I am in the process of creating an IRP that responds to system hacks.

I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access via SSH port 22. From there I have modified file extensions, accessed personal folders etc - on the victim machine.

As part of my IRP, is there any other useful area to look to prove an attack has taken place and files were accessed?? My IRP investigates (so far);

  • Windows Event Viewer (Application Logs, System Logs, Security logs)
  • OpenSSH log files

Any other alternatives would be very much appreciated.

  • Unless your logs are exported to another system, they are useless. They can be deleted or edited by the attacker. – ThoriumBR Jan 16 '20 at 19:06
  • Yeah I’m aware of that, that’s why I’m asking for alternatives. – C.Mann Jan 16 '20 at 19:08
  • First of all, export the logs to another system. Check if the local logs and the remote logs are in sync. If they don't, you have an attack and can know exact what the attacker tried to hide. – ThoriumBR Jan 16 '20 at 19:10

Memory + Hoarder artifacts

Most guides want you to examine processes, network connections, and Event Logs. I don't recommend this.

Others, such as this great guide -- https://unminioncurioso.blogspot.com/2019/03/dfir-first-steps-with-volatility.html -- go into detail about timelines and certain registry hives, such as Amcache, that provide a unique view into what happened.

Perform an analysis using one of these as guest VMs after transferring your artifacts over:

  • Thanks. Is memory or hoarder artefacts considered as live or dead forensics? I’ve finished my computing degree but I’m trying to get my foot in the door in Forensics. So I’m aiming to demonstrate that I’m looking at the evidence collected via “dead forensics”. – C.Mann Jan 19 '20 at 18:26
  • Dead usually means the system isn't on, so live – atdre Jan 20 '20 at 4:22
  • Ah ok that’s no good for me as I’m trying to demonstrate dead forensics. Thanks anyway – C.Mann Jan 20 '20 at 11:18
  • I'll come up with an answer for you, don't worry little guy! – atdre Jan 20 '20 at 17:58
  • Cheers badman!! – C.Mann Jan 20 '20 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.