Windows Incident Response

Tips for DFIR Analysts

This article has been indexed from Windows Incident Response

Over the years as a DFIR analyst…first doing digital forensics analysis, and then incorporating that analysis as a component of IR activity…there have been some stunningly simple truths that I’ve learned, truths that I thought I’d share. Many of these “tips” are truisms that I’ve seen time and time again, and recognized that they made much more sense and had more value when they were “named”.

Tips, Thought, and Stuff to Think About

Computer systems are a finite, deterministic space. The adversary can only go so far, within memory or on the hard drive. When monitoring computer systems and writing detections, the goal is not write the perfect detection, but rather to force the adversary into a corner, so that no matter what they do, they will trigger something. So, it’s a good thing to have a catalog of detections, particularly if it is based on things like, “…we don’t do this here..”.

For example, I worked with a customer who’d been breached by an “APT” the previous year. During the analysis of that breach, they saw that the threat actor had used net.exe to create user accounts within their environment, and this is something that they knew that they did NOT do. There were specific employees who managed user accounts, and they used a very specific third-party tool to do so. When they rolled out an EDR framework, they wrote a number of detection rules related to user account management via net.exe. I was asked to come on-site to assist them when the threat actor returned; this time, they almost immediately detected the presence of the threat actor. Another good example is, how many of us log into our computer systems and type, “whoami” at a command prompt? I haven’t seen many users do this, but I’ve seen threat actors do this. A lot.

From McChrystal’s “Team of Teams“, there’s

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

Read the original article: Tips for DFIR Analysts