Upload
angela-stephens
View
230
Download
0
Tags:
Embed Size (px)
Citation preview
Mastering Windows Network Forensics and Investigation
Chapter 10: Tool Analysis
April 21, 2023© Wiley Inc. 2007. All Rights Reserved 2
Chapter Topics:
• Purpose of tool analysis
• Tools & Techniques
Purpose of Tool Analysis
• Understand the tool used by attacker - what it is doing and how it works
• Understand impact or damage done to target system
• Be able to demonstrate later in court how intrusion occurred
• Enables detailing of damage done to system & connected systems
Tools & Techniques
• Use various antivirus / spyware detection tools first
• Strings– Enables extraction & viewing of plain-text
strings from within executables, DLL’s, etc
• Dependency Walker– Shows on which modules the attacker’s
code depends– Assists with understanding what the code
is doing
Tools & Techniques
• Monitoring the code when it runs– Create clone system (VMWare,
Shadow Drive, restored copy)– Keep in sandbox – isolate on
network– Setup monitoring tools
• Regmon• Filemon• InCtrl5
Tools & Techniques
• Install live analysis tools– PsList– Netstat– Tasklist (tlist)– Fport– Whoami
• Setup network traffic monitoring tool (Wireshark)
– Use whatever tools you would use for a live response to analyze the impact & function of the bad code
InCtrl5 Results
FileMon Results
RegMon Results
Forensic Exam of “Compromised Clone”
• After you’ve run the bad code on test machine, forensically examine it
• If cloned, examine clone device• If VMWare, create full clone of
comprised VMWare image• Examine the compromised full
clone image with forensic tool such as EnCase
EnCase View of VMWare Image
Examine Results of Network Traffic
• When test host compromised, what network traffic resulted from bad code during and after installation?
• Wireshark (formerly Ethereal) network monitoring tool
Ethereal View of Bad Code Attempting to Contact an FTP Server
Do External Port Scan & Compare to Netstat Results
• Root kit can hide open ports and processes from user
• By comparing netstat results with those on external port scan, you can often detect presence of root kit
Results of “netstat –an”
Results?
• Netstat showed 9 open TCP ports?
• SuperScan showed 10 open TCP ports?
• Why?
• Root kit is hiding one of the TCP ports and netstat can’t be relied upon to be accurate!
Results of SuperScan