I thought I'd make my first post of 2017 short and sweet...no frills in this one...
Tools
Volatility 2.6 is available!
Matt Suiche recently tweeted that Hibr2Bin is back to open source!
Here's a very good article on hibernation and page file analysis, which discusses the use of strings and page_brute on the page file, as well as Volatility on the hibernation file. Do not forget bulk_extractor; I've used this to great effect during several examinations.
Willi's EVTXtract has been updated; this is a great tool for when the Windows Event Log has been cleared, or someone took a live image of a system and one or more of the *.evtx files are being reported as 'corrupt' by your other tools.
FireEye recently published an article describing how they parse the WMI repository for indications of process execution...
Cyber Interviews
Douglas has kept the content coming, so be sure to check out the interviews he's got posted so far...
Web Shells
Web shells are still something very much in use by the bad guys. We've seen web shells used very recently, and TrustWave also published an interesting article on the topic.
Tenable published their own article on hunting for web shells.
Volatility 2.6 has some new profiles for Windows 10 that really helped me parse Win 10 memory dumps. On 2.5, it would was taking forever to run and not returning any result. On 2.6 with the new profiles, it works fine.
ReplyDelete