BTL1 Notes

Common Ports

Port	Service	Description
20,21	FTP	File Transfer Protocol used to transfer files b/w systems.
22	SSH	Secure Shell Protocol allows users to securely connect to a remote host.
23	Telnet	Used before SSH, allows users to connect to a remote host, doesn’t offer encryption.
25	SMTP	Simple Mail Transfer Protocol used to send emails between servers within the network, or over the internet.
53	DNS	Domain Name System converts human-readable domain names to machine-readable IP address.
67,68	DHCP	Dynamic Host Configuration Protocol assign IP address-related information to any hosts on the network automatically.
80	HTTP	Hypertext Transfer Protocol allows browsers (Chrome, Firefox, etc) to connect to web servers and request contents.
443	HTTPS	Hypertext Transfer Protocol Secure is a secure version of HTTP Protocol which allows browsers to securely connect to web servers and request contents.
514	Syslog	Syslog server listens for incoming Syslog notifications, transported by UDP packets.	***

Phishing Analysis

---

Gathering Artifacts (IOCs)

Email Artifacts -

• Sender Address

• Reply-To Address

• Sending Server IP

• Reverse DNS

• Recipient Address

• Subject Line

• Date & Time

Web-based Artifacts -

• Full-URLs (sanitized)

• Domain Names

File-based Artifacts -

• Filename & Extension

• MD5/SHA1/SHA256 Hash Values

Artifacts Analysis

1. Visualization Tools - URL2PNG, URLScan

2. URL Reputation Tools - VirusTotal, URLScan, URLhaus, WannaBrowser

3. File Reputation Tools - VirusTotal, Talos File Reputation

4. Malware Sandboxing - Hybrid Analysis

Defanging URL & IP Address

1. Defang URL, Defang IP Addresses - CyberChef (gchq.github.io)

Digital Forensics

---

Data representation can be done in the following ways,

• Base64

• Hexadecimal

• Octal

• ASCII

• Binary

Metadata

# Provided with information such as the read/write permissions, the file name and size, and the times for when the file was last accessed and modified.
ls -lisap <file>
stat <file>

# Received metadata from files
# sudo apt-get install exiftool
exiftool <file>

File Carving

# To choose which file type you want to retrieve you can edit in /etc/scalpel/scalpel.conf
# To start retrieving a file using command below
scalpel -b -o <output-dir> <disk-image-file>   

Hashing

1. Windows

Get-FileHash -Algorithm [algorithm-to-use] [file]

1. Linux

md5sum <file>
sha1sum <file>
sha256sum <file>

Data Acquisition

• FTK Imager - import .img file in FTK Imager. Download

• KAPE - uses for fast acquisition of data. Download

Windows Investigation

LNK Files -

• These files can be found at

%userprofile%\Appdata\Roaming\Microsoft\Windows\Recent

• Windows File Analyzer can be used to view these files in form of human-readable format.

Prefetch Files -

• These files can be found at

C:\Windows\Prefetch

• Prefetch Explorer Command Line can be used to view these files in form of human-readable format a.k.a. PEbatch.exe.

# Using PEbatch requires administrator privilege
PEbatch.exe -f [path-to-file].pf
PEbatch.exe -k "string-to-match" -d [path-to-prefetch-folder]

Jump List -

• These files can be found at

C:\Users\% USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

• JumpList Explorer could be used to analyze these files.

Browsers Artifacts -

• KAPE — Download

• Browser History Viewer — Download

• Browser History Capturer — Download

Event Logs -

• Event ID 4624 - Successful Logon

• Event ID 4625 - Failed Logon

• Event ID 4672 - Special Logon (with administrative privileges logs in)

• Event ID 4634 - Logoff from the current session

• Event ID 4720 - User account was created

• Event ID 4726 - User account was deleted

• Event ID 4732 - A member was added to a security-enabled local group

These event logs could be found at

C:\Windows\System32\winevt\Logs

Linux Investigation

• /etc/passwd — contains a list of user accounts on the system, and their permissions.

• /etc/shadow — contains encrypted passwords of existing users on the system.

• unshadow /etc/passwd /etc/shadow > <new-file> to combine the passwd and shadow together.

• /var/lib/dpkg/status — includes list of all installed software packages on debian-based systems.

• .bash_history — contains a list of commands that have been run by the specific user.

• Hidden Files and Directories — usually prefix with .

• Clear Files — the file that is accessible by standard means. i.e. browser, terminal

• Steganography — a practice of concealing messages or files within other non-secret text or data.

Volatility — Memory Analysis -

# Determine the suggested profile for analysis
volatility -f memdump.mem imageinfo
# Print a list of processes to the terminal
volatility -f memdump.mem --profile=<PROFILE> pslist
# Print a process tree to the terminal
volatility -f memdump.mem --profile=<PROFILE> pstree
# View command line of the specific process with PID XXXX
volatility -f /path/to/file.mem --profile=PROFILE dlllist -p XXXX
# Print all available processes, including hidden ones often used by malware
volatility -f memdump.mem --profile=<PROFILE> psscan
# Dumping the process with a specific PID XXXX
volatility -f /path/to/file.mem --profile=PROFILE procdump -p XXXX -D /home/ubuntu/Desktop
# Print expected and hidden processes
volatility -f memdump.mem --profile=<PROFILE> psxview
# View any active or closed network connections
volatility -f memdump.mem --profile=<PROFILE> netscan
# Create a timeline of events from the memory image
volatility -f memdump.mem --profile=<PROFILE> timeliner
# Pull internet browsing history
volatility -f memdump.mem --profile=<PROFILE> iehistory
# Identify any files on the system from the memory image
volatility -f memdump.mem --profile=<PROFILE> filescan
# Retrieve files from the memory image
volatility -f memdump.mem --profile=<PROFILE> dumpfiles -n --dump-dir=<path-to-dump>

Security Information and Event Management

All queries must start by referencing the dataset

index=<dataset>

To search for a source ip address

index=<dataset> src="x.x.x.x"

To search for a destination ip address that made a connection with, i.e. locahost (127.0.0.1)

index=<dataset> src="127.0.0.1" dst="x.x.x.x"

Incident Response

---

Network Traffic Analysis

Using Wireshark to analyze network traffic capture files including, .pcap, .cap, .pcapng, etc.

Command Prompt to assist with incident response

• List network configuration information in local system

ipconfig /all

• Print a list of running processes and programs

tasklist

• Display running processes and associated binary file that was executed to create the process

wmic process get description, executablepath

• Print a list of all local system users

net user

Print a list of all users that are resided in an administrators user group

net localgroup administrators

List all services and detailed information about each one

 sc query | more

List all open ports on a system

netstat -ab

Powershell to help extracted valuable information

• To get network-related information from the system

Get-NetIPConfiguration
Get-NetIPAddress

• List all local users on the system

Get-LocalUser
# To get more information about a specific user
Get-LocalUser -Name BTLO | select *

• To identify running services on the system and show the results in a nice windows

Get-Service | where Status -eq "Running" | Out-GridView

• List the running processes and group it by their priority value

Get-Process | Format-Table -View priority

• Get specific information from a service

# specific information by including their name
Get-Process -Name 'namehere'
# specific information by including their id and piping for collected all properties
Get-Process -Id 'idhere' | Select *

• List tasks that are set to run after certain conditions are met

Get-ScheduledTask

• Dig more deeper by specifying the task we’re interested in and piping for all properties

Get-ScheduledTask -TaskName 'PutANameHere' | Select *

• Change the Execution Policy applied to specific user

Set-ExecutionPolicy Bypass -Scope CurrentUser

1. DeepBlueCLI is a tool that was created by SANS to aid the investigation and triage of Windows Event Logs

• Run the command to a specific local log file

./DeepBlue.ps1 ../Log1.evtx

Run the command to analyze the system we are currently on

# to analyze a live security log
./DeepBlue.ps1 -log security
# to analyze a live system log
./DeepBlue.ps1 -log system

Appendix A — Logs Information Details

---

Logon Type (Event ID: 4624)

Type	Description
2	Interactive (interactively logged on, meaning a physical logon to the device)
3	Network (accessed system via network)
4	Batch (started as an automated batch job)
5	Service (a Windows service started by service controller)
6	Proxy (proxy logon; not used in Windows NT or Windows 2000)
7	Unlock (unlock workstation - think Interactive logon, but unlocking to resume a previous session)
8	NetworkCleartext (network logon with cleartext credentials)
9	NewCredentials (used by RunAs when the /netonly option is used)

NETLOGON LOG ERROR CODE (Event ID: 4625)

NETLOGON log error code	Description
0xC0000064	The specified user does not exist
0xC000006A	The value provided as the current password is not correct
0xC000006C	Password policy not met
0xC000006D	The attempted logon is invalid due to a bad username
0xC000006E	User account restriction has prevented successful login
0xC000006F	The user account has time restrictions and may not be logged onto at this time
0xC0000070	The user is restricted and may not log on from the source workstation
0xC0000071	The user account’s password has expired
0xC0000072	The user account is currently disabled
0xC000009A	Insufficient system resources
0xC0000193	The user’s account has expired
0xC0000224	User must change his password before he logs on the first time
0xC0000234	The user account has been automatically locked

Linux Logs

• /var/log/auth.log — contains system authorization information. i.e. user logins.

• /var/log/dpkg.log — contains information that is logged when a package is installed or remove using dpkg.

• /var/log/btmp — contains information about failed login attempts.

• /var/log/cron — logs information about cron job.

• /var/log/secure — contains information related to authentication and authorization.

• /var/log/faillog — contains user failed login attempts.