Blue | Respond - Analysis

Live Triage - Windows

System information

echo %DATE% %TIME%
hostname
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic csproduct get name
wmic bios get serialnumber
wmic computersystem list brief

:: Reference: https://technet.microsoft.com/en-us/sysinternals/psinfo.aspx
psinfo -accepteula -s -h -d

User information

whoami
net users
net localgroup administrators
net group administrators
wmic rdtoggle list
wmic useraccount list
wmic group list
wmic netlogin get name,lastlogon,badpasswordcount
wmic netclient list brief
doskey /history > history.txt

Network information

netstat -e
netstat -naob
netstat -nr
netstat -vb
nbtstat -S
route print
arp -a
ipconfig /displaydns
netsh winhttp show proxy
ipconfig /allcompartments /all
netsh wlan show interfaces
netsh wlan show all

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings"

type %SYSTEMROOT%\system32\drivers\etc\hosts
wmic nicconfig get descriptions,IPaddress,MACaddress
wmic netuse get name,username,connectiontype,localname

Service information

at
tasklist
tasklist /scv
tasklist /scv /fi "imagename eq svchost.exe"
schtasks
net start
sc query

wmic service list brief | findstr "Running"
wmic service list config
wmic process list brief
wmic process list status
wmic process list memory
wmic job list brief

PowerShell commands:

Get-Service | Where-Object { $_.Status -eq "running" }

# List of all processes and then all loaded modules
Get-Process |select modules|Foreach-Object{$_.modules}

Policy, patch and settings information

set
gpresult /r
gpresult /z > <OUTPUT FILE NAME>.txt
gpresult /H report.html /F
wmic qfe

:: List GPO software installed
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt"

Autorun and autoload information

:: Startup information
wmic startup list full
wmic ntdomain list brief

:: View directory contents of startup folder
dir "%SystemDrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
dir "%SystemDrive%\Documents and Settings\AllUsers\Start Menu\Programs\Startup"
dir "%userprofile%\Start Menu\Programs\Startup"
:: %ProgramFiles%\Startup\

dir "C:\Windows\Start Menu\Programs\startup"
dir "C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
dir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
dir "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"
dir "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup"
dir "%ALLUSERSPROFILE%\Start Menu\Programs\Startup"

type C:\Windows\winstart.bat
type %windir%\wininit.ini
type %windir%\win.ini

:: View autoruns, hide Microsoft files
:: Reference: https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
autorunsc -accepteula -m
type C:\Autoexec.bat

:: Show all autorun files, export to csv and check with VirusTotal
autorunsc.exe -accepteula -a -c -i -e -f -l -m -v

:: HKEY_CLASSES_ROOT
reg query HKCR\Comfile\Shell\Open\Command
reg query HKCR\Batfile\Shell\Open\Command
reg query HKCR\htafile\Shell\Open\Command
reg query HKCR\Exefile\Shell\Open\Command
reg query HKCR\Exefiles\Shell\Open\Command
reg query HKCR\piffile\shell\open\command

:: HKEY_CURRENT_USERS
reg query "HKCU\Control Panel\Desktop"
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Windows\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Windows\Load
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Windows\Scripts
reg query "HKCU\Software\Microsoft\WindowsNT\CurrentVersion\Windows" /f run
reg query "HKCU\Software\Microsoft\WindowsNT\CurrentVersion\Windows" /f load
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\0penSaveMRU
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\0penSavePidlMRU /s
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\RegEdit /v LastKey
reg query "HKCU\Software\Microsoft\InternetExplorer\TypedURLs"
reg query "HKCU\Software\Policies\Microsoft\Windows\ControlPanel\Desktop"

:: HKEY_LOCAL_MACHINE
reg query "HKLM\SOFTWARE\Microsoft\ActiveSetup\Installed Components" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Shell Folders"
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /s
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon\Userinit
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\shellServiceObjectDelayLoad
reg query "HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Schedule\TaskCache\Tasks" /s
reg query "HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Windows"
reg query "HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Windows" /f Appinit_DLLs
reg query "HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon" /f Shell
reg query "HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon" /f Userinit
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts
reg query HKLM\SOFTWARE\Classes\batfile\shell\open\command
reg query HKLM\SOFTWARE\Classes\comfile\shell\open\command
reg query HKLM\SOFTWARE\Classes\exefile\shell\open\command
reg query HKLM\SOFTWARE\Classes\htafile\Shell\Open\Command
reg query HKLM\SOFTWARE\Classes\piffile\shell\open\command
reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /s
reg query "HKLM\SYSTEM\CurrentControlSet\Control\SessionManager"
reg query "HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\KnownDLLs"
reg query "HKLM\SYSTEM\ControlSet001\Control\SessionManager\KnownDLLs"

Logs

:: Copy event logs
wevtutil epl Security C:\<BACK UP PATH>\mylogs.evtx
wevtutil epl System C:\<BACK UP PATH>\mylogs.evtx
wevtutil epl Application C:\<BACK UP PATH>\mylogs.evtx

:: Get list of logs remotely
:: Reference: https://technet.microsoft.com/en-us/sysinternals/psloglist.aspx
psloglist \\<REMOTE COMPUTER> -accepteula -h 12 -x

PowerShell commands:

# Clear all logs and start a baseline log to monitor
wevtutil el | Foreach-Object {wevtutil cl"$_"}

# List log filenames and path location
wmic nteventlog get path,filename,writeable

# Take pre breach log export
wevtutil el | ForEach-Object{Get-Eventlog -Log "$_" | Export-Csv -Path C:\<BASELINE LOG>.csv -Append}

# Take post breach log export
wevtutil el | ForEach-Object{Get-EventLog -Log "$_" | Export-Csv -Path C:\<POST BASELINE LOG>.csv -Append}

# Compare two files baseline and post breach logs
Compare-Object -ReferenceObject $(Get-Content "C:\<PATH TO FILE>\<ORIGINAL BASELINE LOGS>.txt") -DifferenceObject $(Get-Content "C:\<PATH TO FILE>\<POST BASELINE LOGS>.txt") >> <DIFFERENCES LOG>.txt

# This deletes all logs
wevtutil el | Foreach-Object {wevtutil cl"$_"}

Files, drives and shares information

net use \\<TARGET IP ADDRESS>
net share
net session
wmic volume list brief
wmic logicaldisk get description,filesystem,name,size
wmic share get name,path

:: Find multiple file types or a file
dir /A /S /T:A *.exe *.dll *.bat *.ps1 *.zip
dir /A /S /T:A <BAD FILE NAME>.exe

:: Find executable (.exe) files newer than Jan 1, 2017
forfiles /p C:\ /M *.exe /S /D +1/1/2017 /C "cmd /c echo @fdate @ftime @path"

:: Find multiple files types using loop
for %G in (.exe, .dll, .bat, .ps) do forfiles -p "C:" -m *%G -s -d +1/1/2017 -c "cmd /c echo @fdate @ftime @path"

:: Search for files newer than date
forfiles /P C:\ /S /D +1/01/2017 /C "cmd /c echo @path @fdate"

:: Find large files: (example \<20 MB)
forfiles /S /M * /C "cmd /c if @fsize GEQ 2097152 echo @path @fsize"

:: Find files with Alternate Data Streams
:: Reference: https://technet.microsoft.com/en-us/sysinternals/streams.aspx
streams -s <FILE OR DIRECTORY>

:: Find files with bad signature into csv
:: Reference: https://technet.microsoft.com/en-us/sysinternals/bb897441.aspx
sigcheck -c -h -s -u -nobanner <FILE OR DIRECTORY> > <OUTPUT FILENAME>.csv

:: Find and show only unsigned files with bad signature in C:
sigcheck -e -u -vr -s C:\

:: List loaded unsigned Dlls
:: Reference: https://technet.microsoft.com/en-us/sysinternals/bb896656.aspx
listdlls.exe -u
listdlls.exe -u <PROCESS NAME OR PID>

:: Run Malware scan (Windows Defender) offline
:: Reference: http://windows.microsoft.com/en-us/windows/what-is-windows-defender-offline
MpCmdRun.exe -SignatureUpdate
MpCmdRun.exe -Scan

:: Install, monitor and log system activity to the Windows event log including 
:: md5 hashing of processes created and monitoring of network connections 64bit
:: Reference: https://technet.microsoft.com/en-us/sysinternals/sysmon
sysmon64.exe -i -accepteula –h md5 –n

:: Uninstall Sysmon
sysmon64.exe –u

:: View Sysmon log details
Get-WinEvent -Path C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx | Format-List *

Live Triage - Linux

System information

uname -a
uptime
timedatectl
mount

User information

# View logged in users
w

# Show if a user has ever logged in remotely
lastlog
last

# View failed logins
faillog -a

# View local user accounts
cat /etc/passwd
cat /etc/shadow

# View local groups
cat /etc/group

# View sudo access
cat /etc/sudoers

# View accounts with UID 0
awk -F: '($3 == "0") {print}' /etc/passwd
egrep ':0+' /etc/passwd

# View root authorized SSH key authentications
cat /root/.ssh/authorized_keys

# List of files opened by user
lsof -u <USER NAME>

# View the root user bash history
cat /root/.bash_history

User information

# View network interfaces
ifconfig

# View network connections
netstat -antup
netstat -plantux

# View listening ports
netstat -nap

# View routes
route

# View arp table
arp -a

# List of processes listening on ports
lsof -i

Service information

# View processes
ps -aux

# List of load modules
lsmod

# List of open files
lsof

# List of open files, using the network
lsof -nPi | cut -f 1 -d " "| uniq | tail -n +2

# List of open files on specific process
lsof -c <SERVICE NAME>

# Get all open files of a specific process ID
lsof -p <PID>

# List of unlinked processes running
lsof +L1

# Get path of suspicious process PID
ls -al /proc/<PID>/exe

# Save file for further malware binary analysis
cp /proc/<PID>/exe >/<SUSPICIOUS FILE NAME TO SAVE>.elf

# Monitor logs in real-time
less +F /var/log/messages

# List services
chkconfig --list

Policy, patch and settings information

# View pam.d files
cat /etc/pam.d/common*

Autorun and autoload information

# List cron jobs
crontab -l

# List cron jobs by root and other UID 0 accounts
crontab -u root -l

# Review for unusual cron jobs
cat /etc/crontab
ls /etc/cron.*

Logs

# View root user command history
cat /root/.*history

# View last logins
last

Files, drives and shares information

# View disk space
df -ah

# View directory listing for /etc/init.d
ls -la /etc/init.d

# Get more info for a file
stat -x <FILE NAME>

# Identify file type
file <FILE NAME>

# Look for immutable files
lsattr -R / | grep "\-i-"

# View directory listing for /root
ls -la /root

# Look for files recently modified in current directory
ls -alt | head

# Look for world writable files
find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print

# Look for recent created files, in this case newer than Jan 02, 2017
find / -newermt 2017-01-02q

# List all files and attributes
find / -printf "%m;%Ax;%AT;%Tx;%TT;%Cx;%CT;%U;%G;%s;%p\n"

# Look at files in directory by most recent timestamp
# Could be tampered
ls -alt /<DIRECTORY> | head

# Get full file information
stat /<FILE PATH>/<SUSPICIOUS FILE NAME>

# Review file type
file /<FILE PATH>/<SUSPICIOUS FILE NAME>

# Check for rootkits or signs of compromise

# Run unix-privsec-check tool
wget https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check
./unix-privesc-check > output.txt

# Run chkrootkit
apt-get install chkrootkit
chkrootkit

# Run rkhunter
apt-get install rkhunter
rkhunter --update
rkhunter -check

# Run tiger
apt-get install tiger
tiger
less /var/log/tiger/security.report.*

# Run lynis
apt-get install lynis
lynis audit system
more /var/logs/lynis.log

# Run Linux Malware Detect (LMD)
wget http://www.rfxn.com/downloads/maldetect-current.tar.gz
tar xfz maldetect-current.tar.gz
cd maldetect-*
./install.sh

# Get LMD updates
maldet -u

# Run LMD scan on directory
maldet -a /<DIRECTORY>

Malware Analysis

Static analysis basics

:: Mount live Sysinternals tools drive
\\live.sysinternals.com\tools

:: Signature check of dll, exe files
:: Reference: http://technet.microsoft.com/en-us/sysinternals/bb897441.aspx
sigcheck.exe -u -e C:\<DIRECTORY>

:: Send to VirusTotal
sigcheck.exe -vt <SUSPICIOUS FILE NAME>

Windows PE Analysis on Linux

# View Hex and ASCI of PE(exe or any file),
# with optional -n first 500 bytes
hexdump -C -n 500 <SUSPICIOUS FILE NAME>
od -x somefile.exe
xxd somefile.exe

In Windows using debug tool (works for .java files too):

debug <SUSPICIOUS FILE NAME>

:: just type d and get a page at a time of hex
-d

:: quit debugger
-q

Windows PE analysis on Windows

:: PE Fite Compile Date/Time pert script below (Windows PE only script)
:: Reference: https://www.perl.org/get.html
:: Reference: http://www.perlmonks.org/bare/?node_id=484287
perl.exe <SCRIPT NAME>.pl <SUSPICIOUS FILENAME>

Perl script:

#! perl -slw

use strict;

open EXE, '<:raw', $ARGV[0] or die "$ARGV[0] : $!";

my $dos = do{ local $/ = \65536; <EXE> };

die "$ARGV[0] is not a .exe or .dll (sig='${ \substr $dos, 0, 2 }')" unless substr( $dos, 0, 2 ) eq 'MZ';

my $coffoff = 8+ unpack 'x60 V', $dos;

read( EXE, $dos, $coffoff - 65536 + 4, 65536 ) or die $! if $coffoff > 65536;

my $ts = unpack "x$coffoff V", $dos;

print "$ARGV[0] : ", defined $ts

    ? ( scalar( localtime $ts) || "has unfathomable timestamp value $ts" )

    : 'has no timestamp';

__END__

View strings within PE and optional string length -n option:

# Using stings in Linux
strings -n 10 <SUSPICIOUS FILE NAME>

# Using strings in Windows
# Reference: https://technet.microsoft.com/en-us/sysinternals/strings.aspx
strings <SUSPICIOUS FILE NAME>

Volatility options:

:: Find Malware in memory dump using Volatility and Windows7SPFix64 profile
:: Ref. https://github.com/volatilityfoundation/volatility
python vol.py -f <MEMORY DUMP FILE NAME>.raw -profile=Win7SPFix64 malfind -D /<OUTPUT DUMP DIRECTORY>

:: Find Malware with PID in memory dump using Volatility
python vol.py -f <MEMORY DUMP FILE NAME>.raw -profile=Win7SPFix64 malfind -p <PID #> -D /<OUTPUT DUMP DIRECTORY>

:: Find suspicious processes using Volatility
python vol.py -f <MEMORY DUMP FILE NAME>.raw –profile=Win7SPFix64 pslist
python vol.py -f <MEMORY DUMP FILE NAME>.raw –profile=Win7SPFix64 pstree

:: Find suspicious DLLs using Volatility
python vol.py -f <MEMORY DUMP FILE NAME>.raw –profile=Win7SPFix64 dlllist
python vol.py -f <MEMORY DUMP FILE NAME>.raw –profile=Win7SPFix64 dlldump -D /<OUTPUT DUMP DIRECTORY>

Dc3-Mwcp options:

# Malware analysis parsing Tool
# Ref. https://github.com/Defense-Cyber-Crime-Center/DC3-MWCP

# Install dc3-mwcp tool:
setup.py install
# Use dc3-mwcp tool to parse suspicious file:
mwcp-tool.py -p <SUSPICIOUS FILE NAME>

Rekall options:

# Install Rekall tool
# Ref. https://github.com/google/rekall
pip install rekall
rekal --help

# Run Rekall against a memory file and extract 
# process list, dlllist, executable dump
rekal -f <MEMORY FILE>.aff imageinfo
rekal -f <MEMORY FILE>.dd pslist
rekal -f <MEMORY FILE>.img pslist --pid <PID>
rekal -f <MEMORY FILE>.dd dlllist
rekal -f <MEMORY FILE> pedump

Identify Malware

Process Explorer

Reference video from Youtube.

Look at running processes by running Process Explorer (GUI) and identify potential indicators of compromise:

Items with no icon
Items with no description or company name
Unsigned Microsoft images (First add Verified Signer column under View tab > Select Columns, then go to Options tab and choose Verify Image Signatures)
Check all running process hashes in Virus Total (Go to Options tab and select Check VirusTotal.com)
Suspicious files are in Windows directories or user profile
Purple items that are packed or compressed
Items with open TCP/IP endpoints

Signature File Check: (See Sigcheck)
Strings Check:

Right click on suspicious process in Process Explorer and on pop up window choose Strings tab and review for suspicious URLs. Repeat for Image and Memory radio buttons.
Look for strange URLs in strings

DLL View:

Pop open with Ctrl+D
Look for suspicious DLLs or services
Look for no description or no company name
Look at VirusTotal Results column

Stop and Remove Malware:

Right click and select Suspend for any identified suspicious processes
Right click and select Terminate Previous Suspended processes

Clean up where malicious files Auto start on reboot:

Launch Autoruns
Under Options, Check the boxes Verify Code Signatures and Hide Microsoft entries
Look for suspicious process file from earlier steps on the everything tab and uncheck. Safer to uncheck than delete, in case of error.
Press F5, to refresh Autoruns, and confirm malicious file has not recreated the malicious entry into the previous unchecked auto start location.

Process Monitor:

Sysinternals reference from Microsoft.
If malicious activity is still persistent, run Process Monitor.
Look for newly started process that start soon after terminated from previous steps.

Repeat as needed to find all malicious files and process and/or combine with other tools and suites.

File hash analysis

Hash query

# VirusTotal online API query
# Ref. https://www.virustotal.com/en/documentation/public-api/ (Prerequisite: Need a VT API Key)

# Send a suspicious hash to VirusTotal using cURL
curl -v --request POST --url 'https://www.virustotal.com/vtapi/v2/file/report' -d apikey=<VT API KEY> -d 'resource=<SUSPICIOUS FILE HASH>'

# Send a suspicious file to VirusTotal using cURL
curl -v -F 'file=/<PATH TO FILE>/<SUSPICIOUS FILE NAME>' -F apikey=<VT API KEY> https://www.virustotal.com/vtapi/v2/file/scan

# Team Cymru API
# Ref. https://hash.cymru.com, http://totalhash.com

# Team Cymru malware hash lookup using whois
# Output is timestamp of last seen and detection rate
whois -h hash.cymru.com <SUSPICIOUS FILE HASH>

Hard drive and memory acquisition

Windows

:: Create memory dump remotely
:: Ref. http://kromer.pl/malware-analysis/memory-forensics-using-volatility-toolkit-to-extract-malware-samples-from-memory-dump/
:: Ref. http://sourceforge.net/projects/mdd/
:: Ref. https://technet.microsoft.com/en-us/sysinternals/psexec.aspx
psexec.exe \\<HOST NAME OR IP ADDRESS> -u <DOMAIN>\<PRIVILEGED ACCOUNT> -p <PASSWORD> -c mdd_1.3.exe --o C:\memory.dmp

:: Extract EXE/DLL from memory dump
:: Ref. https://github.com/volatilityfoundation/volatility
volatility dlldump -f memory.dmp -D dumps/
volatility procmemdump -f memory.dmp -D dumps/

:: Create hard drive image using dc3dd of C:\
:: Ref. https://sourceforge.net/projects/dc3dd/files/dc3dd/7.2%20-%20Windows/
dc3dd.exe if=\\.\c: of=d:\<ATTACHED OR TARGET DRIVE>\<IMAGE NAME>.dd hash=md5 log=d:\<MOUNTED LOCATION>\<LOG NAME>.log

Linux

# Create memory dump
dd if=/dev/fmem of=/tmp/<MEMORY FILE NAME>.dd

# Create memory dump using LiME
# Reference: https://github.com/504ensicslabs/lime
wget https://github.com/504ensicsLabs/LiME/archive/master.zip
unzip master.zip
cd LiME-master/src
make
cp lime-*.ko /media/=/media/ExternalUSBDriveName/
insmod lime-3.13.0-79-generic.ko "path=/media/ExternalUSBDriveName/<MEMORY DUMP>.lime format=raw"

# Make copy of suspicious process using process ID
cp /proc/<SUSPICIOUS PROCESS ID>/exe /<NEW SAVED LOCATION>

# Grab memory core dump of suspicious process
gcore <PID>

# Strings on gcore file:
strings gcore.*

# Create a hard drive/partition copy with log and hash options
dd if=<INPUT DEVICE> of=<IMAGE FILE NAME>
dc3dd if=/dev/<TARGET DRIVE EXAMPLE SDA OR SDA1> of=/dev/<MOUNTED LOCATION>\<FILE NAME>.img hash=md5 log=/<MOUNTED LOCATION>/<LOG NAME>.log

# Create a remote hard drive/partition over SSH
dd if=/dev/<INPUT DEVICE> | ssh <USER NAME>@<DESTINATION IP ADDRESS> "dd of=<DESTINATION PATH>"

# Send hard drive image zipped over netcat
# Sending host:
bzip2 -c /dev/<INPUT DEVICE> | nc <DESTINATION IP ADDRESS> <PICK A PORT>
# Receiving host:
nc -p <PICK SAME PORT> -l |bzip2 -d | dd of=/dev/sdb

# Send hard drive image over netcat
# Sending host:
dd if=/dev/<INPUT DEVICE> bs=16M | nc <PORT>
# Receiving host with Pipe Viewer meter:
nc -p <SAME PORT> -l -vv | pv -r | dd of=/dev/<INPUT DEVICE> bs=16M

Live Triage - Windows#

System information#

User information#

Network information#

Service information#

Policy, patch and settings information#

Autorun and autoload information#

Logs#

Files, drives and shares information#

Live Triage - Linux#

System information#

User information#

User information#

Service information#

Policy, patch and settings information#

Autorun and autoload information#

Logs#

Files, drives and shares information#

Malware Analysis#

Static analysis basics#

Identify Malware#

Process Explorer#

File hash analysis#

Hash query#

Hard drive and memory acquisition#

Windows#

Linux#

Live Triage - Windows

System information

User information

Network information

Service information

Policy, patch and settings information

Autorun and autoload information

Logs

Files, drives and shares information

Live Triage - Linux

System information

User information

User information

Service information

Policy, patch and settings information

Autorun and autoload information

Logs

Files, drives and shares information

Malware Analysis

Static analysis basics

Identify Malware

Process Explorer

File hash analysis

Hash query

Hard drive and memory acquisition

Windows

Linux