What You Will Learn
FIGHT CRIME. UNRAVEL INCIDENTS...ONE BYTE (OR PACKET) AT A TIME.
FOR572A: Lethal Network Forensics focuses on introducing the network perspective into your investigative workflow. Even if the most skilled remote attacker compromised a system with an undetectable exploit, the system still had to communicate over the network. Without command-and-control and data extraction channels, the value of a compromised computer system drops to almost zero. Whether your threats include nation-state actors, insider threats, or commodity threat actors, the knowledge acquired in this course will ensure that you are prepared to face such dynamic adversaries in a rapidly changing environment. The skills covered in this course directly support those conducting both traditional post-compromise investigations as well as more recent proactive threat hunting.
This course focuses on the three primary sources of network-based evidence: full packet capture, NetFlow, and logs. Whether used together or separately, or whether used in conjunction with host-based evidence or alone, these sources can provide critical insight into the actions an attacker has taken in the past or continues to take in the victim's environment.
The material covers low-level packet capture techniques and approaches to using high-level data to scope a compromise, identify attack traffic, and root out network-based data theft. Students use a wide range of tools, including tcpdump, Wireshark, hex editors, the Elastic Stack, Arkime, and more.
NOTE: Students will receive the Linux-based SIFT Workstation with over 500 digital forensics and incident response tools prebuilt into the environment, including network forensic tools added just for this course. Also included are the SOF-ELK® platform, which is comprised of a specially configured instance of the Elastic Stack, and an installation of the Arkime full-packet capture and analysis platform. Using only open-source tools, the course shows how you can effectively conduct network investigations covering a wide range of attack profiles.
Syllabus (12 CPEs)
Network data can be preserved, but only if directly captured or documented while in transit. Whether tactical or strategic, packet capture methods are quite straightforward. In this course section students will re-acquaint themselves with tcpdump and Wireshark, which are among the most common tools used to capture and analyze network packets, respectively. However, since long-term full-packet capture is still uncommon in most environments, many artifacts that can tell us about what happened on the wire in the past come from devices that manage network functions. You will learn about what kinds of devices can provide valuable evidence and at what level of granularity. We will walk through collecting evidence from one of the most common sources of network evidence - a web proxy server - and then you'll go hands-on to find and extract stolen data from the proxy as well as directly from captured network traffic.
- Virtual Machine Setup and Orientation
- Hands-on tcpdump and Wireshark
- Carving an Exfiltrated File from a Packet Capture
- Use Cases for Network Forensics
- Difference in Mindset between Computer Forensics and Network Forensics
Foundational Network Forensics Tools: tcpdump and Wireshark
- tcpdump Re-introduction
- pcap File Format
- Berkeley Packet Filter (BPF)
- Wireshark Re-introduction
- User Interface
- Display Filters
- Useful Features for Network Forensic Analysis
Web Proxy Server Examination
- Role of a Web Proxy
- Proxy Solutions - Commercial and Open-Source
- Squid Proxy Server
- Automated Analysis
- Cache Extraction
Network Evidence Acquisition
- Evidence Types: Packet Capture, NetFlow, Logs
- Capture Devices
- Capture Planning and Strategies
The second course section will cover logging protocols and how they can affect evidence availability and level of detail. We'll also discover the Elastic Stack, a large-scale data aggregator and analysis platform, and use the SOF-ELK® distribution to explore large amounts of log data efficiently and effectively. A hands-on lab with SOF-ELK® will reinforce these concepts in a realistic compromise data set. We will then discuss NetFlow, a network traffic summarization technology. Despite not having traffic content like packet capture does, NetFlow is still a vital asset to the network investigator. We'll look at NetFlow architectures to identify the relative strengths and weaknesses of various capture strategies and will again use SOF-ELK® in a lab, but with a large-scale NetFlow collection rather than logs. Finally, we will cover the Arkime full-packet capture and analysis platform, which can provide a petabyte-scale packet capture architecture in a free and open-source tool.
- SOF-ELK® Log Aggregation and Analysis
- Visual NetFlow Analysis with SOF-ELK®
- Network Forensic Analysis Using Arkime
Logging Protocols and Aggregation
- Syslog Protocol
- Windows Event Forwarding Framework
- Log Aggregation Techniques and Considerations
Elastic Stack and the SOF-ELK® Platform
- Elastic Stack Components
- Use Cases for the Elastic Stack as a Log Aggregator
- The Kibana Interface
- The SOF-ELK® Platform
- Types of Evidence It Can Process
- Using Filtering and Searching Features
- Supplied Dashboards
NetFlow Collection and Analysis
- Reasons for Using NetFlow for Investigations
- Components of a NetFlow Architecture
Full-Packet Hunting with Arkime
- Arkime Platform Components and Architecture
- Search Syntax to Isolate Sessions of Interest
- The Viewer Interface and Its Features
Important! Bring your own system configured according to these instructions!
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.
This is common sense, but we will say it anyway. Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't responsible for your system or data.
MANDATORY FOR572 SYSTEM HARDWARE REQUIREMENTS
- CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
- It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
- Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.
- BIOS settings must be set to enable virtualization technology, such as "Intel-VTx". Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!
- 16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.)
- USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)
- 200 Gigabytes of Free Space on your System Hard Drive - Free Space on Hard Drive is critical to host the VMs and data sets we distribute
- Local Administrator Access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
- Wireless 802.11 Capability - there are no wired networks in the classroom.
MANDATORY FOR572 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS
Host Operating System: Latest version of Windows 10 or macOS 10.15.x
- On Windows hosts, VMware products cannot coexist with the Hyper-V hypervisor. Disable Hyper-V and ensure VMware can boot a virtual machine. Disabling Hyper-V, Device Guard, and Credential Guard can be accomplished using these instructions.
- Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
- Linux hosts cannot be supported in the classroom due to their numerous variations. Students that wish to use Linux hosts must be experienced users or administrators, and must also be able to access ExFAT partitions using the appropriate kernel and/or FUSE modules.
PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS\
- Microsoft Office (any version) w/Excel or OpenOffice w/Calc installed on your host - Note you can download Office Trial Software online (free for 30 days)
- Download and install VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Player offers fewer features than VMware Workstation, and Workstation is recommended for a more seamless student experience.
- Download and install 7Zip (for Windows Hosts) or Keka (for macOS)
Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.
SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.