DATA SCIENCE THE DFIR OUT OF THIS! John Lukach blog.4n6ir.com - - PowerPoint PPT Presentation

▶
data science
SMART_READER_LITE
LIVE PREVIEW

DATA SCIENCE THE DFIR OUT OF THIS! John Lukach blog.4n6ir.com - - PowerPoint PPT Presentation

Jan 20, 2024 304 likes •771 views

IM GONNA HAVE TO DATA SCIENCE THE DFIR OUT OF THIS! John Lukach blog.4n6ir.com @jblukach AGENDA DATA SOURCE CLEAN DATA ADD CONTEXT VISUALIZATION SYSMON System Monitor is a Windows system service and device driver that,

slide-1
SLIDE 1

I’M GONNA HAVE TO

DATA SCIENCE

THE DFIR OUT OF THIS!

John Lukach blog.4n6ir.com @jblukach

slide-2
SLIDE 2

AGENDA

  • DATA SOURCE
  • CLEAN DATA
  • ADD CONTEXT
  • VISUALIZATION
slide-3
SLIDE 3

SYSMON

System Monitor is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time. https://technet.microsoft.com/en-us/sysinternals/sysmon

slide-4
SLIDE 4

SYSMON

System Monitor does not provide collection or analysis of the events it generates, nor does it attempt to protect or hide itself from attackers. Sysmon64.exe -accepteula

  • i
  • h md5
  • n
  • l
  • r
slide-5
SLIDE 5

SYSMON-DFIR

Michael Hagg has compiled a great list of Sysmon resources! https://github.com/MHaggis/sysmon-dfir

slide-6
SLIDE 6

EVENT IDS

slide-7
SLIDE 7

PROCESS CREATION

slide-8
SLIDE 8

NETWORK CONNECTION

slide-9
SLIDE 9

NO BLIND SPOTS

A Transparent Proxy has the ability to intercept connections between clients and servers without being visible using Web Cache Communication Protocol (WCCPv2).

slide-10
SLIDE 10

PYTHON-EVTX

Willi Ballenthin released a pure Python parser for Windows Event Log files providing programmatic access to the File and Chunk headers, record templates and event entries. pip3 install python-evtx https://github.com/williballenthin/python-evtx

slide-11
SLIDE 11

LOG VOLUME

slide-12
SLIDE 12

SEARCHABLE

slide-13
SLIDE 13

EXPLORE

slide-14
SLIDE 14

PROCESS EXPLORER

slide-15
SLIDE 15

PROCESS-FOREST

Willi Ballenthin released a Python script that builds historical process hierarchies from process auditing and Symon event logs. https://github.com/williballenthin/process-forest

slide-16
SLIDE 16

PYRAMID OF PAIN

http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

slide-17
SLIDE 17

SYSMON-FOREST.PY

https://github.com/jblukach/sysmon-forest

slide-18
SLIDE 18

HELP

slide-19
SLIDE 19

CLEAN DATA

  • -sqlite is the path to the SQLite database location
  • -evtx is the path to the Sysmon Event Log location
  • -insert is the flag to add events to the database
slide-20
SLIDE 20

STATISTICS

  • -stats on the number of processes, connections and etc.
slide-21
SLIDE 21

ADD CONTEXT

  • -dns is the path to a text file with a list of domains
  • -hash is the path to a text file with a list of hashes
  • -ip is the path to a text file with a list of ip addresses
  • -meta is the path to a text file with a list of meta data
slide-22
SLIDE 22

THIRD PARTY

  • -maxmind is the path to the GeoLite2 City database

pip3 install geoip2

http://dev.maxmind.com/geoip/geoip2/geolite2/

  • -rfc1918 flags private non-routable IP addresses

pip3 install IPy

slide-23
SLIDE 23

VISUALIZATION

  • -tree builds historical structure of processes, connections & etc.
slide-24
SLIDE 24

COLORS

  • -bad
  • -blah
  • -evil
  • -good
  • -known
  • -mark
  • -unknown
slide-25
SLIDE 25

DETAILS

  • -detail display specifics on a process by unique identifier
slide-26
SLIDE 26

DEMO

slide-27
SLIDE 27

CLEAN DATA

python3 sysmon-forest.py --sqlite Cerber.SQLite --evtx Cerber.evtx --insert

slide-28
SLIDE 28

CLEAN DATA

slide-29
SLIDE 29

STATISTICS

python3 sysmon-forest.py --sqlite Cerber.SQLite --stats

slide-30
SLIDE 30

STATISTICS

slide-31
SLIDE 31

STATISTICS

slide-32
SLIDE 32

STATISTICS

slide-33
SLIDE 33

RFC1918

python3 sysmon-forest.py --sqlite Cerber.SQLite --rfc1918 --blah

slide-34
SLIDE 34

RFC1918

slide-35
SLIDE 35

CONTEXT

slide-36
SLIDE 36

CONTEXT

python3 sysmon-forest.py --sqlite Cerber.SQLite --meta input.txt --bad

slide-37
SLIDE 37

CONTEXT

slide-38
SLIDE 38

VISUALIZATION

python3 sysmon-forest.py --sqlite Cerber.SQLite --tree

slide-39
SLIDE 39

VISUALIZATION

slide-40
SLIDE 40

DETAIL

python3 sysmon-forest.py --sqlite Cerber.SQLite --detail {596b7bab-706f- 586a-0000-00108cba1c00}

slide-41
SLIDE 41

DETAIL

slide-42
SLIDE 42

BONUS

slide-43
SLIDE 43

CERBER

slide-44
SLIDE 44

CERBER

slide-45
SLIDE 45

CERBER