipvrse’s parent process. (Should be svchost!)
Look for wmipvrse spawning things like cmd/ps

Active script portion
Look for scrcons.exe
RARELY SEEN!

Question 126

Hunting for WMI activity involves what

Answer 126

Looking for WMIC call create
/node: 
invoke-wmimethod or invoke-CimMethod (PS)
wmiprvse with unusual parent
wmipvrse with unusual children (like PS)
scrcons.exe running
PS with encoded commands

Question 127

Some of the event logs for credential harvesting

Answer 127

4624 (Logons)
4720 (Account Creation)
4776 (Local account authentication)
4672 (Privileged account usage)

Question 128

What is protected processes, and when was it introduced?

Answer 128

Windows 8: Protected processes can only load signed code and can only be attached to other protected processes.

Question 129

Why is protected process easy circumvented

Answer 129

It’s not on by default, and Mimikatz gets around it via a signed driver.

Question 130

Remote credential guard does what?

Answer 130

Update to restricted admin: protects any account (not just admin) during RDP sessions.

Question 131

Windows 8 integrated a lot of protections for _____ that no one integrated

Answer 131

Credential protections, via KB2871997. (Backport to Windows 7)

Question 132

Why isn’t credential guard used pervasively? What does it do?

Answer 132

It’s hardware heavy; works with virtualized sandboxes. Has a lot of work to do for exceptions.

Question 133

What is the core Active Directory authentication protocol used for users?

Answer 133

Kerberos
and
NTLM (for using local accounts, network logon w/SMB vs domain creds

Question 134

An authenticated credential is composed of:

Answer 134

an identity and an authenticator (secret)

Question 135

Create accounts to target on a local box when searching for a credential that can be used on other boxes

Answer 135

cached creds for users (ie, Joe on computer a has logged in via NTLM on another box, and his creds are cached there)

Helpdesk account (pushed to every box for local admin work)

Administrator account (if it hasn’t been randomized as part of build, with sysprep)

Question 136

Challenge for hackers with local system creds that have been cached.

Answer 136

They’re encrypted and salted, so have to be offline cracked, unless you’re passing the hash. If you do crack them, you have the password, so you don’t need to pass the hash.

Question 137

Attacking a local system for creds, what FOUR forms can the credential take?

Answer 137

Stored cached credential
NTLM Hash
Token
Ticket

Question 138

NTLM pass the hash works specifically in what way?

Answer 138

The threat actor has access to a box, find a LOGGED IN system user, accesses the stored credential in the form of the NTLM hash, and then accesses another machine that has that account cached; when it asks the first box for the cred, the hash is passed over. Requires a logged on user, another machine that has that same user cached, and access to the hash.

Question 139

How does Windows 8.1 introduce defense against Pass the Hash attacks?

Answer 139

Starting at 8,1, any priv account is not allowed to do a network logon over NTLM, with the exception of the default administrator account.

(Why you dont clone computers)

Question 140

Caveat to a local cred in the form of a hash, token, or ticket being dumped?

Answer 140

It must be for a user that is LOGGED ON, or the process is still running

Question 141

domain account hashes are stored where during interactive sessions

Answer 141

memory

Question 142

How do you defend cred theft, locally?

Answer 142

Monitor admin accounts/boxes
Stop remote interactive sessions w/Admin accounts
Properly terminate RDP
Windows 10 (cred guard, tspkg, domain protected users group)

Question 143

Credential guard defends creds by moving them

Answer 143

…from LSASS to a hypervisor controlled isolated process.

Question 144

What privileges are required for any system you’re trying to steal a token from?

Answer 144

SeImpersonate or Delegate. (or admin privileges necessary to add those permissions)

Question 145

Type of token that facilitates authentication even across network resources?

Answer 145

Delegate tokens

Can be used w/PSExec to map remote admin shares

Question 146

Type of token that allows for local security context shifts

Answer 146

Impersonate tokens. (SeImpersonate)

Question 147

If a token is present on a system, a user with the SeImpersonate privilege can do what?

Answer 147

Extract the token
Reuse it to manage group membership or add users
Escalate local privileges

Question 148

Power “delegate” tokens are only available to an attacker when _______

Answer 148

Console logons, RDP, using “Run As” on the machine.

Question 149

Smart additional ways to defend token theft on endpoints

Answer 149

“restricted admin” prevents tokens from being available on the machine during remote admin sessions (which should be avoided, anyway)

Remove delegation of high value accounts in AD

Use group policy to set time values for sessions, after which it disconnects (to prevent improperly terminated RDP sessions

Question 150

Cached domain credentials are stored in

Answer 150

SECURITY\Cache reg key

Question 151

To prevent a situation where a user cannot logon, windows ____________

Answer 151

caches the last 10 logon hashes. (25 for 2008+)

Question 152

Format of cached credentials on modern Windows systems

Answer 152

mscash2

Question 153

How long do cached credentials live?

Answer 153

indefinitely, even after a reboot.

Question 154

Creddump can be used to?

Answer 154

extract hashes off-line, to be cracked

Question 155

Why we shouldn’t clone endpoi nts

Answer 155

Creates a standard admin, same RID, which can be used in credential theft/lateral movement very easily

Question 156

Unique ways to limit attacks on cached credentials

Answer 156

Minimize amount of cached accounts

Use Protected Users group

Question 157

NSA/DoD recs for cached credential limit

Answer 157

0-1 (NSA)

<4 (DoD)

Question 158

What does Nishang PS framework allow analysts to do?

Answer 158

through Get-Lsasecret.ps1, can dump and decrypt the LSA secrets. These secrets, if they’re privileged incorrectly, can let a service account be used to exploit escalation of privilege. (looking for overprivileged service accounts)

Can be combined with ticket requests (kerberoasting); offline the ticket, crack it, and use it with the service account.

Question 159

Often used for looking for overprivileged accessible domain service accounts. (badly installed agents, etc)

Answer 159

Nishang Powershell framework (pulling encrypted service account details from LSA)

Kerberoasting to marry that account with a ticket for its use

Question 160

Unique ways to defend against LSA attacks

Answer 160

dont employ services or schedule tasks requiring domain administrative trusts
reduce number of services that require domain accounts
Group managed services, through “Group Managed ServiceAccounts”

Question 161

How do you acquire a golden ticket? (kerberos)

Answer 161

Stolen from memory

kerberos ticket w/o an expiration date, and has domain admin.

Question 162

What is kerberoasting?

Answer 162

request tickets for service accounts: they send you the ticket for a service account, you roast it(crack it) and then reuse it

Question 163

When does a golden ticket expire? What can it be used for?

Answer 163

Expires when the krbtgt is rotated. Changing other credentials is meaningless

Question 164

What does managed service accounts do, and when was it introduced?

Answer 164

Server 2008R2

Introduces frequent password changes and long passwords

Question 165

How can you flexibly utilize a dumped ticket, as a “transplant” ?

Answer 165

If you dump a privileged ticket, you can export it from the system, dump it into Mimikatz (or other utilities) and then import it into another system, where it will be cached and available

Question 166

Key weakness that allows kerberoasting to work

Answer 166

ANY user can request a ticket from a DC for ANY service

The ticket returned for the service has a non-salted hash for the account that runs the service.

This password can be easily cracked offline

Question 167

Dangers of Golden Ticket to defenders

Answer 167

1. If an attacker loses access, ANY user-level access to a domain joined system will provide a mechanism to re-use the golden ticket to get priv access again using Pass the Ticket.
2. Works even if a full password reset is conducted for all enterprise accounts
3. Attack can be constructed with access to either the NTDS.dit or memory. (attacker must have Admin access on a DC to get this)

Question 168

An all-access ticket for a single service or computer is referred to as a

Answer 168

“Silver ticket”

Question 169

Why are silver tickets so effective?

Answer 169

they’re excellent backdoors: auth occurs without requiring comms with the DC. Attacks a computer account password.

Question 170

What is a Skeleton Key for AD?

Answer 170

After gaining access to a DC, a tool like Mimikatz can “patch” LSASS to enable a backdoor password for any valid domain user.

It’s a SECONDARY password for the account; even if they change the primary, the secondary remains available.Easy and persistent backdoor for access.

Question 171

Unique ways to defend against ticket attacks

Answer 171

Credential guard/Remote credential guard
Long and complex passwords on service accounts
Audit service accounts
Regularly change the KRBTGT password (no more than yearly

Question 172

What does a hacker gaining the NTDS.dit do, and how do you get it?

Answer 172

Gains access to all the user and computer account hashes, which are encrypted. (though the encryption is easy to break)

Easiest way to get to a users personal access/drives/phones/computers,

Question 173

How to get around the locked NTDS.dit file, when trying to export it?

Answer 173

use Volume Shadow Copy service.

Question 174

Tools for extracting the NTDS.dit, and where is it?

Answer 174

\Windows\NTDS

Can be ripped by:
ntdsutil
NTDSXtract
ntdsdump
VSSAdmin
PS
Metasploit

Question 175

Why use NTDS.dit for action on objectives?

Answer 175

Often, using admin credentials are noisy: if you have the NTDS.dit, you can natively log in as a user and see what they see, have access to their browser, OneDrive, phone, etc. Less noisy.

Question 176

What is located inside every prefetch file?

Answer 176

The total number of times an application has been executed, the original path of the execution, and the last time of execution. (up to the last 8 times)

telemetry for execution

Question 177

Why is the timestamp of the prefetch file?

Answer 177

It provides an extra bonus 9th “evidence of execution” for the application in question.

Question 178

What’s the format of a prefetch file, and where’s it stored.

Answer 178

_.pf

ON WORKSTATIONS, in Stored in \Windows\Prefetch (not a server service)

Up to 128 files on

Question 179

What does prefetch do?

Answer 179

Meant to give a process an extra bit of juice when it executes, next time will launch quicker/more efficiently. (On old hard drives, it would co-locate executables in close digital space so the hard drive didn’t have to scan to it)

Question 180

SSDs and Prefetch?

Answer 180

IN windows 7, they started disabling prefetch for SSDs, but realized it was still providing efficiencies.

Question 181

How would you look at the targets of sdelete?

Answer 181

the prefetch file for sdelete has the target of what was deleted. Doesn’t include registry keys, but file/filehandles.

Question 182

How can you use frequency analysis of prefetch entries?

Answer 182

If there’s a huge recent amount of “living off the land” type tools, like netstat/net-use from command line, that might indicate that someone is in your space.

Question 183

The first time a file is accessed is connected to the timestamp (creation) of

Answer 183

the .pf file.

Question 184

Over time, a prefetch file may be….

Answer 184

Overwritten with the most recent runs of the file, or erased if the application hasn’t been used in a long time. (After which it gets re-created for a new run, with a new timestamp)

Question 185

Creation of a .pf indicates

Answer 185

that an application ATTEMPTED to execute, not that it did so successfully.

Question 186

What happens to a prefetch file if the application is run from a different directory other than standard?

Answer 186

It changes the hash value, because it’s been executed from a new location. (useful info!)

Question 187

What does pecmd.exe do?

Answer 187

Pulls information on a directory or a single application for prefetch, including volume information, files and directories referenced, and all execution time info.

Question 188

Difference between -f and -d for pecmd.exe

Answer 188

-f is for a single application, -d is a directory of applications

Question 189

What is the hash of a prefetch file calculated from?

Answer 189

the directory path that the executable is in, and the command line options of the programs

Question 190

What happens if you run calc from cmd, if cmd is launched from /syswow (32 bit folder)

Why?

Answer 190

it will launch a 32 bit version of the calc app. A 32 bit process can’t have a 64 bit child process.

Question 191

Why should we always look at spikes in 32 bit programs (things running from syswow)

Answer 191

Because bad guys write a lot of malware in 32 bit, and a lot of child processes are launched in 32 bit as well, which is unusual for system activity

Question 192

Filter = _____

Consumer = _________

Binding - _________

Answer 192

Trigger

Action

Host it runs on

Question 193

How do you use sdelete to fully wipe forensic evidence of prefetch, including unallocated space?

Answer 193

Sdelete has a -z option, to zero-ize unallocated spac.e

Question 194

If bad guys have deleted prefetch, zeroized unallocated space….what option is left to find evidence of the app execution?

Answer 194

Volume shadow copy (provided they didn’t turn VS off/on again or memory (volatility can pull prefetch)

pecmd can use a -vss option to also look in volume shadow copy at run

Question 195

What is Application Compatibility/Shimcache, and why does it matter forensically?

Answer 195

Designed to detect program compatability challenges. (Apps should be able to run in any version of Windows, but that’s hard)

Question 196

What is in shim cache?

Answer 196

All the application files, AS they’re run, that have been checked for compatibility/shimmed

Question 197

When an app is shimmed, what is written?

Answer 197

the last modification time of the executable
the full path of the exe

(not when it was shimmed, when it was executed)

Also, when explorer browses the folder with the executable, and it’s shown in the gui (weird) You hav etc see it with your eyeballs

Question 198

Every time psexec is run, what happens on the remote machine?

Answer 198

a new version of psexsvc is pushed to that machine. The NEW version gets shimmed every single time, even though it’s overwriting the same file. (good to know)

Question 199

What forensic evidence is created when an executable is renamed?

Answer 199

an entry in the shimcache, because it’s shimmed again

Question 200

When you move a file, what cache entry is updated?

Answer 200

shimcache

Question 201

WHEN is the shimcache written to registry and directly accessible?

Answer 201

On shutdown. Prior to that, shimcache entries exist only in memoruy

Question 202

What is the significance of the shimcache “insertFlag”

Answer 202

a Flag in the registry flag that means that confirms the application was executed; if the flag is empty, it likely wasn’t.

Question 203

While shimcache may not give you the date/time executed, parsing it gives you…

Answer 203

the temporal order. What executables ran in what order, starting most recently to most distant, historically.

Question 204

Amcache tracks what things?

Answer 204

Programs installed, programs executed

Question 205

Where does amcache live?

Answer 205

amcache.hve (registry) at C:\Windows\appcompat\programs\amcache.hve

and

Within that hive, a Root\File{Volume GUID} which tells you where the executable was run from, volume wise.

Question 206

What do the keys under each {Volume Guid} in each amcache entry represent?

Answer 206

Each key represents a numerical value, which each represents another executable. Key # is a combo of the MFT entry and a sequence number. (written in hex) Parsers can break that out.

Question 207

What extra piece of data is included with the executables symbol in the amcache?

Answer 207

a SHA-1 hash for it.

Question 208

What is wiiprvse indicative of in shimcache, elsewhere?

Answer 208

indicates client is receiving a remote WMI command

Question 209

Where would you go to look at what explorer directories a threat actor navigated to, and using what artifacts?

Answer 209

Shellbags (using shellbags explorer) and opening the userclass.dat file (found in the user’s home directory)

E\C\users\AppData\Local\Microsoft\Windows\userclasss.dat

Question 210

Where are event logs stored?

Answer 210

%systemroot%\System32\config (older)

%systemroot%\System32\winevt/logs (modern)

Question 211

Where do we see evidence of services starting/stopping/etc?

Answer 211

The System Event log

Question 212

Where do events forwarded from other systems get logged?

Answer 212

Forwarded events log

Question 213

Number of logs found on a modern windows machine

Answer 213

150+ Application, Security, System are only 3.

Question 214

What are some examples of Windows services that get their own logs?

Answer 214

Defender
Firewall
Task Scheduler

Question 215

What updates the security event log?

Answer 215

Only system (LSASS); third party apps don’t log to this log facility

Question 216

What is logged in the security event log?

Answer 216

Auth attenmpts
User behavior/actions
File/folder/share
Security Settings modifications
LSASS process
Processes (manually?)

Question 217

Difference between a logon/account logon event?

Answer 217

Logon event: user logon (where the logons are tracked at): You going through TSA and showing ticket/ID
Account logon event: Authentication event (board the plane) Security checkpoints! (Where did you authenticate)

Question 218

What security event is like a TSA gate check agent scanning your ticket?

Answer 218

an account logon event, or “authentication event”

Question 219

Account event you’ll see most frequently (most important)

Answer 219

4624 and 4625, successful vs. failed logon

Question 220

Event id using other creds (potentially stolen)

Answer 220

4648 (logon using explicit creds)

Question 221

Privileged user logon event

Answer 221

4672 (VIP in the room!)

Question 222

Suspicious of events that are mapping to C$ or admin$ shares

Answer 222

You’ll need the pairing of a Successful logon (4624) and 4672 (superuser/priv account logon)

Question 223

Problem with logoff events in Windows, forensically, and how to adjust course

Answer 223

They aren’t reliably recorded (as 4634, logoffs) so look for 4647.

Question 224

Logon events aren’t recorded when….

Answer 224

malicious activity is used to access a system. Backdoor, exploited service, or similar.

Question 225

Logon codes tell you

Answer 225

HOW the user logs into the system (IE, 7 is RDP, VNC/Console is 2, cached ares to logon is 11, etc)

Question 226

Non-interactive logons are what logon type?

Answer 226

3; network logon

Question 227

When a user logs on using a domain account through the console, it produces cached logon events. Why?

Answer 227

MSFT tries to reduce the traffic to the DC and sometimes defaults to cached creds, even when the DC is online.

Question 228

How to relate a logon to a logoff, in event viewer

Answer 228

Use the Logon ID value; creates “parenthesis” on the front and back end of a session

Question 229

Session lengths are good to establish for what types of logons?

Answer 229

interactive

Question 230

Every domain joined system will have THIS directory created, accessible via interactive login

Answer 230

$: Account is used when communicating with AD and accessing network resources

Question 231

What is the built-in “NETWORK SERVICE” used for?

Answer 231

Assigned to processes or services that need network access

Question 232

4670, after a successful logon, indicates what?

Answer 232

Enumerate the privileges coming with you.

Question 233

Important to track what activity for event logs of privileged account activity during logon, and why?

Answer 233

Not just a member of an admin group, but the additional privileges assignment (as part of event id 4672) that indicates that after the logon, special creds were assigned that COULD BE IMPERSONATED IN TOKEN ATTACKS

Question 234

What privilege assignment at logon time is indication that the account used was ripe for token based attacks?

Answer 234

4672, where things like SeTakeOwnership, SeDebug, and SeImpersonate are admin-equivalent.

Question 235

4720 events should be looked at because….

Answer 235

they indicate account creation happened, which can be an easy true positive.

Question 236

Some of the RDP connection log info is also recorded

Answer 236

In auxiliary logs Remote Desktop-Services-RDPCoreTSZ and TerminalServices-RdpClint

Question 237

How to actually obfuscate the RDP Client Address

Answer 237

The RDP client/server connection will document the source IP, so if you don’t want it to show your actual IP, you have to chain RDP; jump from host to host.

Question 238

Important place to find log data regarding RDP services, that are recorded on the source system

Answer 238

Windows-TerminalServices-RDPClient\Operational

one of the only places that you get discrete source logging (where did the RDP session connect to)

Question 239

Only time we see the Account logon and Logon events in sequence

Answer 239

When a user is logged on locally, NTLM style, ro a workstation or group

Question 240

account logon events refer to….

Answer 240

The third party authorization of creds provided during that logon session. (Authentication vs logon)

Checks for user credential against the DC would be an account logon type.

Question 241

“holy trilogy” of event data that corresponds to a pass the hash PTH attack

Answer 241

4776: Root account authenticated from workstation (account logon)
4624 Successful account logon
In that logon, the type of logon is network

Question 242

New events in Win 10/2016 that track enumeration/recon of group accounts

Answer 242

4788/4799, groups were enumerated

Question 243

event logs (groups) that can help identify bloodhound or powerview use

Answer 243

Look for the enumeration of group membership (not turned on by default)

Question 244

Benefit of Event log explorer

Answer 244

Tolerant of log corruption
filtering
free

Question 245

How to monitor for access to shares, and objects accessed over those shares

Answer 245

Network share event logs

5140/5145. Have to be turned on!

Question 246

Runas events (4648) are unusual, in that

Answer 246

they are often recorded on the originating system, versus the target system. (A logon attempt was made using explicit creds….or, RunAs)

Occasionally recorded on both, such as when RDP connections use different crds..

Question 247

Places where scheduled tasks are recorded

Answer 247

Task Scheduler, Security, and Tasks folder (Windows\System32\Tasks
Locally, remotely and in the “tasks” folder, where the registration/creation of tasks is put.

Question 248

Command line to manipulate services remotely

Answer 248

sc.exe /remote system name, etc

service control

Question 249

One service related event that isn’t recorded to system

Answer 249

new service installed (4697) goes in the security log

Question 250

Tools that added capability to manipulate event logs

Answer 250

Mimikatz and Dandersprintz, post eternalblue

Question 251

Mitigation techniques for event log manipulation

Answer 251

Event log forwarding
Logging “heartbeats”
log gap analysis

Question 252

Evidence of event log tampering

Answer 252

They still exist in memory
Gaps in the records
You need admin rights

Question 253

Two native ways to conduct lateral movement in Windows environments

Answer 253

Map network share (net use)

RDP

Question 254

3 physical places Places where we find filesystem artifacts for RDP connections

Answer 254

Jumplists (AppData\Roaming\MSFT\Windows\Recent\Automatic\Destinations) –> mstc-appid shows all the Remote Desktop times/destinations

Prefetch files (on disk, not memory)

Bitmap cache (RDP puzzles!) cache##.bmc, cache###.bin in user directory, terminal server client/cache

Question 255

What are we looking for in logs to see Remote Desktop SOURCE evidence, and what are the data sources?

Answer 255

Event logs, Registry, and file system

Looking for mstc.exe (MSFT terminal server client) execution

Question 256

The presence of what file in a user’s profile is a good indication that RDP has been executed on that system?

Answer 256

Default.rdp

Question 257

Tool to parse the RDP registry, which is?

Answer 257

Regripper “rdphint”

RDP key found in
NTUSER\Software\MSFT\Terminal Server Client\Servers

Question 258

What type of logon event is created on a system that’s been RDP’d TO?

Answer 258

4624, Logon Type 10

Will also produce a 4778/4779 event, with the ip source, system name, logon user name

Question 259

Names of executables that will be presented on destination even logs for RDP

Answer 259

rdpclip. exe

tstheme. exe

Question 260

Users name directory will be created when….

Answer 260

any interactive login is conducted

Question 261

Executables that will be visible forensically when windows admin shares are mapped, and where can we find them?

Answer 261

net. exe
net1. exe

Can be found in
event logs (Security, smbclient)
registry (mount points, shell bags, shimcche, bam/dam, amcache)
FileSystem (prefetch, user profile artifacts)

Question 262

Key that shows the entire list of systems connected to by a user account

Answer 262

NTuser\Software\MSFT\Windows\CurrentVersion\Explorer\

MountPoints2

Question 263

Why is 4672 presented on the destination for a connection to a remote admin share?

Answer 263

Because you need the privilege to be able to connect to an admin share, thus, 4672, privileged user breakdown

Question 264

5 ways to execute malware on a host, using lateral movement techniques

Answer 264

PsExec
Windows Remote management tools
PowerShell/WMIC
Exploiting a vuln
Application deployment software

Question 265

Popular malware like conficker, shaman, wanna cry, notpetya, etc look for what to be able to propagate?

Answer 265

Windows admin shares

Question 266

Key artifact for PsExec usage in registry

Answer 266

The Sysinternals\PsExec\EulaAccepted key (NTUser.dat)

Question 267

Any changes in the delta of what should raise eyebrows for legit users of PsExec (or for malicious use, really)

Answer 267

Any increase in the amount of Eula’s accepted, which should always remain relatively static. (Same amount of users)

Question 268

PsexeSvc.exe is an artifact for what?

Answer 268

Being on the receiving end (destination) of a psexec connection.

Question 269

receiving commands from WMI will produce what .exe?

What other files will be presented?

Answer 269

wmiprvse.exe

scrcons. exe
mofcomp. exe

Question 270

manipulation of WMI repo will show up where?

Answer 270

System32\wbem\repository

Question 271

good executable indicator of Powershell demoting?

Answer 271

wsmprovhost.exe

Question 272

Full script logging for PS is available at:

Answer 272

PS 5 and beyond

Question 273

Common tools for using application deployment software to deploy lateral movement software/malware

Answer 273

GPO, SCCM, Cloud control panels.

Question 274

What does process tracking give you?

Answer 274

A running diatribe of processes that were executed, and who the parent process was - includes full command line processes (both cmd and Powershell.exe)

Question 275

Problem with process tracking

Answer 275

HUGE amount of data, same as what’s in prefetch

Question 276

What system baseline is the first to integrate process tracking?

Answer 276

WIn 7

Question 277

Where does process tracking add content to?

Answer 277

Windows event logs: adds process information section

Question 278

How do you see command line code in logs?

Answer 278

turn on process tracking, with CLI auditing. Will include the full script that was executed

Question 279

How can you hide command line scripts even if process tracking/cli auditing is fully turned on?

Answer 279

Have the malicious script call script blocks, and have the necessary evil in a file in temp or wherever

Question 280

Turn on what for power-shell specific logs?

Answer 280

Powershell script block logging, Powershell remoting logging

Question 281

How can red teams get around PS logging?

Answer 281

downgrade Powershell to pre-PS5, where it was introduced. Downgrade attacks are very popular!

Question 282

What is tracked in Windows-WinRM/Operational log?

Answer 282

WinRM connections, which is the primary protocol for Powershell Remoting

Question 283

Records all commands typed and the output of those commands, for powershell

Answer 283

the transcript log. Records to the users documents folder by default. Only records input/output to the PS terminal

Question 284

Tools meant to run on Powershell logs to detect obfuscation/encoding

Answer 284

Invoke-Obfuscation tool and Revoke-Obfuscation tool

Question 285

A way to see a PowerShell “bash history”

Answer 285

PS saves it’s history in PSReadline ConsoleHost_history.txt

Stored at
%AppData%\Roaming\MSFT\Windows\PowerShell\PSReadline

Records last 4096 commands typed in PS console

Question 286

What can bad guys do to keep you from seeing the PS “bash” (Command line history)

Answer 286

Set it to disabled in PS, or just remove the PsReadline Module

Do it by Set-PSReadlineOption -HistorySaveStyleSavenothing

Remove-Module-Name PsReadine

Question 287

Best place to discovery evil WMI eventing

Answer 287

WMI-Activity log; look for EID 5861, new permanent customers.

You must be able to “whitelist” typical WMI activity in the environment

Question 288

Problem with WMI activity log for finding WMI evil?

Answer 288

It doesn’t track processes or command lines, without that being turned on, and then it is tracked in security logs

Question 289

What is AMSI?

Answer 289

Anti-Malware Scanning Engine; something that antivirus vendors can hook into for visibility. Windows 10+

Question 290

Most modern way to export evt logs (4)

Answer 290

Zimmerman’s event log extraction tool
evt log explorer (command line version)
evtwalk/evtxtract carving tool

with Powershell, grab it remotely or locally: Get-WinEvent

Question 291

Free blue team logging aggregation/forensic tool, from MSFT?

Answer 291

Sysmon! Easy configuration, filtering

requires a LOT of tuning.

Question 292

What does Mofcomp do?

Answer 292

Can be used to create a WMI event for persistence (Creates WMI filters)

Question 293

Great free database to break down/describe specific Windows event logs and their context

Answer 293

Ultimate Windows Security

EventID a good second option.

Question 294

Ways to obfuscate Powershell script blocks can be found in

Answer 294

Invoke-Obfuscation and Revoke-Obfuscation

Question 295

Open Sourced PowerShell script for deobfuscating other encoded PowerShell scripts

Answer 295

PSDecode

Question 296

Option in cyberchef to decode strange/obfuscated portions

Answer 296

The “magic” option, which will try to do a first few passes on scripts to see what they’re supposed to be used for/attempting to accomplish.

Question 297

Challenges with saving Powershell logs

Answer 297

The transcript logs are trivial to manipulate on a box (unencrypted in the users documents folder)

Powershell remoting limits the sharing of the logs over the network due to problems w/network authentication “double hopping”

Best to have it set as an automated forwarding (UF, filebeat, etc)

Question 298

Powershell logs “bash history” get saved as….

…and what’s the downside?

Answer 298

PSReadline Console Host history. Stored in each user’s profile

No process tracking or script output

Question 299

Evil in WMI logs can be found in

Answer 299

Look for New WMI Event Consumer Creation

Question 300

Ways to look in WMI logs for evil

Answer 300

Look for evil DLL extending WMI capabilities

Look for uncommon words, software terms (Eval, activexobject, .vbs or .ps1 scripts, etc)

Question 301

Exporting logs is challenging because…

Answer 301

Exporting tools will often partially corrupt log files

stored in binary form, so they need to be converted

Question 302

Where does Sysmon store logs?

Answer 302

Creates a new log output dir, Windows-Sysmon/Operational

Question 303

EDR that lets you connect to a remote host and attach a remote disk as local. Works directly with Linux. (Can attach a remote disk to a SIFT image)

Answer 303

F-Response

Question 304

Kape is __________ program that does what?

Answer 304

Triage program: Collects files, and processes the files across its program set. Fasty, flexible, collects locked system files/shadow copies.

Question 305

What are Kape “Targets”

Answer 305

the list of files for it to collect

Question 306

Advanced capabilities of EDR to perform memory analysis leads to good visibility for

Answer 306

CLI artifacts
Network Activity
Process tracking/tracing
DLL injection
Rootkit insertion

Question 307

Why is EDR’s access to memory critical?

Answer 307

Because much of the modern attack ecology is memory resident

Question 308

Why is memory key to finding running processes?

Answer 308

You can hide executables on disk, obfuscated, but you can’t hide them from the processor. They have to be uncloaked to

Question 309

As a cheat, in memory, you can collect executables from memory. How? (Rob Lee’s trick)

Answer 309

Dump all the executables, drivers, dll’s from memory analysis, and run antivirus/clamav at it.

Cant hide the raw in memory!

Question 310

Best place to find malicious software activity

Answer 310

Memory samples; stuff injected into processes, or obfuscated, will be easier to find in memory. (Harder on live host)

Question 311

Why is memory collection/analysis hard to do? (why is it brittle)

Answer 311

It’s tied to specific profiles and variations of operating systems.

Question 312

Options for acquiring memory from running (live) systems

Answer 312

F-response (and SIFT)
Winpmem (Velociraptor)
Dumpit (CLI from USB)
Belkasoft 
Magnetforensics

Question 313

Options for acquiring memory from dead box?

Answer 313

Hibernate file (hiberfi.sys)
Swapfile.sys
Pagefile.sys
Windows Memory Dump (%WINDIR%\Memory.dmp)

Question 314

Difference between memory collection on a Hyper-V image and a VMware/Parallels image

Answer 314

On VMWare, you can just grab the .vmem file
On Hyper-V, you have to attach a process (like Winpmem or F-response) and pull memory like you would any other running system

Question 315

What is a hibernation file on windows?

Answer 315

A fully compressed copy of memory (RAM) at the moment of hibernation.

Some tools can uncompress it. (Volatility) Some can just process it natively.

Question 316

Difference between a PC sleeping and hibernating?

Answer 316

Hibernating isn’t a normal thing:

only occurs from loss of power/power about to drain out of device
or for shutdown/fastboot.
When installing new files/programs (recovery functions)

Question 317

Why Windows 10 being on a regular update schedule makes memory forensics harder? Why?

Answer 317

Every new major update changes it’s memory profile, for tools, making them less effective.

Things like artifact formats (prefetch, shim cache) change!

Also, hibernation file formats and use changes. (It’s not used as frequently any more)

Question 318

What is Virtual Secure Mode, and why does it affect memory acquisition?

Answer 318

Windows 10 feature. It protects the kernel and user mode components, which often block the insertion of the driver necessary to do the memory acquisition

Question 319

Problems with Windows 10 memory file acquisition using Hibernation files?

Answer 319

Data is zeroed after return from hibernation

Hibernate files only keep smaller (and less interesting) files for Hibernate, HybridSleep. (40% of total memory space) BUT they’re kept more often! Stored in case of power loss.

Fast Startup mode only holds for reboots, about 20% of memory.

Question 320

Where is hibernate files backed up to?

Answer 320

Trick question! Nowhere. It’s not backed up in VSS.

Question 321

Core components of what we find in RAM

Answer 321

Kernel Processor Control Region (KPCR)
Kernel Debugger Data Block (KDBG)
Directory Table Base (DTB)

Question 322

Can create volatility environment variables for what?

Answer 322

Things like image location, with a file path, or a specific O/S profile (Win10, update 6, etc)

Question 323

How to:

Recover metadata from a memory image

• Determine the OS and service pack/update (profile info)
• Find date and time when memory was acquired

Answer 323

Volatility plugin -imageinfo

Question 324

what is volatility’s –profile for?

Answer 324

telling it what O/S and build number/service pack the memory sample is from

Question 325

Alternative to imageinfo plugin to find the O/S of a memory image w/Volatility

Answer 325

kdbgscan plugin

Question 326

Signs you picked the wrong volatility profile

Answer 326

Pslists, pecan, filescan, and hiveliest don’t return sane results or gibberish

Question 327

Uncompress and converts Converts hibernation files and crash dump files, as well as snapshots/vbox memory, to raw memory images in volatility

Answer 327

imagecopy plugin

Question 328

During step 1 of memory analysis, which is…… we start with looking at these process blocks

Answer 328

EPROCESS blocks, which show the file links (forward and backward) to parent and child processes

Question 329

Items to look for when analyzing processes

Answer 329

Name - Spelled correctly, legit process
Path - Running from correct dir
Parent process - what you’d expect
command line - arguments and switches make sense
Start time: was it started at boot, near attack?
SID - do the SIDs make sense? Are system/user account SIDs launching correct processes?

Question 330

Specific plugins for finding rogue processes in volatility

Answer 330

malprocfind - automatically identify suspicious system processes

processbl - compare processes and loaded DLLs with a baseline (a known good image for comparison)

Question 331

Good way to compare processes w/volatility to a known good image

Answer 331

processbl ; run against a baseline image

Question 332

How to identify processes that are hidden or no longer running in volatility? Why would things appear here?

Answer 332

Use the psscan plugin

Rootkit detection
may have crashed or not cleanly exited

Question 333

Useful plugin for identifying processes spawned by the wrong parent in volatility

Answer 333

pstree

Question 334

Useful way to identify webshell commands using volatility

Answer 334

Use PStree: see commands being sent by the parent web process.

Question 335

Limitation of the malprocfind volatility plugin

Answer 335

It only looks at common system processes: items like cars, wnnlogon, services, lass, etc.

Question 336

Three plugins used to baseline in Volatility

Answer 336

processbl
servicebl
driverbl

Can be run to tell you what the “diff” between the image is, or, what matches. (The latter can be useful for showing the same driver, but with different paths, etc)

Question 337

Conducting research into what DLLs, registry key access, network sockets, and memory areas used by processes is found in its

Answer 337

Windows Process Objects

Question 338

Handles within process objects contain what info?

Answer 338

Pointers to a resource
Directories and Registry keys access by a process
Mutex/Semaphores (access to objects)
Events

Question 339

Seeing a processes memory areas used can be found in…

Answer 339

memory sections of a process object (volatility)

Question 340

Getting directories and registry key access, events, and object access from a process is found with what plugin for volatility?

Answer 340

handles (Prints the list of open handles)

Question 341

Prints the loaded dlls for each process in volatility

Answer 341

dlllist

Question 342

Scan memory for windows service information in volatility

Answer 342

svcscan

Question 343

How to see the command line associated with a running process?

Answer 343

in volatility, use dullest to display the loaded dlls and command lines

Question 344

How to extract a specific DLL for analysis with volatility

Answer 344

use dlllist to identify a specific DLL (and its base offset) and then use dlldump to extract it.

Question 345

Why do we want to look at the access tokens for a process? How?

Answer 345

Give us the running user of the process, and the relative authority given to the overall process.

use getsids plugin to see token info, which shows you the account Sid AND the group info

Question 346

How to find process SIDS, which would show you system processes running with a user context?

Answer 346

getsids

Question 347

LOcalSystem SID

Answer 347

S-1-5-18

Question 348

NetworkService SID

Answer 348

S-1-5-20

Question 349

Administrator group SID

Answer 349

S-1-5-32-544

Question 350

User group/guest SID

Answer 350

S-1-5-32-545

Guests:
S-1-5-32-546

Question 351

Handles in a process is all of the…..

Answer 351

Nouns.

Files, Objects, Keys, etc.

Question 352

Limits to looking at process handles in volatility, and a way to navigate it

Answer 352

there’s hundreds or thousands per process

-t (gripping the file) can limit it to File or Registry Keys for quick wins

Question 353

What is a mutex/mutant?

Answer 353

Type of process structure: it’s a governor.

Processes will use it often as a flag so that if you run a second copy of the process, it won’t launch. (Wont need to instantiate another version of it) Malware uses it to prevent multiple infections/dos’ing yourself.

Make great IoC!

Question 354

Well known malware will ________to say, regardless of version, that a copy of the malware was installed and running.

Answer 354

use a mutex flag

Carbon Black and Falcon, etc will look for these. When intel produces it as an IoC for malware, can load it as a yara signature

Question 355

When Threat Intel/Malware analysis produces a mutex, what can be done with it?

Answer 355

Make a yara signature and sweep for that flag, as it’s usually a solid IoC that the malware was installed on the host

Question 356

Some things to look for with the svcscan plugin for Volatility

Answer 356

Scan for service records, with associated info on processes and drivers.

Can look for windows services that are used as a persistence mechanism: Auto starts, etc. Can also find services that malware stopped. (Like antivirus services being stopped)

the verbose option will identify the DLLs used by services.

Question 357

Some things to look for in network sockets established by processes?

Answer 357

Things that aren’t web browsers that are connecting on 80,443,8080

Eliminate product updates.

Focus especially on anything RDP or DNS to unusual names

Question 358

Where would you see internet explorer using weird protocol ports? (in memory)

Answer 358

Using network sockets for a process that are opened. use iexplore/edge opening sockets to a weird port

Question 359

Whats “poker hands” as they relate to network sockets

Answer 359

Look for 4444 or 5555, or straights (4567) because those tend to mean something/suspicious

Question 360

RPC connections between workstations is weird, because

Answer 360

workstations don’t fully establish RPC connections to communicate natively in AD environments!

Question 361

What is a service opening a connection to itself (127.0.01:random to 127.0.0.1:3389)

Answer 361

Evidence of port redirection. (Netcat shoveling, etc)

Question 362

Plugin for volatility to give you connections and sockets (versus just list of tcp connections)

Answer 362

netscan

Question 363

What types of connections are returned from volatility’s netscan plugin

Answer 363

both active and terminated connections - pay attention to the process.

Question 364

First thing that should flag in your mind when you find evidence of code injection

Answer 364

Something, on the system, that is causing the code injection. (Aircraft carrier during pearl harbor analogy; for planes to get there, they had to have been carried somewhere. Must be an aircraft carrier somewhere)

spearfish code; initial access.

Question 365

Why use code injection?

Answer 365

Camoflagues code
Access memory/permissions of target system
Process migration
Evade A/V and Allowlisting
Facilitates complex attacks (Rootkit)

Question 366

Simple code injection techniques are ____ to find for manual memory analysis, versus more complex techniques, which are ______ to find.

Answer 366

Simple code injection: easy for A/V, EDR; hard for manual

Complex code injection: harder for A/V/EDR find, much easier to find manually

Question 367

Three very common types of code injection, and how they work

Answer 367

Simple code injection: Writing into existing DLLs or code

Reflective DLL injection: Loading code independent of host processes. (For example, meterpreter uses it’s own loader) Powershell can do this, too.

Process hollowing: starts a suspended service, carves out a section for new code, and then starts service. Much of the code (like DLLs, handles, etc are from original process, making it harder to see)

Question 368

Loaded a service in the suspended state, carving out some space for new Code, and then launching it is an example of

Answer 368

Process Hollowing

Question 369

VirtualAllocEX() and CreateRemoteThread() and SetWindowsHookEx() are techniques found in what, and what do they do?

Answer 369

Simple Code injection (DLL injection)

They create space in the DLL, on disk, and write in new code.

Question 370

When does the injected DLL usually get caught, by signature based methods?

Answer 370

When it gets loaded from the volume it lives on into memory, and is checked.

Question 371

Why is reflective techniques easier for manual review, but harder for automated techniques?

Answer 371

Its easy to see DLLs that aren’t loaded from file, or loaded from a standard location. DLLs loaded in unusually way are glaring beacons of weirdness.

For example, DLLs loaded down from memory dont have a source file on disk!

Question 372

Two popular plugins for finding DLL injection

Answer 372

ldrmodules

Malfind

Question 373

What does ldrmodules do in Volatility?

Answer 373

Detect unlinked DLLs and non-memory mapped files

Checks the “DLL manifest” of the PEB (Process Execution Block) and finds DLLs that were removed from the manifest, or unlinked.

Look for DLLs with no “MappedPath” info

Question 374

what does malfind do in Volatility?

Answer 374

Finds hidden and injected code, and will dump affected memory sections

Question 375

What is a lack of a “mapped path” or a weird path for a DLL in the PEB indicate?

Answer 375

That it was not loaded using the Windows API, or loaded in some unusual way. (Often indicative of a DLL injection attack)

Question 376

What’s special about executable code in the ldrmodules plugin of Volatility?

Answer 376

They will flag as “false” for InInit, because they’re executable.

Question 377

Stuxnet uses what type of code injection? Why is this easier for manual review?

Answer 377

Process injection

Can find duplicate examples of dlls that should only have 1 version of it, which is glaring

In memory, the lack of a mapped path from where the DLL was loaded combined with it not being on the PEB (manifest) is a red alarm light

Question 378

What does the “Base” section of a ldrmodules volatility plugin output?

Answer 378

the memory section it’s present in. (Will be mapped to the Process Execution Block, PEB, for legit DLLs)

Question 379

What is reflective code injection? Who uses it?

Answer 379

When you can get arbitrary code execution (injection into a process) without using the Windows LoadLibrary code.

Manage to get code into a process/DLL w/out using Windows process.

Metasploit, Cobalt Strike, Pulsar, etc

Question 380

Easiest way to detect reflective code injection?

Answer 380

Manual memory analysis! Because most security tools are looking at manipulation of the Windows loader API, these techniques when successful are harder to see, but glaring in manual memory review. (malfind)

Question 381

Malfind (volatility) goes through ______ to perform its checks.

Answer 381

Memory, every process, and looking in “mapped Path, page execution read/write” which is a section that and looks for anything that’s marked as being executable

Then, looks for a section on disk mapped to that executable.

Question 382

Malfind is good for finding

Answer 382

reflective types of code injection techniques

Question 383

Like on a file system, marking a file as being executable, but for code in memory

Answer 383

The VAD tree MappedPath section that Malfind looks at

Question 384

What volatility plugin dumps extracted files it deems potentially malicious, and how?

Answer 384

Malfind: –dump-dir=

Question 385

When executables are dumped out of Volatility’s malfind search, what is the first thing it does to check to see if the dumped files are code?

Answer 385

the “MZ” Header is usually indicative of code.

MZ is indeed the characteristic signature of a .exe file:

The DOS MZ executable format is the executable file format used for .EXE files in DOS.

The file can be identified by the ASCII string “MZ” (hexadecimal: 4D 5A) at the beginning of the file (the “magic number”). “MZ” are the initials of Mark Zbikowski, one of leading developers of MS-DOS.

Question 386

How does modern malware try to hide from the malfind executable dump?

Answer 386

Malfind only shows a preview of the first 64 bytes; can start with nonsense, then have a jump/redirect later to the code.

By manipulating the file with memory reads, so that the first two bits aren’t the standard MZ header, but that it jumps to it under conditions. Advanced stuff.

Question 387

Peanut Butter and Jelly in code example

Answer 387

Take a piece of bread
PB on bread
Jelly on PB
Take a piece of bread and put it on the jelly

Code in assembly often has the same instruction as the one below, can see a discernible sequence.

Question 388

How to avoid malfind counter-measures?

Answer 388

USe –dump-dir options that outputs the entire contents, vs. just the 64 byte header.

Can also just scan the files, or set up yara scans.

Question 389

Two plugins for detecting process hollowing in Volatility

Answer 389

Hollowfind and threadmap

Question 390

Volatility looks for Rootkits by looking for kernel hooking in what plugins

Answer 390

modscan: finds modules via pool tag scanning
apihooks: Finds DLL function hooks
psxview: finds hidden processes via cross-view tech
ssd: displays system service descriptor table entries

Question 391

Requirement for Rootkit hooking

Answer 391

Has to be signed code, so it can get into ring 0 process

Question 392

Displays hooked functions with the System Service Descriptor Table (Windows kernel hooking) (Rootkits)

Answer 392

ssdt module of volatility

Question 393

Key first step to finding Rootkits in the SSDT table, and eliminating “known goods”

Answer 393

grep out entries with ntoskrnl and wn32k, which are normal mods.

Question 394

DKOM is a process to….

Answer 394

Hide Rootkits by removing them from the EPROCESS double linked list. (Forward link, backward link)

Question 395

Finding DKOM (process hiding) is checked with

Answer 395

psxview; checks the splits and psscan output against what’s running a thread.

Question 396

Scans memory to image to find loaded, unloaded, and unliked kernel modules (drivers)

Answer 396

modscan/modules plugin of volatility

Question 397

Diffs drivers vs. known good drivers

Answer 397

driverbl plugin to volatility; like servicbl, lets you compare it against a known good baseline image

Question 398

Can be used to manipulate calls to the notepad, microphone, font renderer, and others in order to “spy” on things discreetly.

How would you see these calls?

Answer 398

the Windows API, which can be “hooked”

Find these hooks with the apihooks module of volatility

Question 399

These hide the existence of system objects like processes, files, reg keys, and network artifacts

Answer 399

Rootkits

Question 400

idp and driverirp are use for

Answer 400

unlinking and identifying api hooking

Question 401

Best way to extract processes, drivers, and objects

Answer 401

dlldump
moddump
procdump
memdump
cmdscan
dumpfiles
filescan

Question 402

how to scan memory samples for file objects (docs, pdfs, etc)

Answer 402

filescan

Question 403

how to extract files (docs, pdfs, etc) from memory by name or physical offset

Answer 403

dumpfiles

Question 404

Can extract kernel drivers from a memory sample

Answer 404

moddump

Question 405

Profile to dump out history for specific processes; for example, get the chat history for a Skype process, or command line history (from conhost)

Answer 405

memdump, or vaddump. (Will dump memory sections owned by a process to a file or group of files)

Question 406

What can we do with a memdump sample, from the volatility plugin?

Answer 406

can do strings/unicode extraction; can pull useful commands out of the sample (using grep on the extracted filename)

Question 407

How to extract the console output/command history from memory?

Answer 407

Use cmdscan and consoles plugins, and run strings/greps against that output. (Better resideue of command_history and console_information)

Question 408

Memory analysis tools other than Volatility (live systems)

Answer 408

Recall and GRR/Velociraptor (Free EDR tools)

Question 409

Allows you to create indicators out of memory dumps

Answer 409

yarascan

Question 410

Tool for extracting ascii and unicode strings from memory dump files

Answer 410

bstrings - handles regex, too

Question 411

Three main pieces of a super timeline

Answer 411

FileSystem data
Windows Artifact Data
Registry keys

Question 412

What is a “pivot point” in timeline analysis?

Answer 412

An event, malicious or otherwise, in which you can see a group of threat actor activity just by “temporal” analysis

Question 413

Tool for extracting the metadata from a system, only

Answer 413

Fls or MFTEcmd

Question 414

Tool for creating a super timeline, creating the standard file system metadata extract as well as extra enrichment data

Answer 414

Plaso (log2timeline)

Contains filesystem artifacts, artifact timestamps, registry timestamps, and works on all O/S variants

Question 415

Four timestamps for an NTFS file

Answer 415

m - Data content change time (modified)
a - Data last access time (accessed)
c - metadata change time (MFT changed)
b - metadata creation time (Created)

Question 416

What is a “MACTime” column in a timeline for?

Answer 416

The specific timestamp that was modified:

Modified
Accessed
Changed
Birthed (created)

Question 417

Tool that lets you interact with a forensic image as if it was a normal filesystem

Answer 417

FLS

Question 418

What is a body file?

Answer 418

a master timeline with relevant data from all the individual images

Question 419

3 main types of data collected from filesystems

Answer 419

1. Allocated files (Normal files)
2. Deleted files (Files deleted normally, but still have structures; file path name, permissions, timestamps)
3. Unallocated inodes (Orphan files, with no structure.

Question 420

Sort the data from a filesystem collection tool (body file) into a usable segment to analyze with…

Answer 420

Mactime tool (perl script)

Question 421

Steps for timestomping

Answer 421

Manually set the Standard Information attributes
Copy the file to another folder
Manually set the Standard Information attributes (some will change during the move)

Question 422

What is time stomping?

Answer 422

Manually setting timestamps (using file copy operations) to change the times, cover up when it was actually done

Question 423

3 Parts of Log2timeline

Answer 423

The log2timeline binary, which extracts timelines
pinfolds: displays storage metadata
sort - sorts and processes output

Question 424

What does Plaso do?

Answer 424

Uses Log2Timeline, but pulls relevant forensic data from ALL the places

LNK
Jumplists
All Browsers webhistory
Registry )shellbags, mountpoints. services, autoruns; terminal server. task scheduler, etc etc)
Prefetch
Shimcache
Winfirewall
and many more

Question 425

What types of web artifacts does Plaso pull out?

Answer 425

everything. Cache, cookies, history, etc, from all browsers

Question 426

How to import additional file system details into Plaso

Answer 426

mactime parser

Question 427

Things log2timeline can look at

Answer 427

Mount point
Image
Kape output directory
partition
etc

Question 428

How does Plaso handle volume shadow copies?

Answer 428

When it detects, it will ask if it wants to extract them in the timeline.

Have to be careful, it slows down analysis a lot.

Question 429

Ways to streamline log2timeline

Answer 429

Can use a filter file, or just use specific parsers (just MFT, or just specific registry key, or trigger if it finds certain things)

Question 430

How does log2timeline filter?

Answer 430

Use pipe for OR, also the .+ will recurse something in the directory. Lets you set wildcards and conditions for directories.

EX: /(Users|Docs and Settings)/.+/NTUSER{.}.DAT

Question 431

SANS provided filter file for log2timeline…

Answer 431

Uses 99% of the standard use cases for extractions. Conditions found in cape. Looks for see idic things in memory, registry, LNK, Jump lists, prefetch, specific Event Logs, MFT entries, ec.

Question 432

How would you let Plaso know that you want to skip collecting something specific, like winevt logs or recycle_bin, or chrome cookies?

Answer 432

in the –parsers command line switch, do a -

log timeline.py –parsers parsers “win7, -winevt”

Question 433

Tools for sorting a super timeline generated by Plaso

Answer 433

pinfo.py and psort.py

Question 434

Pinfo.py does what?

Answer 434

Takes a plaso dump and tells you what’s in it, and how big it is.

Shows you what parsers have been run and what’s inside each file, how many events

Question 435

What are lnk files?

Answer 435

Shortcut files.

Question 436

what does Psort.py

Answer 436

Sorted the data output from Plaso. Can use it to “date bound” the results. Can also change the output type. (CSV vs. xlsx.

Can also sort it into a specific timezone, ie EST/PST

Question 437

Steps for creating a sample super timeline

Answer 437

Mount the remote system drive
Extract with log2timeline.py (with parsers we care about)
Filter the timeline w/psort to the range of time you’re interested in.

Question 438

Steps for creating a sample super timeline for a phishing attack

Answer 438

Mount the remote disk w/f-response
create timeline w/ standard windows filters, with log2timeline
gather the filesystem data, with MFTECmd.exe and create a body file
parse the body file with the maytime parsers (log2timeline)
sort the data for the date range you’re interested in

Question 439

How does SANS recommend coloring the super timeline?

Answer 439

Red for evidence of execution
Gray for event logs of interest
Yellow: web history
Blue: USB usage
Black for deleted items
Light green: file opening
dark green: folder opening

Question 440

What does MACB stand for?

Answer 440

Modified, accessed, (MFT record) changed, birthed.

Question 441

5 anti-forensic techniques for filesystem hiding

Answer 441

Timestomping
File Deletion (Delete)
FreeSpace Wiping
Data Encryption (.rar)
Fileless malware

Question 442

Manipulating registry keys or deleting them, or hiding scripts in the registry, are examples of

Answer 442

Registry anti-forensics techniques

Question 443

How long will a deleted file hang around, on average, once it’s deleted?

Answer 443

SSDs and Disks will cleanup via optimization or drive “trimming” which wipes out unallocated storage areas, which zeroize deleted files. Around weekly, or less depending on how long it’s been.

Expect 72 hrs.

Question 444

Best place to find deleted or wiped files

Answer 444

outside of 72 hrs, residue will likely exist in the volume shadow if at all

Question 445

Very common anti-forensics/hiding technique for Powershell scripts

Answer 445

Registry key, as a download cradle type abbreviated script

Question 446

Why is the registry a poor place to hide Powershell scripts?

Answer 446

It’s a database. It acts like a mini-file system; when the key is deleted, it will exist as unallocated space forever. It leaves permanent forensic residue, indefinitely.

Anything that is a filesystem works this way, without defragging/disk cleanup.

Question 447

How do things get removed from a PST file? (old deleted/archived email items)

Answer 447

When it’s COMPACTED. Compaction removes deleted files, which would cover forensic residue, but create it’s own record of being compacted.

Question 448

Privacy cleaners vs forensics

Answer 448

Ineffectual. They will clean out your files, but not delete them forensically; in fact they point out specifically what was deleted

Question 449

Easy way to search for hidden scripts someone is trying to hide in a registry key

Answer 449

Use registry explorer (or regcmd, the Zimmerman tool) and search for anything that has Base64 in values above a specific length, like 400 characters; scripts are unusually large for a key.

Question 450

Way to speed up cataloguing the event logs

Answer 450

Use the –vss option; looks at all 3 versions, dedups, and catalogs them.

Question 451

Equivalent to virtualization snapshots. (Point in time)

Answer 451

the Volume Shadow copies. Usually have overlap with each other.

Question 452

Volume shadow database is usually ____ sized

Answer 452

about 3-5% of the hard drive.

Question 453

When does volume shadow “snapshot” occur

Answer 453

For servers, daily

For workstations, 3-6 that cover about a week; triggered on installation of software, reboots, events

Question 454

tools for working with VSS files

Answer 454

Convert to VHD for analysis
use iSCSI and mount it to SIFT
vshadowinfo, vshadowmount

Question 455

Best O/S for doing volume shadow work

Answer 455

SIFT; it does a better job of ignoring permissions, seeing everything. (Windows APIs respect windows permissions)

Question 456

Command used to mount VSS in SIFT

Answer 456

ewfmount to see the mount points/ vshadowmount to mount them

Question 457

3 steps for mounting shadow files

Answer 457

Attach the remote system drie
vshadowmount /dev/sdc2 /mnt/vss
Make a for loop, mount every individual VSS “drive” to a Linux file point

Question 458

Why dont we see $MFT, $EXTEND, etc

Answer 458

The O/S hides them. (Truly hidden) if you mount a disk imagine on Linux, it will ignore those MSFT rules and expose them.

Question 459

How do you see the $MFT?

Answer 459

You have to look at it on a non-windows (Linux) machine, mount the drive for analysis, and it’s there, BUT NOT EXPOSED BY LS command?!

Question 460

What is the $MFTMIRR on an NTFS volume? How is it different?

Answer 460

A backup copy of the MFT. Only contains the first 4 records.

Question 461

What is the $LOGFILE on an NTFS volume?

Answer 461

Transactional logging file

Question 462

What is the $VOLUME on an NTFS volume?

Answer 462

Contains the volume name, NTFS version number, and a “dirty flag”

Question 463

What is the $ATTRDEF on an NTFS volume?

Answer 463

Contains the attribute definitons

Question 464

What is the $BITMAP on an NTFS Volume?

Answer 464

Tracks allocations (in-use versus free) of each cluster in the volume

Question 465

What is the $BOOT on an NTFS Volume?

Answer 465

MBR

Question 466

What is the $BADCLUS on an NTFS Volume?

Answer 466

Something that tracks bad/defective clusters so NTFS won’t use them

Question 467

What is the $SECURE on an NTFS Volume?

Answer 467

Tracks all the security information for files on the volume (Security manifest)

Question 468

What is the $EXTEND on an NTFS Volume?

Answer 468

A directory containing $UsnJrnl, ObjId, $Quota, $Reparse

Question 469

What does the $MFT contain on NTFS?

Answer 469

Metadata catalog; think of it as a Dewey Decimal Card Catalog. (where is book stored, when was it last checked out, etc)

contains data that describes files. Pointers to data layer for files, MACB times, permissions. Everything has a numeric address.

Question 470

How does the MFT provide “addressing”

Answer 470

Shows where stuff lives on the disk; what cluster. It’s an index number. If the drive is fragmented, what fragment does the data/file live on. What’s the starting number for the volume, what’s the end number.

Question 471

Each MFT entry is a fixed length ($EXTEND, $BOOT, etc) and it’s structured how?

Answer 471

1024 bytes. Databases.

Question 472

What happens when you delete files, to their record in the $MFT?

Answer 472

For NTFS volumes, those records get a bit flipped that it’s “allocated space” and now is “unallocated space”

Those entries remain until they’re overwritten by new entries.

Question 473

How would you identify something from a MSFT O/S in the MFT that’s unusual?

Answer 473

Files are recorded in the MFT by inode in alphabetical order, typically. Items that were added to directories like System32 (core Windows files) will show up as far outliers. (Or be grouped with the non-native programs)

Question 474

How does the $MFT reflect a TA adding files in two separate physical places on a disk?

Answer 474

Sequentially. Since the MFT records them contiguously into the catalog, it can be used to find values that are close to each other, representing related files or malware in two separate places.

Question 475

What does the linux xxd command do, and how do forensicators use it

Answer 475

creates a hash dump of a files contents, so you can view magic numbers and such

“When you’re trying to make sense of a binary file format, a good hex viewer or hex editor is an invaluable tool. As shown in “Ultima 1 Reverse Engineering: Decoding Savegame Files“, a typical workflow involves viewing a hex dump of the binary data, making some small change, taking a second hex dump, and comparing the differences. If you’re lucky, you might even be able to observe patterns in the data directly.”

Question 476

What can you see in the hex dump of an MFT entry?

Answer 476

the “FILE” signature: 46 49 4c 45, where the entry starts. (can see FILE0 in the readout)

Can see the sequence number, node entry number.

Question 477

Every file in the MFT has what standard attributes?

Answer 477

$STANDARD_INFORMATION
$FILE_NAME (long and/or short)
$DATA

Question 478

What’s in the $STANDARD_INFORMATION of a MFT entry?

Answer 478

What type of file it is
MACB times

ARCANE RULES OF NTFS timestamps

Question 479

What is kept in the $FILE_NAME of a MFT entry?

Answer 479

Unicode name of the file, what folder is it found in.

Question 480

MFT manipulation (Timestamps) can be found by

Answer 480

1. Using MFTcmd and running the timestamp anomaly engine. Will find lack of sub second precision, differences in timestamps.
2. Can run a scatterplot of times things were created, inode creation time.

Question 481

what does sorting by inode table, with ls -li, in the MSFT for a windows system tell you?

Answer 481

It should show you a sequence of all the binaries/dll installed at the same time (install!) and then the outliers.

Question 482

What can be found in the $DATA part of the MFT?

Answer 482

the Data run: starting location, and length, of a data section on a cluster.

Is Resident will tell you whether the data lives in a space on cluster, or (isResident) is stored on the MFT itself.

Question 483

What is a Zone Identifier 3?

Answer 483

It’s a flag marked in the MT, in the MFT, as an evidence of download. It’s marked as data that was downloaded from the internet.

Question 484

Tools for looking at the metadata of a file, for NTFS systems

Answer 484

itstat

Shows the SID of the file, nanosecond-accuracy MACB metadata inode number, etc.

Question 485

What is the problem with file wiping?

Answer 485

Does wipe as much as you think: it overwrites the content of the file, and scramble the MFT entry. It does NOT, however, get the second language of the MFT info, which is the directory. (just the file, which shows as zzzzzzzz in the metadata, but the directory folder has the file name/MACB timestamp)

Question 486

Where can you find the file folder metadata to find files that may have been wiped?

Answer 486

i30

Directory folder; shows the file data and the deleted file information. FTK imager shows this! The slack space of a directory file will contain the file name and file metadata.

File system metadata is another place to look.

Question 487

The slack space of a directory file will contain

Answer 487

….the file name and file metadata for files in it.

Question 488

Where are file directory metadata files stored?

Answer 488

Stored in an index called $I30

Question 489

What are the two parts of the $MFT directory information indexed?

Answer 489

$I30
INDEX_ROOT: directly in the MFT
INDEX_ALLOCATION: Stored as separate index chunks for large directory listings, like System32

Question 490

How are file names stored in the directory index? $I30

Answer 490

It’s all stored as per-record list of files, with the MACB time stamp.

Question 491

Tool that parses slack space in directory structures, and what is the output?

Answer 491

WISP windows Slack Parser

Directory file extraction timeline, with MACB values of the files.

Question 492

What facility in NTFS records all the changes to metadata?

Answer 492

the Journal; can be used to identify the prior state of files. Like VSS, it’s a time machine.

Question 493

With VSS, this NTFS function allows us to peer back in time

Answer 493

USN System journal; can be combined with the MFT and $Logfile transactions to find files and what happened when

Question 494

What two things are tracked in the $UsnJournal

Answer 494

changes to the volume.
$Max - pointers that tell the system where to start reading the disk
$J - enteries for each file that has changed since log was started

Question 495

couple tools for parsing the UsnJournal

Answer 495

MFTECmd (Zimemrman tool)
ANJP (Advanced NTFS Journal Parser)
jp (Journal parser)

Question 496

GUI tool that parses the USNJournal, the MFT, and the $Logfile, into a consolidated view

Answer 496

ANJP (Advanced NTFS Journal Parser)

Question 497

What does the paid version of ANJP do?

Answer 497

It automatically flags things like open outlook attachments, Skype downloads, disk wiper artifacts, etc. (The email attachment is hard to see anywhere else)

Question 498

How to see forensically that someone opened an email attachment?

Answer 498

Volume Shadow or disk, MFTs, using ANJP to see the access to the file/action.

Question 499

How is a file written to disk? 6 steps.

Answer 499

$Bitmap is scanned for a cluster to write to
$MFT record created
$Bitmap updated to show where clusters are allocated.
$I30 of parent directory is updated.
$USNJrnl updated
$logfile updated with this transaction.

Question 500

What data still exists after a file is deleted in NTFS? (Sneaky spots)

Answer 500

Data clusters marked as unallocated in $Bitmap, but data is intact until the cluster is reused

• Slack space
• MFT record flags, $LogFile/UsnJrnl still have a record
• $FILE_NAME attribute is preserved until overwritten
• $I30 index entry