# BTL1 Notes

### Common Ports <a href="#common-ports" id="common-ports"></a>

<br>

| Port  | Service | Description                                                                                                                                            |        |
| ----- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------ |
| 20,21 | FTP     | File Transfer Protocol used to transfer files b/w systems.                                                                                             |        |
| 22    | SSH     | Secure Shell Protocol allows users to securely connect to a remote host.                                                                               |        |
| 23    | Telnet  | Used before SSH, allows users to connect to a remote host, doesn’t offer encryption.                                                                   |        |
| 25    | SMTP    | Simple Mail Transfer Protocol used to send emails between servers within the network, or over the internet.                                            |        |
| 53    | DNS     | Domain Name System converts human-readable domain names to machine-readable IP address.                                                                |        |
| 67,68 | DHCP    | Dynamic Host Configuration Protocol assign IP address-related information to any hosts on the network automatically.                                   |        |
| 80    | HTTP    | Hypertext Transfer Protocol allows browsers (Chrome, Firefox, etc) to connect to web servers and request contents.                                     |        |
| 443   | HTTPS   | Hypertext Transfer Protocol Secure is a secure version of HTTP Protocol which allows browsers to securely connect to web servers and request contents. |        |
| 514   | Syslog  | Syslog server listens for incoming Syslog notifications, transported by UDP packets.                                                                   | \*\*\* |

### Phishing Analysis <a href="#phishing-analysis" id="phishing-analysis"></a>

***

#### Gathering Artifacts (IOCs) <a href="#gathering-artifacts-iocs" id="gathering-artifacts-iocs"></a>

**Email Artifacts** -

* Sender Address
* Reply-To Address
* Sending Server IP
* Reverse DNS
* Recipient Address
* Subject Line
* Date & Time

**Web-based Artifacts** -

* Full-URLs (sanitized)
* Domain Names

**File-based Artifacts** -

* Filename & Extension
* MD5/SHA1/SHA256 Hash Values

#### Artifacts Analysis <a href="#artifacts-analysis" id="artifacts-analysis"></a>

1. **Visualization Tools** - [URL2PNG](https://www.url2png.com/), [URLScan](https://urlscan.io/)
2. **URL Reputation Tools** - [VirusTotal](https://www.virustotal.com/gui/), [URLScan](https://urlscan.io/), [URLhaus](https://urlhaus.abuse.ch/), [WannaBrowser](https://www.wannabrowser.net/)
3. **File Reputation Tools** - [VirusTotal](https://www.virustotal.com/gui/), [Talos File Reputation](https://www.talosintelligence.com/talos_file_reputation)
4. **Malware Sandboxing** - [Hybrid Analysis](https://www.hybrid-analysis.com/)

**Defanging URL & IP Address**

1. [Defang URL, Defang IP Addresses - CyberChef (gchq.github.io)](https://gchq.github.io/CyberChef/#recipe=Defang_URL\(true,true,true,'Valid%20domains%20and%20full%20URLs'\)Defang_IP_Addresses\(\))

### Digital Forensics <a href="#digital-forensics" id="digital-forensics"></a>

***

**Data representation can be done in the following ways,**

* Base64
* Hexadecimal
* Octal
* ASCII
* Binary

#### Metadata <a href="#metadata" id="metadata"></a>

```sh
# Provided with information such as the read/write permissions, the file name and size, and the times for when the file was last accessed and modified.
ls -lisap <file>
stat <file>

# Received metadata from files
# sudo apt-get install exiftool
exiftool <file>
```

#### File Carving <a href="#file-carving" id="file-carving"></a>

```shell
# To choose which file type you want to retrieve you can edit in /etc/scalpel/scalpel.conf
# To start retrieving a file using command below
scalpel -b -o <output-dir> <disk-image-file>   
```

#### Hashing <a href="#hashing" id="hashing"></a>

1. Windows

```powershell
Get-FileHash -Algorithm [algorithm-to-use] [file]
```

1. **Linux**

```sh
md5sum <file>
sha1sum <file>
sha256sum <file>
```

#### Data Acquisition <a href="#data-acquisition" id="data-acquisition"></a>

* **FTK Imager** - import `.img` file in FTK Imager. [Download](https://accessdata.com/product-download/ftk-imager-version-4-5)
* **KAPE** - uses for fast acquisition of data. [Download](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape)

**Windows Investigation**

**LNK Files** -

* These files can be found at

```
%userprofile%\Appdata\Roaming\Microsoft\Windows\Recent
```

* [Windows File Analyzer](https://www.mitec.cz/wfa.html) can be used to view these files in form of human-readable format.

**Prefetch Files** -

* These files can be found at

```
C:\Windows\Prefetch
```

* [Prefetch Explorer Command Line](https://ericzimmerman.github.io/#!index.md) can be used to view these files in form of human-readable format a.k.a. `PEbatch.exe`.

```powershell
# Using PEbatch requires administrator privilege
PEbatch.exe -f [path-to-file].pf
PEbatch.exe -k "string-to-match" -d [path-to-prefetch-folder]
```

**Jump List** -

* These files can be found at

```
C:\Users\% USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations
```

* [JumpList Explorer](https://ericzimmerman.github.io/#!index.md) could be used to analyze these files.

**Browsers Artifacts** -

* **KAPE** — [Download](https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape)
* **Browser History Viewer** — [Download](https://www.foxtonforensics.com/browser-history-viewer/)
* **Browser History Capturer** — [Download](https://www.foxtonforensics.com/browser-history-capturer/)

**Event Logs** -

* **Event ID** 4624 - Successful Logon
* **Event ID** 4625 - Failed Logon
* **Event ID** 4672 - Special Logon *(with administrative privileges logs in)*
* **Event ID** 4634 - Logoff from the current session
* **Event ID** 4720 - User account was created
* **Event ID** 4726 - User account was deleted
* **Event ID** 4732 - A member was added to a security-enabled local group

These event logs could be found at

```
C:\Windows\System32\winevt\Logs
```

**Linux Investigation**

* `/etc/passwd` — contains a list of user accounts on the system, and their permissions.
* `/etc/shadow` — contains encrypted passwords of existing users on the system.
* `unshadow /etc/passwd /etc/shadow > <new-file>` to combine the passwd and shadow together.
* `/var/lib/dpkg/status` — includes list of all installed software packages on debian-based systems.
* `.bash_history` — contains a list of commands that have been run by the specific user.
* **Hidden Files and Directories** — usually prefix with `.`
* **Clear Files** — the file that is accessible by standard means. *i.e. browser, terminal*
* **Steganography** — a practice of concealing messages or files within other non-secret text or data.

**Volatility — Memory Analysis** -

```sh
# Determine the suggested profile for analysis
volatility -f memdump.mem imageinfo
# Print a list of processes to the terminal
volatility -f memdump.mem --profile=<PROFILE> pslist
# Print a process tree to the terminal
volatility -f memdump.mem --profile=<PROFILE> pstree
# View command line of the specific process with PID XXXX
volatility -f /path/to/file.mem --profile=PROFILE dlllist -p XXXX
# Print all available processes, including hidden ones often used by malware
volatility -f memdump.mem --profile=<PROFILE> psscan
# Dumping the process with a specific PID XXXX
volatility -f /path/to/file.mem --profile=PROFILE procdump -p XXXX -D /home/ubuntu/Desktop
# Print expected and hidden processes
volatility -f memdump.mem --profile=<PROFILE> psxview
# View any active or closed network connections
volatility -f memdump.mem --profile=<PROFILE> netscan
# Create a timeline of events from the memory image
volatility -f memdump.mem --profile=<PROFILE> timeliner
# Pull internet browsing history
volatility -f memdump.mem --profile=<PROFILE> iehistory
# Identify any files on the system from the memory image
volatility -f memdump.mem --profile=<PROFILE> filescan
# Retrieve files from the memory image
volatility -f memdump.mem --profile=<PROFILE> dumpfiles -n --dump-dir=<path-to-dump>
```

### Security Information and Event Management <a href="#security-information-and-event-management" id="security-information-and-event-management"></a>

All queries must start by referencing the dataset

```
index=<dataset>
```

To search for a source ip address

```
index=<dataset> src="x.x.x.x"
```

To search for a destination ip address that made a connection with, i.e. locahost (127.0.0.1)

```
index=<dataset> src="127.0.0.1" dst="x.x.x.x"
```

### Incident Response <a href="#incident-response" id="incident-response"></a>

***

#### Network Traffic Analysis <a href="#network-traffic-analysis" id="network-traffic-analysis"></a>

Using **Wireshark** to analyze network traffic capture files including, `.pcap`, `.cap`, `.pcapng`, etc.

#### **Command Prompt** to assist with incident response <a href="#command-prompt-to-assist-with-incident-response" id="command-prompt-to-assist-with-incident-response"></a>

* List network configuration information in local system

```
ipconfig /all
```

* Print a list of running processes and programs

```
tasklist
```

* Display running processes and associated binary file that was executed to create the process

```
wmic process get description, executablepath
```

* Print a list of all local system users

```
net user
```

Print a list of all users that are resided in an administrators user group

```
net localgroup administrators
```

List all services and detailed information about each one

```
 sc query | more
```

List all open ports on a system

```
netstat -ab
```

#### **Powershell** to help extracted valuable information <a href="#powershell-to-help-extracted-valuable-information" id="powershell-to-help-extracted-valuable-information"></a>

* To get network-related information from the system

```
Get-NetIPConfiguration
Get-NetIPAddress
```

* List all local users on the system

```
Get-LocalUser
# To get more information about a specific user
Get-LocalUser -Name BTLO | select *
```

* To identify running services on the system and show the results in a nice windows

```
Get-Service | where Status -eq "Running" | Out-GridView
```

* List the running processes and group it by their priority value

```
Get-Process | Format-Table -View priority
```

* Get specific information from a service

```
# specific information by including their name
Get-Process -Name 'namehere'
# specific information by including their id and piping for collected all properties
Get-Process -Id 'idhere' | Select *
```

* List tasks that are set to run after certain conditions are met

```
Get-ScheduledTask
```

* Dig more deeper by specifying the task we’re interested in and piping for all properties

```
Get-ScheduledTask -TaskName 'PutANameHere' | Select *
```

* Change the Execution Policy applied to specific user

```
Set-ExecutionPolicy Bypass -Scope CurrentUser
```

1. **DeepBlueCLI** is a tool that was created by SANS to aid the investigation and triage of Windows Event Logs

* Run the command to a specific local log file

```
./DeepBlue.ps1 ../Log1.evtx
```

Run the command to analyze the system we are currently on

```
# to analyze a live security log
./DeepBlue.ps1 -log security
# to analyze a live system log
./DeepBlue.ps1 -log system
```

### Appendix A — Logs Information Details <a href="#appendix-a--logs-information-details" id="appendix-a--logs-information-details"></a>

***

#### Logon Type (Event ID: 4624) <a href="#logon-type-event-id-4624" id="logon-type-event-id-4624"></a>

| Type | Description                                                                                       |
| ---- | ------------------------------------------------------------------------------------------------- |
| 2    | Interactive (interactively logged on, meaning a physical logon to the device)                     |
| 3    | Network (accessed system via network)                                                             |
| 4    | Batch (started as an automated batch job)                                                         |
| 5    | Service (a Windows service started by service controller)                                         |
| 6    | Proxy (proxy logon; not used in Windows NT or Windows 2000)                                       |
| 7    | Unlock (unlock workstation - think Interactive logon, but unlocking to resume a previous session) |
| 8    | NetworkCleartext (network logon with cleartext credentials)                                       |
| 9    | NewCredentials (used by RunAs when the `/netonly` option is used)                                 |

#### NETLOGON LOG ERROR CODE (Event ID: 4625) <a href="#netlogon-log-error-code-event-id-4625" id="netlogon-log-error-code-event-id-4625"></a>

| NETLOGON log error code | Description                                                                    |
| ----------------------- | ------------------------------------------------------------------------------ |
| 0xC0000064              | The specified user does not exist                                              |
| 0xC000006A              | The value provided as the current password is not correct                      |
| 0xC000006C              | Password policy not met                                                        |
| 0xC000006D              | The attempted logon is invalid due to a bad username                           |
| 0xC000006E              | User account restriction has prevented successful login                        |
| 0xC000006F              | The user account has time restrictions and may not be logged onto at this time |
| 0xC0000070              | The user is restricted and may not log on from the source workstation          |
| 0xC0000071              | The user account’s password has expired                                        |
| 0xC0000072              | The user account is currently disabled                                         |
| 0xC000009A              | Insufficient system resources                                                  |
| 0xC0000193              | The user’s account has expired                                                 |
| 0xC0000224              | User must change his password before he logs on the first time                 |
| 0xC0000234              | The user account has been automatically locked                                 |

#### Linux Logs <a href="#linux-logs" id="linux-logs"></a>

* `/var/log/auth.log` — contains system authorization information. i.e. user logins.
* `/var/log/dpkg.log` — contains information that is logged when a package is installed or remove using *dpkg*.
* `/var/log/btmp` — contains information about failed login attempts.
* `/var/log/cron` — logs information about cron job.
* `/var/log/secure` — contains information related to authentication and authorization.
* `/var/log/faillog` — contains user failed login attempts.
