Applied Incident Response - Steve Anson

. .

Résumé :

Part I Prepare 1

Chapter 1 The Threat Landscape 3

Attacker Motivations 3

Intellectual Property Theft 4

Supply Chain Attack 4

Financial Fraud 4

Extortion 5

Espionage 5

Power 5

Hacktivism 6

Revenge 6

Attack Methods 6

DoS and DDoS 7

Worms 8

Ransomware 8

Phishing 9

Spear Phishing 9

Watering Hole Attacks 10

Web Attacks 10

Wireless Attacks 11

Sniffing and MitM 11

Crypto Mining 12

Password Attacks 12

Anatomy of an Attack 13

Reconnaissance 13

Exploitation 14

Expansion/Entrenchment 15

Exfiltration/Damage 16

Clean Up 16

The Modern Adversary 16

Credentials, the Keys to the Kingdom 17

Conclusion 20

Chapter 2 Incident Readiness 21

Preparing Your Process 21

Preparing Your People 27

Preparing Your Technology 30

Ensuring Adequate Visibility 33

Arming Your Responders 37

Business Continuity and Disaster Recovery 38

Deception Techniques 40

Conclusion 43

Part II Respond 45

Chapter 3 Remote Triage 47

Finding Evil 48

Rogue Connections 49

Unusual Processes 52

Unusual Ports 55

Unusual Services 56

Rogue Accounts 56

Unusual Files 58

Autostart Locations 59

Guarding Your Credentials 61

Understanding Interactive Logons 61

Incident Handling Precautions 63

RDP Restricted Admin Mode and Remote Credential Guard 64

Conclusion 65

Chapter 4 Remote Triage Tools 67

Windows Management Instrumentation Command-Line Utility 67

Understanding WMI and the WMIC Syntax 68

Forensically Sound Approaches 71

WMIC and WQL Elements 72

Example WMIC Commands 79

PowerShell 84

Basic PowerShell Cmdlets 87

PowerShell Remoting 91

Accessing WMI/MI/CIM with PowerShell 95

Incident Response Frameworks 98

Conclusion 100

Chapter 5 Acquiring Memory 103

Order of Volatility 103

Local Memory Collection 105

Preparing Storage Media 107

The Collection Process 109

Remote Memory Collection 117

WMIC for Remote Collection 119

PowerShell Remoting for Remote Collection 122

Agents for Remote Collection 125

Live Memory Analysis 128

Local Live Memory Analysis 129

Remote Live Memory Analysis 129

Conclusion 131

Chapter 6 Disk Imaging 133

Protecting the Integrity of Evidence 133

Dead-Box Imaging 137

Using a Hardware Write Blocker 139

Using a Bootable Linux Distribution 143

Live Imaging 149

Live Imaging Locally 149

Collecting a Live Image Remotely 154

Imaging Virtual Machines 155

Conclusion 160

Chapter 7 Network Security Monitoring 161

Security Onion 161

Architecture 162

Tools 165

Snort, Sguil, and Squert 166

Zeek (Formerly Bro) 172

Elastic Stack 182

Text-Based Log Analysis 194

Conclusion 197

Chapter 8 Event Log Analysis 199

Understanding Event Logs 199

Account-Related Events 207

Object Access 218

Auditing System Configuration Changes 221

Process Auditing 224

Auditing PowerShell Use 229

Using PowerShell to Query Event Logs 231

Conclusion 233

Chapter 9 Memory Analysis 235

The Importance of Baselines 236

Sources of Memory Data 242

Using Volatility and Rekall 244

Examining Processes 249

The pslist Plug-in 249

The pstree Plug-in 252