verisift CLAUDE.md

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Course: SANS FOR508 — Advanced Incident Response, Threat Hunting & Digital Forensics Scenario: Stark Research Labs (SRL) — Lab 1.1 APT Incident Response Challenge

---

Case Overview

Field	Value
Client	Stark Research Labs (SRL)
Domain	SHIELDBASE (Windows Server 2022, 2022 DFL)
Threat Actor	CRIMSON OSPREY (state-level APT)
Incident Declared	2023-01-24
Your Role	External IR consultant
Initial Responders	Roger Sydow (IT Admin), Clint Barton (IT Security Analyst)

---

Evidence Files

File	System	Notes
/cases/srl/base-dc-cdrive.E01	dc01 — Domain Controller	C: drive (~12.5 GB)
/cases/srl/base-rd01-cdrive.E01	rd01 — Remote Desktop Server	C: drive (~16.6 GB) — primary compromise host
/cases/memory/rd01-memory.img	rd01	RAM capture (5 GB, primary analysis image)
/cases/srl/base-rd_memory.img	rd01	RAM capture (3 GB, baseline-era image)
/cases/srl/base-dc_memory.img	dc01	RAM capture (5 GB)

Read-only — do NOT modify evidence files. Output all analysis to ./analysis/, ./exports/, or ./reports/ (relative to /cases/srl/).

---

Common Commands

Mount E01 images (read-only)

# Mount rd01 C: drive
sudo mkdir -p /mnt/ewf_rd01 /mnt/rd01
sudo ewfmount /cases/srl/base-rd01-cdrive.E01 /mnt/ewf_rd01
sudo mount -o ro,loop,noatime /mnt/ewf_rd01/ewf1 /mnt/rd01

# Mount dc01 C: drive
sudo mkdir -p /mnt/ewf_dc01 /mnt/dc01
sudo ewfmount /cases/srl/base-dc-cdrive.E01 /mnt/ewf_dc01
sudo mount -o ro,loop,noatime /mnt/ewf_dc01/ewf1 /mnt/dc01

# Unmount when done
sudo umount /mnt/rd01 && sudo umount /mnt/ewf_rd01
sudo umount /mnt/dc01 && sudo umount /mnt/ewf_dc01

Volatility 3 (memory — rd01)

VOL="python3 /opt/volatility3-2.20.0/vol.py"
IMG="/cases/memory/rd01-memory.img"

# Human-readable process tree
$VOL -f $IMG -r pretty windows.pstree | cut -d '|' -f 1-11

# All processes incl. exited
$VOL -f $IMG windows.psscan | grep -v "N/A"

# Command lines
$VOL -f $IMG windows.cmdline | tee ./exports/cmdline.txt

# Process SIDs
$VOL -f $IMG windows.getsids | tee ./exports/getsids.txt

# Network connections
$VOL -f $IMG -r csv windows.netstat | tee ./exports/netstat.csv

# DLL list for a specific PID
$VOL -f $IMG -r csv windows.dlllist --pid 1912 | tee ./exports/dlllist-stun.csv