Forensics Flashcards
How do items get into the SIEM
Sensors
Sensitivity
Trends
Alerts
Correlation
Log Files
Describe the sensors that feed data into a SEIM
The endpoint being monitored feeds sata to the SEIM
Describe sensitivity as it relates to a SEIM
How much or how little we are logging and how sensos are configured to determine how much data is passed
Describe Trends as they relate to SEIM
SEIM identifies trends in the network as data is fed to the SIEM, for example, failed login attempts accross many user accounts may be brute force
How are alerts created in a SIEM
Created in the SIEM based on certaim parameters, such as account lock outs, failed password attempts
Describe correlation of SIEM data
Ensuring that endpoints are using standardized IP and hostname formatting, and devices are using UTC
Describe log files as they related to SIEMS
Files that record etiehr events that occur in an OS or other software that is being run, or message between users for COMMS software
What are the types of log files
System
Application
Security
web
DNS
Authentication
DumpFiles
VOIP
Describe what system, application, and security log files provide
System - What is occuring on host or server
Application - what each app is doing
Security- monitor log in events
Describe what web log files provide
Web - may be a proxy server that will detail what websites users are visiting, and if you host a web server, these logs will tell you what files and hosted items are being interacted with
Describe what DNS, and authentication files provide
DNS - What requests have been made of the DNS server, see what host is asking for what address
Authentication - will show all authentication info across files, systems, resources
Describe what DumpFiles and VOIP logs are used for
Dump Files are logged when things crash, memory contents are written to disk for later review
VOIP logs can be captured as VOIP metadata
What are the three variations of SYSLOG
Syslog, rsyslog, syslog-ng
Which versions of SYSLOG offer encryption
Syslog-NG
What is JournalCTL
LInux CMD utility used for querying and displaying logs from JournalD, the systemD logging service in Linux
What is NXLog
Multiplatform log management tool that helps to identify security risks and policy breaches and analyze operational problems in server, OS, and application Logs
Open source, cross platform tool similar to rsyslog and syslog-NG
What is Netflow and what data does it collect/display
Network protocol developed by Cisco that collects active IP netweork traffice as it flow sin our out of an interface.
It can collect the point of origin, destination, volume and paths on the network that data has.
What are some uses of Netflow and it’s limitation
It provides a summary of data going in and out of a network, and can display network spikes which can help admins determine who is using the most bandwidth and at which time.
Netflow CANNOT tell exactly what files are leaving or entering the network
What is Sflow
Sampled Flow provides a means for exporting truncated packets with Interface counters for the purpose of network monitoring
It is an open source version of netflow
It will sample packets using X out of Y method
What is IPfix
IP Flow info Export - Universal standard for export of IP flow information from network devices and mediation systems such as account/billing systems that facilitate measurement, accounting and billing.
Back end of service management, cell phone and ISPs can use this to determine how much data you have used in a given period, and bill you for what you use.
Describe metadata
Data about data, could provide an underlying definition or description of underlying data that make finding or working with data easier.
Example:
Files > Created on, Created by
Email > email header
Describe forensic procedures
Written procedures that ensure that personnel handle forensics properly, effectivity, and in compliance with regulations
What are the four steps to forensics
Identifications
Collect
Analysis
Reporting
Describe Identification and Collection of forensic evidence
Identification - Ensure scene is safe and secure to prevent contamination, and identify scope of what evidence is to be collected
Collection - Ensure authorization to collect evidence, document and prove the integrity of the evidence
Describe the analysis step of forensics
A copy of the evidence is created for analysis and repeatable methods and tools are used to analyze the data
Describe the Reporting step of forensics
A report is created that detais the methods and tools used in the investigation.
It presents detailed findings and conclusion based on the analysis.
What is a legal hold
Process designed to preserve all relevant information when litigation is reasonably expected to occur .
A liaison who has legal knowledge and expertise should be appointed and act as a POC for LE
What are the ethics that forensic analysts must abide
- Analysis must be performed without bias
- analysis must be repeatable by 3rd party
- Evidence must not be changed or manipulated
Describe a forensic timeline
A tool that shows the sequence of filesystem events within a source image using a graphical format
What are some common questions to ask in the analysis stage of an incident response
How was access to the system obtained
What tools have been installed - RAT, NMAP
What changes to the files have been made
Was data exfiltrated
What was sensitivity of the data exfiltrated
When a disk has been retrieved as evidence, how should the data be handled
A forensic disk image of the data should be taken, This will allow for any malware to be removed from the system.
What are the first four steps that should be followed after a forensic image has been taken of digital evidence
- Capture and Hash system images
- Analyze data with forensic tools
- Capture screenshots of the machine
- Review network and traffic logs
What are steps 5-9 when analyzing collected data
- Capture video - CCTV?
- Consider order of volatility of data on systems you are collecting data from
- take statements
- review licensing and documentation
- Track man hours and expenses
What is order of volatility
consideration when collecting digital evidence
- CPU Registers and Cache
- Contents of RAM, Routing Tables, ARP Cache, Process tables, and swap files
- Data on persistent mass storage
- remote logging and monitoring data
- physical configuration and network topology
- Archival Media - backups
Define the process of data acquisition
The mehtod and tools used to create a forensically sound copy of data from a source device asuch as memory or disk
What may complicate data acquisition
BYOD - Employees using their personal devices may not allow forensic copies of their personal data to be made and analyzed
How does a PCs power state affect data acquistion
Some data may only be available while the PC is powered on, other data may require the PC to be turned off, or be collected during a reboot.
Where are Windows Reg Keys stored
Most are stored on Disk, but HKLM/Hardware are stored in memory, and can be accessed via a memory dump.
