Digital Forensics and Incident Response Incident response tools and techniques for effective cyber threat response

Cover
Title Page
Copyright
Contributors
Table of Contents
Preface
Part 1: Foundations of Incident Response and Digital Forensics
Chapter 1: Understanding Incident Response
The IR process
The role of digital forensics
The IR framework
The IR charter
CSIRT team
The IR plan
Incident classification
The IR playbook/handbook
Escalation process
Testing the IR framework
Summary
Questions
Further reading
Chapter 2: Managing Cyber Incidents
Engaging the incident response team
CSIRT engagement models
Investigating incidents
The CSIRT war room
Communications
Rotating staff
SOAR
Incorporating crisis communications
Internal communications
External communications
Public notification
Incorporating containment strategies
Getting back to normal – eradication, recovery, and post-incident activity
Summary
Questions
Further reading
Chapter 3: Fundamentals of Digital Forensics
An overview of forensic science
Locard’s exchange principle
Legal issues in digital forensics
Law and regulations
Rules of evidence
Forensic procedures in incident response
A brief history of digital forensics
The digital forensics process
The digital forensics lab
Summary
Questions
Further reading
Chapter 4: Investigation Methodology
An intrusion analysis case study: The Cuckoo’s Egg
Types of incident investigation analysis
Functional digital forensic investigation methodology
Identification and scoping
Collecting evidence
The initial event analysis
The preliminary correlation
Event normalization
Event deconfliction
The second correlation
The timeline
Kill chain analysis
Reporting
The cyber kill chain
The diamond model of intrusion analysis
Diamond model axioms
A combined diamond model and kill chain intrusion analysis
Attribution
Summary
Questions
Part 2: Evidence Acquisition
Chapter 5: Collecting Network Evidence
An overview of network evidence
Preparation
A network diagram
Configuration
Firewalls and proxy logs
Firewalls
Web application firewalls
Web proxy servers
NetFlow
Packet capture
tcpdump
WinPcap and RawCap
Wireshark
Evidence collection
Summary
Questions
Further reading
Chapter 6: Acquiring Host-Based Evidence
Preparation
Order of volatility
Evidence acquisition
Evidence collection procedures
Acquiring volatile memory
FTK Imager
WinPmem
RAM Capturer
Virtual systems
Acquiring non-volatile evidence
FTK obtaining protected files
The CyLR response tool
Kroll Artifact Parser and Extractor
Summary
Questions
Further reading
Chapter 7: Remote Evidence Collection
Enterprise incident response challenges
Endpoint detection and response
Velociraptor overview and deployment
Velociraptor server
Velociraptor Windows collector
Velociraptor scenarios
Velociraptor evidence collection
CyLR
WinPmem
Summary
Questions
Chapter 8: Forensic Imaging
Understanding forensic imaging
Image versus copy
Logical versus physical volumes
Types of image files
SSD versus HDD
Tools for imaging
Preparing a staging drive
Using write blockers
Imaging techniques
Dead imaging
Live imaging
Virtual systems
Linux imaging
Summary
Questions
Further reading
Part 3: Evidence Analysis
Chapter 9: Analyzing Network Evidence
Network evidence overview
Analyzing firewall and proxy logs
SIEM tools
The Elastic Stack
Analyzing NetFlow
Analyzing packet captures
Command-line tools
Real Intelligence Threat Analytics
NetworkMiner
Arkime
Wireshark
Summary
Questions
Further reading
Chapter 10: Analyzing System Memory
Memory analysis overview
Memory analysis methodology
SANS six-part methodology
Network connections methodology
Memory analysis tools
Memory analysis with Volatility
Volatility Workbench
Memory analysis with Strings
Installing Strings
Common Strings searches
Summary
Questions
Further reading
Chapter 11: Analyzing System Storage
Forensic platforms
Autopsy
Installing Autopsy
Starting a case
Adding evidence
Navigating Autopsy
Examining a case
Master File Table analysis
Prefetch analysis
Registry analysis
Summary
Questions
Further reading
Chapter 12: Analyzing Log Files
Logs and log management
Working with SIEMs
Splunk
Elastic Stack
Security Onion
Windows Logs
Windows Event Logs
Analyzing Windows Event Logs
Acquisition
Triage
Detailed Event Log analysis
Summary
Questions
Further reading
Chapter 13: Writing the Incident Report
Documentation overview
What to document
Types of documentation
Sources
Audience
Executive summary
Incident investigation report
Forensic report
Preparing the incident and forensic report
Note-taking
Report language
Summary
Questions
Further reading
Part 4: Ransomware Incident Response
Chapter 14: Ransomware Preparation and Response
History of ransomware
CryptoLocker
CryptoWall
CTB-Locker
TeslaCrypt
SamSam
Locky
WannaCry
Ryuk
Conti ransomware case study
Background
Operational disclosure
Tactics and techniques
Exfiltration
Impact
Proper ransomware preparation
Ransomware resiliency
Prepping the CSIRT
Eradication and recovery
Containment
Eradication
Recovery
Summary
Questions
Further reading
Chapter 15: Ransomware Investigations
Ransomware initial access and execution
Initial access
Execution
Discovering credential access and theft
ProcDump
Mimikatz
Investigating post-exploitation frameworks
Command and Control
Security Onion
RITA
Arkime
Investigating lateral movement techniques
Summary
Questions
Further reading
Part 5: Threat Intelligence and Hunting
Chapter 16: Malware Analysis for Incident Response
Malware analysis overview
Malware classification
Setting up a malware sandbox
Local sandbox
Cloud sandbox
Static analysis
Static properties analysis
Dynamic analysis
Process Explorer
Process Spawn Control
Automated analysis
ClamAV
YARA
YarGen
Summary
Questions
Further reading
Chapter 17: Leveraging Threat Intelligence
Threat intelligence overview
Threat intelligence types
The Pyramid of Pain
The threat intelligence methodology
Sourcing threat intelligence
Internally developed sources
Commercial sourcing
Open source intelligence
The MITRE ATT&CK framework
Working with IOCs and IOAs
Threat intelligence and incident response
Autopsy
Maltego
YARA and Loki
Summary
Questions
Further reading
Chapter 18: Threat Hunting
Threat hunting overview
Threat hunt cycle
Threat hunt reporting
Threat hunting maturity model
Crafting a hypothesis
MITRE ATT&CK
Planning a hunt
Digital forensic techniques for threat hunting
EDR for threat hunting
Summary
Questions
Further reading
Appendix
Assessments
Index
About Packt
Other Books You May Enjoy