I had the fortunate opportunity of presenting to the 2021 HTCIA (High Tech Crime Investigators Association) this week. I’d originally hoped to attend in person but we’ve still got travel restrictions in place so it was virtual attendance for me. There was a lot of good speakers and content through the week (triggering my imposter syndrome more and more as the week went on) 😉 In the end I think it went off pretty well. Somehow I managed to see around the “screen sharing” label that for whatever reason (narrator: it was nerves) that I never dismissed.
I don’t know yet if the recordings will remain available after the conference, however I promised to share my slides from the event so if you’d like to review, head on over to the GitHub and grab a copy. While you’re there check out the main feature of my presentation – CSIRT-Collect.
Recently my session on PowerShell Tools for IR Forensics Collection was re-broadcast by Magnet Forensics. During the event there were a few questions and I thought I’d share my responses here.
If you missed the presentation, just look to the previous post and you’ll find a link for YouTube.
Does the CSIRT script check for sufficient available space for the temp files before running? I’ve run into this issue with KAPE collections that get a lot of event logs.
No it doesn’t. Depending on the artifact collection type, the output sizes can vary greatly. Once you have a collection script that you want to use as your default, I’d measure what the average size is. In all my collection processes I like to make sure I have 1.5x available free space for what I anticipate collecting. A WMI ‘check’ could be built into the script to verify the freespace vs. expected collection needs.
This will present the available free space on any fixed disks attached to the system.
The best utilization of free space I could come up with was to grab the memory first, compress it, ship it off and then repeat the collection, compression and transfer with KAPE. This minimizes the amount of disk space needed on the remote host. Both processes have a clean-up operation where all local data is deleted from the endpoint once the network transfer has successfully completed.
With memory sizes so big lately, is it possible to configure the script to collect the important artifacts from memory, rather than the entire memory (e.g. process listing, network connections, etc.)?
It would be possible to generate that information on the endpoint using a series of PowerShell commands and write the output to a text file (Get-Process, Get-NetTCPConnection, etc.). This is certainly useful from an IR perspective, but the only artifact that would be returned back would be the output file. Depending on the circumstances of the investigation you may still need/want the full memory image as evidence.
Do we have the list of artifacts that are being collected here?
In the example presented we’re leveraging the SANS Triage KAPE collection target. The specific collection template used by the CSIRT-Collect script can be adjusted by changing the KAPE command options in the script. You can view the details for any KAPE target by either double-clicking the entry in the KAPE gui, or by viewing the corresponding .tkape file in the program directory (use your text editor of choice). For the SANS Triage collection, the following artifacts are gathered:
# Event Logs
# Evidence of Execution
Name: Amcache transaction files
Name: Syscache transaction files
Name: PowerShell Console Log
# File System
# LNK Files and JumpLists
Name: Lnk files from Recent
Comment: Also includes automatic and custom jumplist directories