Respond Analysis
Last updated
Last updated
System Information:
These commands are used to retrieve information about the system, including the date, time, hostname, detailed system info, operating system name and version, product name, BIOS serial number, and a brief list of computer systems.
Source:
This command retrieves detailed system information using the psinfo tool from Sysinternals.
User Information:
These commands gather information regarding the user, like the current user, all user accounts, group and local group administrators, remote desktop settings, and user account details. It also retrieves command line history and saves it to a text file.
Network Information:
These commands collect various network-related information like network statistics, active connections, routing tables, ARP tables, DNS cache content, proxy settings, interface configurations, and more.
Service Information:
PowerShell commands for service information:
These commands display information related to system tasks, services, and processes that are running, including service configuration and memory usage of processes.
Policy, Patch, and Settings Information:
For listing GPO-installed software:
These commands are used to display the environment variable, group policy results, and Quick Fix Engineering (update patches) information.
Autorun and Autoload Information:
Commands to display the content of the startup service path:
Commands to display and save all autorun files in CSV and check them using virustotal:
Commands querying registry entries:
Commands for querying various registry keys under the HKEY_CURRENT_USER hive:
Commands querying registry keys under the HKEY_LOCAL_MACHINE hive:
Commands related to working with event logs, including exporting logs:
Alternate Data Streams:
check malicious file and save in csv
check malicious file
DLL Unassigned
Windows Defender
LIVE TRIAGE - Linux
System Information
User Information
List of users who have logged in:
List of users who have logged in remotely:
Show unsuccessful logins:
Display local users:
Display local groups:
Display sudo access:
Display users with UID 0:
List of valid ssh authentication keys:
List files opened by the user:
Display bash history:
Network Information
Display network interfaces:
Display network connections:
Display listening ports:
Display routes:
Display the ARP table:
Display processes and used ports list:
Service Information
List of processes:
List of loaded modules:
List of open files:
List of network-open files:
List of files opened by a specific process:
List of all files opened by a specific process:
List of unlinked processes’ keys in execution:
Processes of a PID:
Storing analysis of executable files of malware:
Live reports display:
List of services:
Policy, Patch, and Settings Information
Display files within the pam.d path:
Autorun and Autoload Information
List of cron jobs:
List of cron jobs run by root user and UID zero:
Check unusual cron jobs:
Reports
Check history of executed commands by root user:
Check the last user logged into the system:
Files, Drivers, and Shared Environment Information
Display disk usage:
Display files in /etc/init.d path:
More information about a file:
Determine file type:
Display immutable files:
List files in /root path:
Display a list of recently modified files:
List writable files:
List files created since Jan 02, 2017:
List all files and their attributes:
List files in a specific path that have a newer timestamp (might be manipulated):
Display file details:
Check file type:
Run unix-privsec-check tool:
Execute chkrootkit:
Execute rkhunter:
Execute tiger:
Execute lynis:
Execute Linux Malware Detect (LMD):
Get LMD updates:
Run and scan LMD on a specific path:
Displaying Events using usbrip:
Display history:
Display commit contents:
STATIC ANALYSIS:
Creating Mount live Sysinternals tools drive:
Checking Signature for dlt and exe files:
Display Hex and ASCI of PE files (exe or any file), with switch -n and first 500 bytes:
Use debug tool in Windows (for .java files):
Windows PE Analysis:
Displaying strings inside PE and string lengths with switch -n:
Using strings in Linux:
Using strings in Windows:
Identify Malware in dumped memory using Volatility and the Windows7SPFix64 profile:
Process memory output
Installing dc3-mwcp tool:
Using dc3-mwcp tool to check suspicious files:
Tool: PROCESS EXPLORER
Step 1: Process Listing and Inspecting Suspicious Items:
Step 2: Checking File Signatures:
Step 3: Examining Strings:
Step 4: Viewing DLLs:
Step 5: Stopping and Removing Malware:
Step 6: Remove suspicious files that run at system startup:
Step 7: Process Monitoring
Step 8: Repeat Above Steps for Identifying Suspicious Files.
OS: WINDOWS
Remotely create a memory dump:
Extract exe and dll files from dumped memory:
OS: LINUX
Create a memory dump:
Utilizing various websites and tools like dcode, StegCracker, StegExtract, Sonic Visualizer, spek, etc.
Create a copy of a suspicious process using process ID:
More information about the suspicious process in dumped memory:
Using Strings on a file:
Create a copy of a hard drive and partition including tags and hashes:
Create a hard drive and partition over SSH:
Send a zipped hard drive image over netcat: To send to the host:
To receive by the host:
To send to host host:
To receive by the host using Pipe Viewer meter:
Encryption websites:
Examining hidden data in a photo with bash script StegExtract:
Example:
Examining hidden data in a photo with StegSolve:
Examining hidden data in a file with exiftool:
Example:
Examining hidden data in music with spek:
Investigating PowerShell activity can be crucial in modern cybersecurity due to PowerShell's powerful capabilities and its frequent use in various attack scenarios. PowerShell is a versatile scripting language that provides vast access to a system's internals, making it a potent tool for both system administrators and adversaries. Hence, monitoring PowerShell execution is essential for detecting potential malicious activities.
Here's how the Windows Event IDs 4103 and 4104 pertain to PowerShell investigation:
Event ID 4103: PowerShell Script Block Logging:
Event ID 4103 is associated with PowerShell Script Block Logging, which is a feature that logs the processing of PowerShell commands and scripts. This logging includes the script block contents, even if they are obfuscated or encrypted, providing insight into exactly what code was run.
By analyzing the logs associated with this Event ID, investigators can examine the PowerShell commands/scripts executed on a system. This can be invaluable in understanding the actions taken by an adversary or troubleshooting legitimate script-related issues.
Event ID 4104: PowerShell Module Logging:
Event ID 4104 is related to PowerShell Module Logging, which logs pipeline execution details, including the names of cmdlets, functions, workflows, and scripts involved, along with their parameters.
Similar to script block logging, module logging helps investigators understand the sequence of PowerShell operations and the context in which they were run. This can be instrumental in identifying malicious PowerShell usage or troubleshooting legitimate operations.
Both Event IDs 4103 and 4104 are part of a broader PowerShell logging capability that, when properly configured and monitored, can significantly aid in the investigation of malicious activities or system issues. Collecting and analyzing these logs can provide a wealth of information about the actions being performed on a system via PowerShell, making them a crucial aspect of PowerShell-related investigations.
Process name: lsass.exe
Process path: %Systemroot%\System32\lsass.exe
Username: SYSTEM
Number of instances: One
Parent process: wininit.exe
Process name: smss.exe
Process path: %Systemroot%\System32\smss.exe
Username: SYSTEM
Number of instances: One
Parent process: System
Process name: csrss.exe
Process path: %Systemroot%\System32\csrss.exe
Username: SYSTEM
Number of instances: Two (one for system processes and one for user processes)
Parent process: smss.exe
Process name: wininit.exe
Process path: %Systemroot%\System32\wininit.exe
Username: SYSTEM
Number of instances: One
Parent process: smss.exe
Process name: services.exe
Process path: %Systemroot%\System32\services.exe
Username: SYSTEM
Number of instances: One
Parent process: wininit.exe
Process name: svchost.exe
Process path: %Systemroot%\System32\svchost.exe
Username: Varies (can run as SYSTEM, NETWORK SERVICE, LOCAL SERVICE, etc.)
Number of instances: Multiple (one for each group of services)
Parent process: services.exe
Process name: RuntimeBroker.exe
Process path: %Systemroot%\System32\RuntimeBroker.exe
Username: The user's account
Number of instances: Multiple
Parent process: svchost.exe
Process name: winlogon.exe
Process path: %Systemroot%\System32\winlogon.exe
Username: SYSTEM
Number of instances: One for each interactive user login
Parent process: smss.exe
Process name: LogonUI.exe
Process path: %Systemroot%\System32\LogonUI.exe
Username: SYSTEM
Number of instances: One (when required for user logon interactions)
Parent process: winlogon.exe
Process name: explorer.exe
Process path: %Systemroot%\explorer.exe
Username: The user's account
Number of instances: One per user session
Parent process: userinit.exe or winlogon.exe (depending on the system configuration)
Event ID 4688 records every process creation activity
Event ID 4689 records every process exit activity
Showing Microsoft autorun and hidden files Source:
-us/sysinternals/streams.aspx
منبع. us/sysinternals/bb897441.aspx
-us/sysinternals/bb896656.aspx
منبع. -us/windows/what-is-windows-defender-offline
Source:
Script for compile time and date of PE files (Only for Windows). Source: and
Source:
Source:
Source:
Source:
Source:
Ref:
Source:
Create a memory dump using LiME tool: Source:
Examining hidden data in a file with StegCracker: Example:
Examining hidden data in music with Sonic Visualizer: Example: In Sonic Visualizer, select: Pane -> Add Spectrogram -> Channel 1
