incident-response

Incident Response

When to Activate

• Active security incident requiring investigation
• Memory forensics and artifact extraction
• Disk forensics and timeline reconstruction
• Malware containment and eradication
• Post-incident analysis and reporting

IR Phases

1. Identification & Scoping

# Determine scope of compromise
# Key questions:
# - What systems are affected?
# - What's the initial access vector?
# - How long has the attacker been present?
# - What data may be compromised?
# - Is the attacker still active?

# Quick triage
chainsaw hunt /path/to/evtx/ -s sigma/ --mapping mappings/sigma-event-log-all.yml
hayabusa csv-timeline -d /path/to/evtx/ -o timeline.csv

2. Evidence Collection

# Memory acquisition (before anything else!)
# Windows: winpmem, DumpIt, FTK Imager
# Linux: LiME (insmod lime.ko "path=/evidence/mem.lime format=lime")

# Disk imaging
dd if=/dev/sda of=/evidence/disk.img bs=4M status=progress
# Or: FTK Imager, dc3dd for forensic imaging

# Log collection
# Windows: Event logs, Sysmon, PowerShell logs
# Linux: /var/log/auth.log, /var/log/syslog, journalctl
# Network: PCAP, NetFlow, DNS logs, proxy logs
# Cloud: CloudTrail, Azure Activity Log, GCP Audit Log

# Volatile data (collect before shutdown)
# - Running processes (ps aux / tasklist)
# - Network connections (netstat -anp / Get-NetTCPConnection)
# - Logged-in users (w / query user)
# - Open files (lsof / handle.exe)
# - Loaded modules (lsmod / listdlls)

3. Memory Forensics (Volatility 3)

# Process analysis
vol3 -f mem.raw windows.pslist
vol3 -f mem.raw windows.pstree
vol3 -f mem.raw windows.cmdline
vol3 -f mem.raw windows.netscan

# Malware detection
vol3 -f mem.raw windows.malfind  # injected code
vol3 -f mem.raw windows.hollowprocesses  # process hollowing
vol3 -f mem.raw windows.svcscan  # suspicious services

# Credential extraction
vol3 -f mem.raw windows.hashdump
vol3 -f mem.raw windows.lsadump
vol3 -f mem.raw windows.cachedump

# File extraction
vol3 -f mem.raw windows.dumpfiles --pid PID
vol3 -f mem.raw windows.filescan | grep -i "suspicious"

# Linux memory
vol3 -f mem.raw linux.pslist
vol3 -f mem.raw linux.bash  # bash history from memory
vol3 -f mem.raw linux.check_syscall  # rootkit detection