2

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is necessary.

I am envisioning a batch script that collected all the basic information about the system (e.g. open network connections, IP addresses, host name, logged on user, local administrators, etc.) and then takes a memory dump using Memorize or similar tool for later analysis.

It would be more efficient if we would run these scripts remotely rather than connecting a thumb drive to the machine with the tools loaded but my concern is that copying the tools to the suspect machine would modify the file system and would be bad for forensics purposes.

Are there any other good options for collecting this information remotely without compromising the forensic data? I am aware of PSexec but tools like memorize will still have to be copied to the remote machine. Perhaps putting all the tools on a read-only share, and redirecting the data back to the analysis workstation with netcat or cryptcat?

Thanks!

Improve this question
4
  • 1
    Are you concerned that leaving a known infected computer on your network could be risky?
    – Neil Smithline
    May 21, 2015 at 22:12
  • That is definitely a concern but so is re-imaging a computer without knowing the infection source or what level of access was obtained (if any).
    – m3ta
    May 21, 2015 at 22:25
  • 1
    I understand. I think the common process is to immediately pull the machine from the net when the problem is detected, run some diagnostics on it (preferably booted from a live CD/USB), reimage it, then reconnect it back to the net.
    – Neil Smithline
    May 21, 2015 at 22:29
  • Absolutely, the immediate concern is to limit infection. Ransomware for example can sweep through an entire org in no time, ref SONY Pictures. Taking it off the network should not impact analysis unless it is incredibly sophisticated. If that is suspected, it would be best to cut power (not shutdown) until forensics can be carried out.
    – Julian Knight
    May 21, 2015 at 23:41

1 Answer 1

Reset to default
4

Live response is a common and accepted practice today. A number of commercial and open source tools can gather volatile data, because immediately pulling the system off of the network can also be disruptive to the forensic validity of your evidence. The key is not "don't change anything", but rather "be able to explain and have documentation for any changes".

For example, SANS best practices explain fairly well how to proceed in this sort of case. NIST 800-86 also documents this in sections 5.1 and 5.2.

I recommend looking into tools like GRR or OSQuery. I don't know of remote live response tools for Windows other than commercial ones like MIR or Carbon Black. (I have no affiliation with any of those tools or organizations.)

Improve this answer
2
  • 1
    Beyond the tools that Kyle mentions if you need something you need to run from time to time check out BriMorLabs Live Response Collection it might be able to provide you all the data you could use to start to do a root cause analysis on the system.
    – user77069
    May 22, 2015 at 13:43
  • For completeness, Mozilla released MIG recently. It's another real-time digital forensics and incident response system akin to GRR and OSQuery.
    – dicato
    Jun 23, 2015 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.