🔏
🔏
🔏
🔏
s0cm0nkey's Security Reference Guide
Search…
All of the Best Links and Resources on Cyber Security.
Cyber Intelligence
Red - Offensive Operations
Red - Web App Hacking
Blue - Defensive Operations
Blue - DFIR: Digital Forensics and Incident Response
Interact with remote machine
Windows System Enumeration
Windows Process Information
Windows DFIR Checks
Windows DFIR Check by MITRE Tactic
Windows Event Logs
Windows Remediation Commands
IR Event Log Cheatsheet
Linux DFIR Commands
MacOS DFIR Commands
YARA
Memory Forensics
Sandboxing
File/Binary Analysis
Malware
Reverse Engineering
Yellow - NetEng/SysAdmin
Yellow - Code and CLI
Grey - Privacy/TOR/OPSEC
Training and Resources
Powered By GitBook
Blue - DFIR: Digital Forensics and Incident Response
DFIR: Digital Forensics and Incident Response is a hugely important important sector of cyber security, where your everyday security analysis is take to the next level. While most security analysts will work out of a SIEM or SOAR platform, Incident Responders and Forensic analysts typically work directly with a potentially compromised device. With this, they are required to not only be familiar with a larger array of tools for analysis, but also a much stricter set of process and procedures as their actions are often subject to legal requirements.

DFIR Resource Collections

Incident Response

Resources

IR/Malware Scanners

  • ​https://www.nextron-systems.com/thor/ - IR scanner with more than 12,000 handcrafted YARA signatures, 400 Sigma rules, numerous anomaly detection rules and thousands of IOCs.
    • ​Loki Scanner - The free and open IOC scanner using YARA rules.
    • ​Fenrir - Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for Indicators of Compromise (IOCs).
  • ​MalwareBytes IR Scanner​
  • ​ClamAV - ClamAV is an open source antivirus engine for detecting trojans, viruses, malware & other malicious threats. Can be used with a USB for portable scanning of devices.
  • ​Microsoft Safety Scanner - Microsoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. Simply download it and run a scan to find malware and try to reverse changes made by identified threats.
  • ​gmer Rootkit scanner - An application that detects and removes rootkits​
  • ​chkrootkit - A tool to locally check for signs of a rootkit.
  • ​RKHunter - scans systems for known and unknown rootkits, backdoors, sniffers and exploits.
  • ​hashlookup-forensic-analyser - Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/​
  • ​pe-sieve - Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
  • ​Redline by Fireeye - Redline®, FireEye's premier free endpoint security tool, provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile.
  • ​https://www.herdprotect.com/ - herdProtect is a second line of defense malware scanning platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection. As a second line of defense anti-malware solution, herdProtect is designed to run with any existing anti-virus program already installed on a user's PC. herdProtect is a free service to help user's find and remove malicious software.
  • Windows Defender Scan
    1
    "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1
    2
    "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2
    3
    "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File C:\Users\[username]\AppData\Local\Temp
    Copied!
    Note: Types are as follows
    • 1: Quick scan
    • 2: Full system scan
    • 3: File and directory custom scan

    Check Windows Defender for excluded files and default actions

    1
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s
    2
    Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions'
    3
    Get-MpPreference | Select Exclusion*
    4
    Get-MpPreference | Select *DefaultAction
    Copied!
  • ​Crowdstrike's CrowdResponse Scanner - Static Host Data Collection Tool
1
CrowdResponse -v -i config.txt -o out.xml
Copied!
  • ​Binalyze IREC Tactical - Standalone evidence collector for traditional DFIR situations. Can scan target with set YARA rules
1
IREC.exe --triage-memory
2
IREC.exe -ad "\\MACHINE\IREC-DIR" --triage-ruleset MyYaraRules --triage-memory
Copied!
1
yara32.exe -d filename=[file defined in ruleset.yar] [ruleset.yar] [file to scan]
2
yara32.exe -d filename=[svchost.exe] [ruleset.yar] -r [directory to scan]
3
yara64.exe yararule.yar -r C:
4
yara64.exe yararule.yar -r C: -f 2> $null
Copied!
  • Yara Linux
Note: -s shows matching yara strings.
1
yara rule.yara malware.exe -s
2
yara rule.yara [Directory] -s
Copied!
Depreciated Tools

Other Tools

  • Frameworks and Collections
    • ​Kansa (Powershell) - A modular incident response framework in Powershell. It uses Powershell Remoting to run user contributed, ahem, user contri- buted modules across hosts in an enterprise to collect data for use during incident response, breach hunts, or for building an environmental baseline.
    • ​Windows Forensic Toolchest - The Windows Forensic Toolchest™ (WFT) is designed to provide a structured and repeatable automated Live Forensic Response, Incident Response, or Audit on a Windows system while collecting security-relevant information from the system.
    • ​Veliciraptor - A tool for collecting host based state information.
    • ​Meerkat - Meerkat is collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints without requiring a pre-deployed agent.
  • Utility
    • ​AWS_IR - Python installable command line utility for mitigation of instance and key compromises.
    • ​https://processhacker.sourceforge.io/ - A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.
    • ​ADTimeline - The ADTimeline script generates a timeline based on Active Directory replication metadata for objects considered of interest.

DFIR Commands

Forensics

Guides and Resources

Tools

EricZimmermanCommandLineToolsCheatSheet-v1.0.pdf
54KB
PDF
  • Extraction Tools
    • ​bulk-extractor - bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures.
    • ​dumpzilla - Dumpzilla application is developed in Python 3.x and has as purpose extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers to be analyzed.
    • ​regripper - RegRipper is an open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis.
    • ​safecopy - safecopy tries to get as much data from SOURCE as possible, even resorting to device specific low level operations if applicable.
  • Browser Tools
    • ​galleta - Galleta is a forensics tool that examines the content of cookie files produced by Microsoft Internet Explorer (MSIE). It parses the file and outputs a field separated that can be loaded in a spreadsheet.
    • ​pasco - Pasco is a forensic tool that examines the content of cache files (index.dat) produced by Microsoft Internet Explorer.
  • Misc Utility
    • ​XOR Tool - A tool to do some xor analysis: Guess the key length (based on count of equal chars) and Guess the key (base on knowledge of most frequent char)
    • ​forensics-colorize - forensics-colorize is a set of tools to visually compare large files, as filesystem images, creating graphics of them. It is intuitive because the produced graphics provide a quick and perfect sense about the percentage of changes between two files.
    • ​dislocker - Dislocker has been designed to read BitLocker encrypted partitions under a Linux system
    • ​mac-robber - mac-robber is a digital investigation tool (digital forensics) that collects metadata from allocated files in a mounted filesystem. This is useful during incident response when analyzing a live system or when analyzing a dead system in a lab.
    • ​testdisk - TestDisk checks the partition and boot sectors of your disks. It is very useful in forensics, recovering lost partitions.
    • ​unhide - Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp.

File Carving/Recovery

  • ​Foremost: Foremost is a console program to recover files based on their headers, footers, and internal data structures.
  • ​ext4magic - ext4magic can extract the information from the journal and restore files in an entire directory tree, if the information in the journal are sufficient.
  • ​ext3grep - ext3grep is a simple tool intended to aid anyone who accidentally deletes a file on an ext3 filesystem, only to find that they wanted it shortly thereafter.
  • ​extundelete - extundelete uses the information stored in the partition’s journal to attempt to recover a file that has been deleted.
  • ​magicrescue - Magic Rescue scans a block device for file types it knows how to recover and calls an external program to extract them.
  • ​myrescue - myrescue is a program to rescue the still-readable data from a damaged harddisk, CD-ROM, DVD, flash drives, etc. It is similar in purpose to dd_rescue (or ddrescue), but it tries to quickly get out of damaged areas to first handle the not yet damaged part of the disk and return later.
  • ​recoverdm - recoverdm recover disks with bad sectors. You can recover files as well complete devices. In case it finds sectors which simply cannot be recovered, it writes an empty sector to the output file and continues.
  • ​recoverjpeg - recoverjpeg tries to recover JFIF (JPEG) pictures and MOV movies from a peripheral. This may be useful if you mistakenly overwrite a partition or if a device such as a digital camera memory card is bogus.
  • ​rifiuti2 - Rifiuti2 analyses recycle bin files from Windows. Analysis of Windows recycle bin is usually carried out during Windows computer forensics.
  • ​scalpel - scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files.
  • ​scrounge-ntfs - Scrounge NTFS is a data recovery program for NTFS filesystems. It reads each block of the hard disk and try to rebuild the original filesystem tree into a directory.
  • ​undbx - UnDBX is a tool to extract, recover and undelete e-mail messages from MS Outlook Express .dbx files
  • RDP Cache Recovery

Forensic Imaging

  • ​FTK Imager by AccessData - Create forensic images of local hard drives, CDs and DVDs, thumb drives or other USB devices, entire folders, or individual files from various places within the media.
1
ftkimager --list-drives
2
ftkimager \\.\PHYSICALDRIVE0 "[Location]\Case" --e01
3
ftkimager [source] [destination]
4
ftkimager \\.\PHYSICALDRIVE0 "[Location]\Case" --e01 --outpass securepasswordinsertedhere
Copied!
  • ​DD utility - Unix disk manipulation tool
    • ​dc3dd - dc3dd is a patched version of GNU dd with added features for computer forensics
    • ​dcfldd - Enhanced version of dd for forensics and security
    • ​ddrescue - Data recovery and protection tool
1
dd.exe --list
2
dd.exe if=/dev/<drive> of=Image.img bs=1M
3
dd.exe if=\\.\<OSDrive>: of=<drive>:\<name>.img bs=1M --size --progress
4
(LINUX) sudo dd if=/dev/<OSDrive> of=/mnt/<name>.ddimg bs=1M conv=noerror,sync
Copied!
  • ​X-ways Imager - Forensic disk imaging tool. Stripped down version of the X-Ways Forensics computer forensics software with just the disk imaging functionality and little more
  • ​guymager - The forensic imager contained in this package, guymager, was designed to support different image file formats, to be most user-friendly and to run really fast.

Memory Forensics

USB Analysis

MacOS

Malware Analysis

In incident response, phishing, or security monitoring scenarios, you will encounter potentially malicious files that will require in depth analysis to certify the nature of the file. These files can be as overt as an executable labeled "virus.exe" or as covert as "resume.doc". There will be instances where even after all of your analysis, you still cannot verify the nature of the document, and therefore should be considered malicious until proven otherwise.

Malware Analysis Toolsets and multi-engine scanners

Sandboxing

Outside of sandboxing, there are a host of other tools available that can perform different types of analysis on malware. There are even a few virtual machine distributions that are dedicated to malware analysis. The foremost of them are Flare-VM and Remnux. These will usually include sandboxing tools like cuckoo, code analysis tools like Snyk and Ghidra, and a host of other handy options.
Remember: it is always advised to perform your malware analysis on a virtual machine, in order to prevent unwanted accidents.

File Analysis

Resources

Reverse Engineering

Previous
Blue ToolBox
Next
Interact with remote machine
Last modified 2mo ago
Copy link
Contents
DFIR Resource Collections
Incident Response
Resources
IR/Malware Scanners
Other Tools
DFIR Commands
Forensics
Guides and Resources
Tools
File Carving/Recovery
Forensic Imaging
Memory Forensics
USB Analysis
MacOS
Malware Analysis
Malware Analysis Toolsets and multi-engine scanners
Sandboxing
File Analysis
Resources
Reverse Engineering