Skip to main content

Posts

Rapid malware execution investigation via velociraptor, excel

 We will be using velociraptor and excel to find out malware execution on the system by differential analysis.  Context = Any true positive alert you get or you were targeted by a sophisticated advanced persistent threat. We need actionable intelligence to pivot more. Workflow : Following the below two links, collect the build the collector and collect the artifacts first from the fresh system and the infected system.  https://mahimfiroj.blogspot.com/2026/09/windows-rapid-triage-with-velociraptor.html https://github.com/secure-cake/win-mal-investigations (Preferred)  Reference file : SLIDES_Windows-Malware-Investigations-02082024.pdf (Saved on my ovi.it88 google drive) Here we also have some important script that will be helpful during IR. https://github.com/secure-cake/win-mal-investigations/tree/main/misc-powershell Once collection is done, now we need to follow the following workflow again from the 4th point: In this case the artifacts does not require parsing. H...
Post a Comment
Read more
Recent posts

Windows rapid triage with velociraptor and kape

 During malware incidents or any cyber attack, we need to first triage the system to collect useful artifacts so that it can help in our analysis greatly.  The main link I followed: https://github.com/secure-cake/rapid-endpoint-investigations/wiki/REI-Wiki-Part-1:-Intro We will use velociraptor to collect artifacts and kape tool to parse those artifacts.  Let's first ready the tools. Download velociraptor from the below link: Velociraptor (download): https://docs.velociraptor.app/downloads/ Now register, download kape from the below link and save here C:\Tools\KAPE https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape Once the kape is installed, now we need to download some executables and put it in this folder  KAPE\Modules\bin NirSoft BrowsingHistoryView: https://www.nirsoft.net/utils/browsing_history_view.html (SAVE TO: ..KAPE\modules\bin\browsinghistoryview.exe NirSoft Browser Downloads View: https://www.nirsoft.net/utils/web_...
Post a Comment
Read more

Linux rapid triage using velociraptor (offline collector - Linux IR)

Linux rapid triage using velociraptor offline collector with catscale  Today we will see how we can collect linux artifacts using velociraptor offline collector during malware incidents. For reference: https://github.com/secure-cake/malware-investigations/wiki/Velociraptor-Offline-Collector-with-CatScale-for-Linux Catscale will use linux living of the land tools to collect artifacts.  Step 1: Download the velociraptor from the below link on your analyst windows system: https://docs.velociraptor.app/downloads/ Step 2: Now we need to launch PowerShell or command prompt to execute the velociraptor gui by the following command. .\velociraptor-v0.XX.X-windows-amd64.exe gui  Step 3: In this step we will first import the catscale VR artifacts then select other artifacts. Here we have multiple steps. 1. From the VR welcome page, click on " Import Extra Artifacts ". 2. On the next dialogue box, follow below image instruction.  Remove all except Artifact Exchange and The Tria...
Post a Comment
Read more

Google Drive quota download error fix

Here we will see how to solve google drive quota download related error.  When the file size is too big like 60 GB and it is most popular file, then most people will hit download if the author post it publicly. In that case, you face this type of error which will take around 24 hours to reset.   Step 1:  Go to you personal drive and create a folder.  Step 2: Now open the link and click on Add shortcut icon.  Step 3: Select the folder that you created just now and click on Add. You will be notified that shortcut is added.  Step 4: Now right click on this folder and select download. Shortly the download will be started.  Avi
Post a Comment
Read more

Way Forward For Duplicate LVM Names

 Avoiding duplicate lvm name issues.  Scenario : Let's say 5-10 systems are compromised and all of those systems are spawned up from a pre-configured template i.e. AMI - amazon machine image. Using that you can launch new EC2 instance.  Template‑এ থাকে: OS (Linux/Windows) Pre‑installed packages Configuration settings Now when you try to bring all the images of those host machines and try to mount on your analyst vm, it will refuse to work due to same lvm group name, uuid etc. We are here to fix that problem.  First note the checksum: host1/disk1.raw and  host1/disk1.raw --> We have this directory structure where images are present.  md5sum host*/* e3b85cad126731e76955b2240b69f39d  host1/disk1.raw e3b85cad126731e76955b2240b69f39d  host2/disk1.raw You can see that the checksum is same.  Pre-requisite necessary tool installation: apt install xmount Step 1 — দুইটার জন্যই xmount cache + loopback সেটআপ: mkdir -p /mnt/host1/xmount/disk1 mkdir -...
Post a Comment
Read more

Timeline analysis preparation (Linux IR)

 Before starting this lab, we need to first mount the image. See my this blog: https://mahimfiroj.blogspot.com/2026/08/disk-acquisition-and-access.html Step 1: Creating working directories. mkdir -p /images/case cd /images/case Now you need to confirm that the image is already mounted. See the above blog post. Step 2: Creating body files. fls is a tool from sleuthkit.  apt install sleuthkit -y Root filesystem (LVM): fls -r -m / /dev/VulnOSv2-vg/root | gzip > bodyfile-root.gz Boot / other raw partitions (offset required): fls -r -m /boot -o 2048 /mnt/case/img/ewf1 | gzip > bodyfile-boot.gz -r for recursive and -m for mount point, -o for offset. gz is done to save the space. Step 3: Building filtered timeline. zcat bodyfile-* | mactime -d <YYYY-MM-DD> | grep -v deleted-realloc > timeline.csv wc -l timeline.csv 3327 timeline.csv Another Way of doing this: fls -r  -m "/" /media/Avi/USB/yamato.raw > timeline.body (This file name and extension does not need t...
Post a Comment
Read more

Disk acquisition and access for IR

 Goal for this lab is after we acquire the disk in .E01 format then how can we mount this to linux system for analysis.  দুইটা scenario cover করছি: (A) simple E01 + LVM (single disk), (B) E01 + Software RAID + LVM (multi-disk, যেমন disk1/disk2) From the linux analysis vm like sansforensic vm, you need to run the following commands.  We need to first create the working directories : mkdir -p /mnt/case/img /mnt/case/data E01 + LVM (single disk) - First case. Step 1 — E01 mount: ewfmount Webserver.E01 /mnt/case/img ls -lh  /mnt/case/img total 0  -r--r--r-- 1 root root 32G Feb 16 18:21 ewf1 Ewf1 is a raw disk image. It's size and main disk size are same. This is in read-only mode. See the permission. Step 2 — See the partition layout : mmls /mnt/case/img/ewf1 কোন offset-এ কোন partition আছে (boot, lvm ইত্যাদি) note করুন। RAID sign ( 0xfd ) আছে কিনা খেয়াল করুন — থাকলে Scenario B তে যান। lvscan | grep VulnOSv2-vg mount -o ro,noexec /dev/VulnOSv2-vg/root /mnt/case/dat...
Post a Comment
Read more