Fundamentals of forensic methodology (Part 1)

• https://github.com/topics/file-integrity-monitoring

• https://www.solarwinds.com/security-event-manager/use-cases/file-integrity-monitoring-software

Anti-forensic methods

Timestamps

An attacker may be interested in changing the timestamps of files to avoid detection. Timestamps can be found inside the MFT in the $STANDARD_INFORMATION__ and __ $FILE_NAME attributes.

Both attributes have 4 timestamps: modify , access , create , and modify the MFT register (MACE or MACB).

Windows Explorer and other tools show information from $STANDARD_INFORMATION.

TimeStomp is an anti-forensic tool

This tool changes the timestamp information inside $STANDARD_INFORMATION , but not the information inside $FILE_NAME . Thus, it is possible to detect suspicious activity.

Usnjrnl

The USN log (update sequence number log) is an NTFS (Windows NT file system) feature that tracks changes to volumes. The UsnJrnl2Csv tool allows you to verify these changes.

The preview image is the result shown by the tool, where you can see that some changes have been made to the file.

$LogFile

All metadata changes to the file system are logged in a process known as write-ahead journaling. Logged metadata is stored in a file named **$LogFile** located in the root directory of the NTFS file system. Tools such as LogFileParser can be used to analyze this file and identify changes.

Again, you can see in the output of the tool that some changes have been made. Using the same tool, you can determine to what time the timestamps were changed:

• Open the Services program by typing “services” in the search text box after clicking the Windows Start button.

• Find Volume Shadow Copy in the list, select it, and then right-click to open Properties.

• In the Startup Type drop-down menu, select Disabled, then confirm the changes by clicking Apply and OK.

You can also change the configuration of the files that will be copied to the shadow copy of the registry:

HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot

Overwrite deleted files

fsutil usn deletejournal /d c:

fdisk -l disk.img 
Disk disk.img: 102 MiB, 106954648 bytes, 208896 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00495395

Device        Boot Start    End Sectors  Size Id Type
disk.img1       2048 208895  206848  101M  1 FAT12

Note that the sector size is 512 and the start is 2048 . Then mount the image like this:

mount disk.img /mnt -o ro,offset=$((2048*512))

• Raw (each segment combined together)

• Padded (same as raw, but with zeros in the right bits)

• Lime (recommended format with metadata

LiME can also be used to send a dump over the network instead of storing it on the system using something like: path=tcp:4444

Disk image

First of all, you will need to turn off the system. This is not always an option, as sometimes the system will be a working server that the company cannot afford to shut down. There are 2 ways to turn off the system: normal shutdown and shutdown according to the “plug in” principle. The former will allow processes to complete as usual and synchronize the file system, but it will also allow potential malware to destroy evidence. The “pull the plug” approach can cause some information loss (a small amount of information will be lost because we’ve already made a memory image) and malware won’t have any way to do that. So if you suspect that there might be malware, just run the command in the system and pull the fork.sync

It is important to note that before connecting the computer to anything related to the case, you should make sure that it is mounted as read-only to avoid changing any information.

#Create a raw copy of the disk
dd if=<subject device> of=<image file> bs=512

#Raw copy with hashes along the way (more secure as it checks hashes while it's copying the data)
dcfldd if=<subject device> of=<image file> bs=512 hash=<algorithm> hashwindow=<chunk size> hashlog=<hash file>
dcfldd if=/dev/sdc of=/media/usb/pc.image hash=sha256 hashwindow=1M hashlog=/media/usb/pc.hashes

Preliminary analysis of the disk image

Creating a disk image with no data.

#Find out if it's a disk image using "file" command
file disk.img 
disk.img: Linux rev 1.0 ext4 filesystem data, UUID=59e7a736-9c90-4fab-ae35-1d6a28e5de27 (extents) (64bit) (large files) (huge files)

#Check which type of disk image it's
img_stat -t evidence.img 
raw
#You can list supported types with
img_stat -i list
Supported image format types:
        raw (Single or split raw file (dd))
        aff (Advanced Forensic Format)
        afd (AFF Multiple File)
        afm (AFF with external metadata)
        afflib (All AFFLIB image formats (including beta ones))
        ewf (Expert Witness Format (EnCase))

#Data of the image
fsstat -i raw -f ext4 disk.img 
FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: Ext4
Volume Name: 
Volume ID: 162850f203fd75afab4f1e4736a7e776

Last Written at: 2020-02-06 06:22:48 (UTC)
Last Checked at: 2020-02-06 06:15:09 (UTC)

Last Mounted at: 2020-02-06 06:15:18 (UTC)
Unmounted properly
Last mounted on: /mnt/disk0

Source OS: Linux
[...]

#ls inside the image
fls -i raw -f ext4 disk.img
d/d 11: lost+found
d/d 12: Documents
d/d 8193:       folder1
d/d 8194:       folder2
V/V 65537:      $OrphanFiles

#ls inside folder
fls -i raw -f ext4 disk.img 12
r/r 16: secret.txt

#cat file inside image
icat -i raw -f ext4 disk.img 16
ThisisTheMasterSecret

Search for known malware

Linux offers tools to ensure the integrity of system components, which is critical to identifying potentially problematic files.

# Debian package and log details
cat /var/lib/dpkg/status | grep -E "Package:|Status:"
cat /var/log/dpkg.log | grep installed
# RedHat RPM database query
rpm -qa --root=/mntpath/var/lib/rpm
# Listing directories for manual installations
ls /usr/sbin /usr/bin /bin /sbin
# Identifying non-package executables (Debian)
find /sbin/ -exec dpkg -S {} \; | grep "no path found"
# Identifying non-package executables (RedHat)
find /sbin/ –exec rpm -qf {} \; | grep "is not"
# Find exacuable files
find / -type f -executable | grep <something>

Recover deleted running binaries

Imagine a process that was executed from /tmp/exec and deleted. It can be removed

cd /proc/3746/ #PID with the exec file deleted
head -1 maps #Get address of the file. It was 08048000-08049000
dd if=mem bs=1 skip=08048000 count=1000 of=/tmp/exec2 #Recorver it

Check the autostart locations. Scheduled tasks

cat /var/spool/cron/crontabs/*  \
/var/spool/cron/atjobs \
/var/spool/anacron \
/etc/cron* \
/etc/at* \
/etc/anacrontab \
/etc/incron.d/* \
/var/spool/incron/* \

#MacOS
ls -l /usr/lib/cron/tabs/ /Library/LaunchAgents/ /Library/LaunchDaemons/ ~/Library/LaunchAgents/

Services

Paths by which malware can be installed as a service:

pip3 install usbrip
usbrip ids download #Download USB ID database

usbrip events history #Get USB history of your curent linux machine
usbrip events history --pid 0002 --vid 0e0f --user kali #Search by pid OR vid OR user
#Search for vid and/or pid
usbrip ids download #Downlaod database
usbrip ids search --pid 0002 --vid 0e0f #Search for pid AND vid

# List recent files in a directory: 
ls -laR --sort=time /bin```

# Sort files in a directory by inode: 
ls -lai /bin | sort -n```

git diff --no-index --diff-filter=A path/to/old_version/ path/to/new_version/

git diff --no-index --diff-filter=M path/to/old_version/ path/to/new_version/ | grep -E "^\+" | grep -v "Installed-Time"

git diff --no-index --diff-filter=D path/to/old_version/ path/to/new_version/

• check the OutputDebugString error

• run as a service

• the process of creation

IOC

IOC stands for Indicator of Compromise. An IOC is a set of terms that define potentially unwanted software or confirmed malware. Blue Teams uses this definition to search for this kind of malicious files in its systems and networks. Sharing these definitions is very useful because when malware is identified on a computer and an IOC is created for that malware, other blue teams can use it to identify the malware faster.

The tool for creating or modifying IOCs is the IOC Editor. You can use tools like Redline to find specific IOCs in a device.

Loki

Loki is a scanner for simple indicators of compromise. Detection is based on four detection methods:

1. File Name IOC
   Regex match on full file path/name

2. Yara Rule Check
   Yara signature matches on file data and process memory

3. Hash Check
   Compares known malicious hashes (MD5, SHA1, SHA256) with scanned files
   
4. C2 Back Connect Check
   Compares process connection endpoints with C2 IOCs (new since version v.10)

Linux malware detection

Linux Malware Detect (LMD) is a Linux malware scanner released under the GNU GPLv2 license designed to detect threats in shared environments. It uses threat data from network intrusion detection systems to extract malware actively used in attacks and generates signatures for detection. In addition, threat data is also obtained from user reports using the LMD scan feature and resources from the malware community.

rkhunter

Tools such as rkhunter can be used to scan the file system for possible rootkits and malware.

sudo ./rkhunter --check -r / -l /tmp/rkhunter.log [--report-warnings-only] [--skip-keypress]

• FLOSS is a tool that will try to find obfuscated lines in executables using various methods.

• PEpper checks some basic things inside the executable (binary data, entropy, urls and ips, some yara rules).

• PEstudio is a tool that allows you to get information about Windows executables, such as imports, exports, headers, as well as check the total number of viruses and find potential attack methods.

• DiE is a tool for determining if a file is encrypted and for finding packers.

• NeoPI is a Python script that uses a variety of statistical techniques to detect obfuscated and encrypted content in text/script files. NeoPI’s intended purpose is to help discover hidden web shell code.

• PHP-malware-finder does its best to detect obfuscated/tricky code, as well as files that use PHP functions that are often used in malware/webshells.

Apple binary signatures

When checking a malware sample, you should always check the signature of the binary, as the developer who signed it may already be associated with the malware.

#Get signer
codesign -vv -d /bin/ls 2>&1 | grep -E "Authority|TeamIdentifier"

#Check if the app’s contents have been modified
codesign --verify --verbose /Applications/Safari.app

#Check if the signature is valid
spctl --assess --verbose /Applications/Safari.app

Detection methods Compilation of files

If you know that some folder containing web server files was last updated on a certain date . Check the date when all files on the web server were created and modified, and if any date is suspicious, check that file.

Base lines

If the folder’s files should not have been changed, you can calculate the hash of the folder’s original files and compare them to the current ones. Any change will be suspicious.

Statistical analysis

When information is stored in logs, you can check statistics such as how many times each web server file was accessed, as the web shell can be one of the largest .

Continuation in the second part