DFIR Blog
  • Infosec
    • Blog
    • Threat Landscape
  • Digital Forensics
    • Windows Forensics
    • Mac Forensics
    • Memory Forensics
    • Forensic Resources
  • Incident Response
  • CISSP
    • Domain-1
    • Domain-2
    • Domain-3
    • Domain-4
    • Domain-5
    • Domain-6
    • Domain-7
    • Domain-8
  • Contact
  • HTB
  • Productivity

Windows Forensics

Evidence of Execution - Shimcache

6/23/2019

 
Shimcache/Amcache is also know is AppCompatCache. There are certain application which are build to work on the historical version of the OS.  Usually if an application needs 'shimming' - windows looks at AppCompatKey registry key to figure out if an application needs shimming or not.

When a program is shimmed, a registry key is updated to notify the system.
Picture
Use tools like RegRipper to parse it.
Forensics Value:
If you are dealing with an Anti-forensics kind of situation. The adversary might have deleted the logs from prefetch and the file itself.  The amcache entries will show if the app existed on the system.

Key things to remember:
  • Recent entries are on the top.
  • Entries are written on shutdown

Shimcache/Amcache and Prefetch is a very powerful combination for identification of the execution.

Things to keep in mind during shimcache analysis:
1) Each time an exe is modified or renamed - it'll create a new shimcache entry
2) Cannot determine the last time of execution via Shimcache.

Antedating

6/23/2019

 
Antedating: Creating a document with incorrect time stamps.
Investigation:
  • Analyzing the metadata of the document to get the baseline information is the first step.
  • Secondly, perform a comparative analysis of the metadata of all the documents under the investigation.
  • One might get some important information from the source machine. Analyze the event logs if it's a windows machine.
  • Look for the email headers if the document is shared via email.
  • Use basic common sense in analysis by looking and the OS and the release date of the extension.

How to antedate a document?
  • Use Software to change the metadata.
  • Changing the computer time before creating an electronic document is another method of antedating, as the metadata for the newly created electronic file will be based on the incorrect setting of the system.

Readings:
http://www.cse.scu.edu/~tschwarz/COEN252_13/Papers/antedating.pdf

Evidence of execution - Prefetch

6/16/2019

 
Prefetch Basics: Windows Prefetch stores application specific data in order to help it to start quicker. Each time you turn on your computer, Windows keeps track of the way your computer starts and which programs you commonly open. Windows saves this information as a number of small files in the prefetch folder. The next time you turn on your computer, Windows refers to these files to help speed the start process.

The os loads key pieces of data and code from disk into memory before it's actually needed. 

Location: c:\Windows\Prefetch
Prefetch Investigation FAQ:

When you should grab prefetch file?
You can grab is before performing Incident Response as the prefetch directory is populated after the application is executed. The content of the file is pretty volatile. 

How you can use it in an Investigation?
Analysis of prefetch file is common in investigation, it has wealth of information stored in it.
*  It contains:
  • number of time an application has been executed,
  • The original path of execution,
  • the last time of execution
Note: Up to last 8 times application executed is stored in prefetch file. If I also add the timestamp of the prefetch file creation - we will have 9 run times of the application. 

Here is what information we can glean from the prefetch:
  • When a malicious file was executed?
  • Where it was launched from?
  • How many times it has been run?
  • What DLLs were used by the malicious code?
  • Name and location of the malicious file (even if deleted)?

Kerberos Primer and Cyber Attacks

6/5/2019

 
Picture

​Kerberos is a network authentication protocol inspired by the greek work for a a three heaed dog Cerberus. Couple of key points to remember about the protocol
  • Uses Ticket for Authentication
  • Avoid sending password over the network
  • Uses Symmetric key encryption
​

Picture
Source: ​https://docops.ca.com/ca-single-sign-on/12-8/en/configuring/policy-server-configuration/authentication-schemes/configure-kerberos-authentication

Kerberos Attacks

#Pass the ticket:
  • Pass the ticket is used to perform "lateral movement” by leveraging Kerberos Authentication System.
  • The Attacker will extract Kerberos TGT (Ticket Granting Ticket) from LSASS memory.
  • The obtained ticket is used to request Kerberos Service Ticket to get access to network.
  • Kerberos TGT Expires in 10 Hours by default 
  • Tools like Mimikatz, Rubeus are used to perform this kind of attack
    • Phase-1 is to Monitor via tools looking for 4624 Logon events
    • Once any user logs in - the tools will go & grab the ticket.

Ways to investigate Pass the ticket Attack
  • Get access to the host and analyze the logon sessions
  • Use kList command to inspect the Kerberos Tickets associated with the session
  • Looks for Kerberos tickets that do not match the user associated with the session
Basically you’ll look for all the current user login session and see corresponding tickets associated with it. If you notice any anomaly that will be indicative to suspicious activity on the host.
Countermeasures:
  • Credentials Guard is Hypervisor based isolation to restrict access to the hashes and the tickets. Watch this video - https://www.youtube.com/watch?v=urqXgBbVyWY​
  • Multi-factor Authentication (MFA) is one of the good ways to handing Pass the Ticket Attacks along the standard cybersecurity practices.
#Overpass the hash:
In overpass-the-hash, the attacker will try to capture NTLM hash for the account it wishes to compromise using tools like Mimikatz etc.
Using this command in mimikatz: 
Sekurlsa::pth /user:[USER] /domain:[DOMAIN] /ntlm:[NTLM HASH]
The NTML hash was passed into Kerberos authentication provider using RC4 Encryption

#Kerberoasting:
The focus of this attack is to compromise a service account. It request a ticket for a highly privileged service account. Capture the hash for it and crack it offline.

#Golden Ticket:
This is generated with a Ticket Granting Ticket for any account with my expiration is generated.

​
Majority of the Active Directory based attacks can be detected by implementing Microsoft Advanced Threat Analytics.
https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata

    Archives

    September 2019
    August 2019
    July 2019
    June 2019
    March 2019
    March 2018

    Categories

    All
    ATA
    Detection
    Forensics
    Microsoft
    Rules
    Windows
    Windows Foreniscs

    RSS Feed

  • Infosec
    • Blog
    • Threat Landscape
  • Digital Forensics
    • Windows Forensics
    • Mac Forensics
    • Memory Forensics
    • Forensic Resources
  • Incident Response
  • CISSP
    • Domain-1
    • Domain-2
    • Domain-3
    • Domain-4
    • Domain-5
    • Domain-6
    • Domain-7
    • Domain-8
  • Contact
  • HTB
  • Productivity