What would be the best tools to use to get information about a machine/endpoint. For example:

An endpoint was infected with a virus or malware, what would be the best way to get a historical snapshot of the machine (when it was provisioned, last updated, etc.)? I do not have physical access to the system. I don't want to run forensics on it, I just want to get as much information about the machine as possible.

  • Another thing I thought was to use either SMB (e.g., smbexec.py) or WMI (eg., wmiexec.py or wmidump -- cqure.net/wp/tools/network/wmidump ). You can find smbexec.py and wmiexec.py on Kali Linux in the /usr/share/doc/python-impacket/examples/ directory – atdre Nov 15 '16 at 19:33

For Windows, Linux, macOS with no previously-installed agents (e.g., either free or commercial agents such as SCCM, JAMF, osquery, LimaCharlie, FireEye HX, Crowdstrike Falcon, et al), I would jump to either GRR or NBD. For Windows, there is an NBD-Server project that can attach either memory (via GRR/Rekall's winpmem) as well as disks to NBD server TCP ports. For Unix and Linux OSes, it's simply nbd-server, available as a package on most distributions (or you can compile it to a specific platform).

The client should probably be a Linux machine and be able to load the NBD driver and use the nbd-client from userspace with The SleuthKit and filesystem mount tools. I have used CAINE Linux as the NBD client as it contains all of the tools necessary (N.B., others prefer SIFT, or via GIFT). You can then use plaso to acquire artifacts. For a full list see the formats here -- https://github.com/log2timeline/plaso/wiki -- or check out the --help and --info flags for each of the plaso tools. One of the best ways to work cases and collaborate on timeline data is to use a tool such as Google Timesketch.

In a way, the above would be running forensics on it, but I still think it's the best way. If you want to run around networks for hunting operations, perhaps check out Kansa or PowerForensics, but both of these are Windows-specific due to their reliance on PowerShell. CrowdStrike also has a wonderful free, open-source software (FOSS) solution, Falcon Orchestrator, that is built for your purpose -- but again, only Windows-specific. The nicest thing about NBD, pmem, and plaso is that you only have to teach the concepts to your staff once and they apply equally-well to all platforms.

  • Have you used either GRR or Falcon Orchestrator? GRR looks interesting, but it says you have to add the agent to the machine you wish to collect information on. If I try to push an agent out to an infected endpoint, don't I risk the infection spreading? – cyb3ard Nov 14 '16 at 20:06
  • 1
    Falcon, yes, but not the Ochestrator FOSS version. For GRR, there are specific ways to add additional security and obfuscation to the agent -- github.com/google/grr-doc/blob/master/… -- fortunately, it's FOSS, so these can be easily added – atdre Nov 14 '16 at 21:35
  • 1
    To answer this for nbd-server -- at least on Linux, nbd-server can be run in userspace provided that it has access to the file-handle permissions necessary on the block device. One can also restrict it by source IP and/or require authentication for the nbd-client, although to encrypt you may need to wrap it with stunnel or similar. Typically, you could acquire this on a secured network, such as a hub, dedicated WLAN AP, or cross-over Ethernet – atdre Nov 14 '16 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.