1. Mastering Windows Network Forensics and Investigation Chapter 10: Tool Analysis

2. December 1, 2015 © Wiley Inc. 2007. All Rights Reserved 2 Chapter Topics: Purpose of tool analysis Tools & Techniques

3. Purpose of Tool Analysis Understand the tool used by attacker - what it is doing and how it works Understand impact or damage done to target system Be able to demonstrate later in court how intrusion occurred Enables detailing of damage done to system & connected systems

4. Tools & Techniques Use various antivirus / spyware detection tools first Strings –Enables extraction & viewing of plain-text strings from within executables, DLL’s, etc Dependency Walker –Shows on which modules the attacker’s code depends –Assists with understanding what the code is doing

5. Tools & Techniques Monitoring the code when it runs –Create clone system (VMWare, Shadow Drive, restored copy) –Keep in sandbox – isolate on network –Setup monitoring tools Regmon Filemon InCtrl5

6. Tools & Techniques Install live analysis tools –PsList –Netstat –Tasklist (tlist) –Fport –Whoami Setup network traffic monitoring tool (Wireshark) –Use whatever tools you would use for a live response to analyze the impact & function of the bad code

7. InCtrl5 Results

8. FileMon Results

9. RegMon Results

10. Forensic Exam of “Compromised Clone” After you’ve run the bad code on test machine, forensically examine it If cloned, examine clone device If VMWare, create full clone of comprised VMWare image Examine the compromised full clone image with forensic tool such as EnCase

11. EnCase View of VMWare Image

12. Examine Results of Network Traffic When test host compromised, what network traffic resulted from bad code during and after installation? Wireshark (formerly Ethereal) network monitoring tool

13. Ethereal View of Bad Code Attempting to Contact an FTP Server

14. Do External Port Scan & Compare to Netstat Results Root kit can hide open ports and processes from user By comparing netstat results with those on external port scan, you can often detect presence of root kit

15. Results of “netstat –an”

16. Results? Netstat showed 9 open TCP ports? SuperScan showed 10 open TCP ports? Why? Root kit is hiding one of the TCP ports and netstat can’t be relied upon to be accurate!

17. Results of SuperScan