FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

Overview

There are ways to gain an advantage against adversaries targeting you. It starts with the right mindset and knowing what works.

The last decade has not been kind to network defenders. Threats to the modern enterprise are legion and attackers have used the enormous complexity of enterprise networks against us. But the tide is shifting. Over the past decade, we have seen a dramatic increase in sophisticated attacks against organizations. State-sponsored attackers, often referred to as Advanced Persistent Threat (APT) actors, have proved difficult to suppress. Massive financial attacks from the four corners of the globe have resulted in billions of dollars in losses. Ransomware and extortion became an existential threat almost overnight. While the odds are stacked against us, the best security teams are proving that these threats can be managed and mitigated. FOR508™ aims to bring those hard-won lessons into the classroom.

Understanding attacks is critical to being able to detect and mitigate them. We start our education of attacker techniques on day one, learning common malware and attack characteristics and diving deep into techniques used by adversaries to maintain persistence in the network. Persistence is typically completed early in the attack cycle and students will learn hunting techniques to audit the network and accomplish early discovery. Living off the land binaries (local tools available in most environments), PowerShell, and WMI-based attacks in particular, have become standard operating procedure for advanced adversaries and students get a lot of practice with tools and techniques to identify such attacks at scale. We end the day with an in-depth discussion of Microsoft credentialing. The complexity of credentials in the modern enterprise cannot be overstated and credentials are the number one vulnerability present in every network. By understanding the tools and techniques being used to target credentials, students learn how to prevent, detect, and mitigate these devastating attacks.

Exercises

• APT Incident Response Scenario Introduction
• Malware Persistence Detection and Analysis
• Creating Local and Remote Triage Evidentiary Images
• Scaling Remote Endpoint Incident Response

Topics

Real Incident Response Tactics

• Preparation: Key tools, techniques, and procedures that an incident response team needs to respond properly to intrusions
• Identification/Scoping: Proper scoping of an incident and detecting all compromised systems in the enterprise
• Containment/Intelligence Development: Restricting access, monitoring, and learning about the adversary in order to develop threat intelligence
• Eradication/Remediation: Determining and executing key steps that must be taken to help stop the current incident and the move to real-time remediation
• Recovery: Addressing systemic weaknesses that lead to the incident
• Lessons-Learned/Threat-Intel Consumption: Leverage the TTPs discovered to continue to hunt and detect similar intrusions in the future

Threat Hunting

• Hunting versus Reactive Response
• Intelligence-Driven Incident Response
• Building a Continuous Incident Response/Threat Hunting Capability
• Forensic Analysis versus Threat Hunting Across Endpoints
• Threat Hunt Team Roles
• ATT&CK - MITRE's Adversarial Tactics, Techniques, and Common Knowledge

Malware

• Identification of Compromised Systems
• Finding Active and Dormant Malware
• Digital signatures for code signing
• Malware Characteristics
• Common Hiding and Persistence Mechanisms
• Finding Evil by Understanding Normal
• Malicious use of built-in commands (“Living off the Land”) and 3rd-party utilities

Incident Response and Hunting Across the Enterprise

• Rapid Response Tooling Solutions
• PowerShell Remoting
• PowerShell Remoting Credential Safeguards
• Kansa PowerShell Remoting IR Framework
• KAPE Triage Collection Tool
• Velociraptor Incident Response Platform

Malware Persistence Identification

• AutoStart Locations, RunKeys
• Service Creation/Replacement
• Service Failure Recovery
• Scheduled Tasks
• DLL Hijacking Attacks
• WMI Event Consumers

Prevention, Detection, and Mitigation of Credential Theft

• Pass the Hash
• Token Stealing
• Cached Credentials
• LSA Secrets
• NTLM Attacks
• Kerberos Attacks
• Golden Tickets
• Kerberoasting
• DCSync
• NTDS.DIT theft
• Bloodhound and Active Directory Graphing
• Credential Attacks with Mimikatz, Metasploit, and many others
• Technical and Architectural Mitigation Techniques

Overview

Even the most advanced adversaries leave footprints everywhere. Learn the secrets of the best hunters.

Cyber defenders have a wide variety of tools and artifacts available to identify, hunt, and track adversary activity in a network. Each attacker action leaves a corresponding artifact and understanding what is left behind as footprints can be crucial to both red and blue team members. Attacks follow a predictable pattern, and we focus our detective efforts on immutable portions of that pattern. As an example, at some point an attacker will need to run code to accomplish their objectives. We can identify this activity via application execution artifacts. The attacker will also need one or more accounts to run code. Consequently, account auditing is a powerful means of identifying malicious activity.

Exercises

• Hunting and Detecting Evidence of Execution at Scale
• Discovering Credential Abuse
• Tracking Lateral Movement
• Hunting Malicious use of WMI and PowerShell

Topics

Advanced Evidence of Execution Detection

• Attacker Tactics, Techniques, and Procedures (TTPs) Observed Via Process Execution
• Prefetch Analysis
• Application Compatibility Cache (ShimCache)
• Amcache Registry Examination
• Scaling ShimCache and Amcache Investigations

Lateral Movement Adversary Tactics, Techniques, and Procedures (TTPs)

• Compromising Credentials Techniques
• Remote Desktop Services Misuse
• Windows Admin Share Abuse
• PsExec and Cobalt Strike Beacon PsExec Activity
• Windows Remote Management Tool Techniques
• PowerShell Remoting/WMIC Hacking
• Cobalt Strike Lateral Movement and Credential Use
• Vulnerability Exploitation

Log Analysis for Incident Responders and Hunters

• Profiling Account Usage and Logons
• Tracking and Hunting Lateral Movement
• Identifying Suspicious Services
• Detecting Rogue Application Installation
• Finding Malware Execution and Process Tracking
• Capturing Command Lines and Scripts
• Anti-Forensics and Event Log Clearing

Investigating WMI and PowerShell-Based Attacks

• WMI Overview
• WMI Attacks Across the Kill Chain
• Auditing the WMI Repository
• WMI File System and Registry Residue
• Command-Line Analysis and WMI Activity Logging
• PowerShell Transcript and ScriptBlock Logging
• Discovering Cobalt Strike beacon PowerShell Import Activity
• Detecting PowerShell Injection from Cobalt Strike, Metasploit, and Empire
• PowerShell Script Obfuscation
• Microsoft Defender Logs, Detection History, and MPLog Analysis

Overview

Using memory analysis sometimes feels like cheating. Finding active attacks shouldn't be this easy.

Memory forensics has come a long way in just a few years. It is now a critical component of many advanced tool suites (notably EDR) and the mainstay of successful incident response and threat hunting teams. Memory forensics can be extraordinarily effective at finding evidence of worms, rootkits, PowerShell attacks, ransomware precursors, and advanced malware used by targeted attackers. In fact, some fileless attacks may be nearly impossible to unravel without memory analysis. Memory analysis was traditionally the domain of Windows internals experts and reverse engineers, but new tools, techniques, and detection heuristics have greatly leveled the playing field making it accessible today to all investigators, incident responders, and threat hunters. Further, understanding attack patterns in memory is a core analyst skill applicable across a wide range of endpoint detection and response (EDR) products, making those tools even more effective.

Exercises

• Detect Custom Malware in Memory
• Examine Windows Process Trees
• Locate Advanced “Beacon” Malware
• Identify Advanced Malware Hiding Techniques
• Analyze Memory from Multiple Infected Systems

Topics

Endpoint Detection and Response (EDR)

• EDR Capabilities and Challenges
• EDR and Memory Forensics

Memory Acquisition

• Acquisition of System Memory
• Hibernation and Pagefile Memory Extraction and Conversion
• Virtual Machine Memory Acquisition
• Memory changes in Windows 10 and 11

Memory Forensics Analysis Process for Response and Hunting

• Understanding Common Windows Services and Processes
• Identify Rogue Processes
• Analyze Process Objects
• Review Network Artifacts
• Look for Evidence of Code Injection
• Audit Drivers and Rootkit Detection
• Dump Suspicious Processes and Drivers

Memory Forensics Examinations

• Live Memory Forensics
• Memory Analysis with Volatility
• Webshell Detection Via Process Tree Analysis
• Code Injection, Malware, and Rootkit Hunting in Memory
• Advanced Memory Forensics with MemProcFS
• WMI and PowerShell Process Anomalies
• Extract Memory-Resident Adversary Command Lines
• Investigate Windows Services
• Hunting Malware Using Comparison Baseline Systems
• Find and Dump Cached Files from RAM

Memory Analysis Tools

• Velociraptor
• Volatility
• MemProcFS

Overview

Timeline analysis will change the way you approach digital forensics, threat hunting, and incident response...forever.

Temporal data is located everywhere on a computer system. Filesystem modification/access/creation/change times, log files, network data, registry data, and browser history files all contain time data that can be correlated and analyzed to rapidly solve cases. Pioneered by Rob Lee as early as 2001, timeline analysis has grown to become a critical incident response, hunting, and forensics technique. New timeline analysis frameworks provide the means to conduct simultaneous examinations on a multitude of systems across a multitude of forensic artifacts. Analysis that once took days now takes minutes.

Exercises

• Malware Discovery
• Tracking Adversary Activity with Super-Timeline Analysis
• Observe Attacker Movements Through Systems
• Identify Intrusion Root Causes

Topics

Malware Discovery

• Locate suspicious processes with entropy and signature analysis
• Recover malicious files in AV quarantine
• Use YARA for malware classification
• Review malicious binaries with Capa

Timeline Analysis Overview

• Timeline Benefits
• Prerequisite Knowledge
• Finding the Pivot Point
• Timeline Context Clues
• Timeline Analysis Process

Filesystem Timeline Creation and Analysis

• MACB Timestamps
• Windows Time Rules (File Copy versus File Move)
• Filesystem Timeline Creation Using Sleuthkit, fls and MFTECmd
• Bodyfile Analysis and Filtering Using the mactime Tool

Super Timeline Creation and Analysis

• Super Timeline Artifact Rules
• Program Execution, File Knowledge, File Opening, File Deletion
• Timeline Creation with log2timeline/Plaso
• log2timeline/ Plaso Components
• Filtering the Super Timeline Using psort
• Targeted Super Timeline Creation
• Super Timeline Analysis Techniques
• Scaling Super Timeline Analysis with Elastic Search (ELK)

Overview

Advanced adversaries are always improving. We must keep pace.

Attackers commonly take steps to hide their presence on compromised systems. While some anti-forensics steps can be relatively easy to detect, others are much harder to deal with. As such, it’s important that forensic professionals and incident responders are knowledgeable on various aspects of the operating system and file system which can reveal critical residual evidence.

Exercises

• Volume Shadow Snapshot Analysis
• Timelines
• Anti-Forensics Analysis using NTFS
• Timestomp Identification
• Advanced Data Recovery

Topics

Volume Shadow Copy Analysis

• Volume Shadow Copy Service
• Options for Accessing Historical Data in Volume Snapshots
• Accessing Shadow Copies with vshadowmount
• Volume Shadow Copy Timelining

Advanced NTFS Filesystem Tactics

• NTFS Filesystem Analysis
• Master File Table (MFT) Critical Areas
• NTFS System Files
• NTFS Metadata Attributes
• Rules of Windows Timestamps for $StdInfo and $Filename
• Detecting Timestamp Manipulation
• Resident versus Nonresident Files
• Alternate Data Streams
• NTFS Directory Attributes
• B-Tree Index Overview and Balancing
• Finding Wiped/Deleted Files using the $I30 indexes
• Filesystem Flight Recorders: $Logfile and $UsnJrnl
• Common Activity Patterns in the Journals
• Useful Filters and Searches in the Journals
• What Happens When Data Is Deleted from an NTFS Filesystem?

Advanced Evidence Recovery

• Markers of Common Wipers and Privacy Cleaners
• Deleted Registry Keys
• Detecting "Fileless" Malware in the Registry
• File Carving
• Volume Shadow Carving
• Carving for NTFS artifacts and Event Log Records
• Effective String Searching
• NTFS Configuration Changes to Combat Anti-Forensics

Overview

Solving the final intrusion lab requires investigating artifacts on over thirty systems including Windows 10 and 11 workstations, DMZ servers, a domain controller, internal development servers, and hosted Exchange email. You will walk out of the course with hands-on experience investigating a real attack, curated by a cadre of instructors with decades of experience fighting advanced threats.

Topics

• The Intrusion Forensic Challenge requires analysis of multiple systems from an enterprise network with many endpoints.
• Learn to identify and track attacker actions across an entire network finding initial exploitation, reconnaissance, persistence, credential dumping, lateral movement, elevation to domain administrator, and data theft/exfiltration
• Witness and participate in a team-based approach to incident response.
• Discover evidence of some of the most common and sophisticated attacks in the wild including Cobalt Strike, Sliver, Covenant, Remote Monitoring and Management (RMM) tools, PowerShell exploit frameworks, and custom nation-state malware.
• During the challenge, each incident responder will be asked to answer key questions and address critical issues in the different categories listed below, just as they would during a real breach in their organizations:

Identification And Scoping:

• How and when was the network breached? Which system is "Patient Zero"?
• How did the initial infection occur giving the attackers a foothold? What type of exploit was used?
• When and how did the attackers first laterally move to each system?
• What were the attacker's primary and secondary command and control backdoors?

Containment And Threat Intelligence Gathering:

• How and when did the attackers obtain domain administrator credentials?
• What did the attackers look for on each system?
• Damage Assessment: what data was stolen?
• Damage Assessment: was email accessed or stolen?
• Was any evidence of anti-forensics activity discovered?
• Were the attackers able to access any cloud-based resources like cloud computing resources or cloud storage data?
• Threat Intelligence: catalog host-based and network indicators of compromise.

Remediation And Recovery:

• What level of account compromise occurred? Is a full password reset required during remediation?
• Based on the attacker techniques and tools discovered during the incident, what are the recommended steps to remediate and recover from this incident?
• What systems need to be rebuilt?
• What IP addresses need to be blocked?
• What countermeasures should we deploy to slow or stop these attackers if they come back?
• What recommendations would you make to detect these intruders in our network again?