Avi's blog

 Base64 decode command. Go to sans sift workstation: echo "base64 payload data" | base64 -d | iconv -f UTF-16LE -t UTF-8 iconv command is used to convert double-byte Unicode to single-byte Unicode or ascii, making the output easier to read.  Avi

 Setting up plaso on your own windows host using wsl distro- windows subsystem for linux. First go to your linux vm and run below commands: docker must be installed on your linux vm. docker run -t --name Plaso-v20230520 log2timeline/plaso:20230520 log2timeline.py --version Link for plaso tags: If you want to pull latest docker image then from the below link find the relative tags. Here we are pulling 20230520 plaso version.  https://hub.docker.com/r/log2timeline/plaso/tags Making the .tar file that will be moved to windows vm. docker export Plaso-v20230520 > /cases/Plaso-v20230520.tar Now you can remove it from linux vm. docker rm Plaso-v20230520 Now take it to windows vm. Then open command prompt in admin mode and run below commands: mkdir C:\SANS\Plaso-v20230520 wsl --import Plaso-v20230520 C:\SANS\Plaso-v20230520 .\Plaso-v20230520.tar Avi

 EvtxECmd - this tool will help us to convert event logs into csv format. Later we can use timeline analysis tool to analysis the csv data more efficiently.  This tool also help us to convert logs into json format.  Download the tool first. https://ericzimmerman.github.io/#!index.md Command : evtxecmd --sync evtxecmd -f E:\C\Windows\System32\winevt\logs\Security.evtx --csv g:\Labs\event-logs --csvf security.csv evtxecmd -f "e:\C\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%40Operational.evtx" --csv G:\Labs\event-logs --csvf taskscheduler.csv Windows have so many event logs and so many event id's. Not all the event id's are important. Of course you can use your own but Mark Hallman created a script that will parse all the important event id's that is discussed in SANS FOR508 course. You can use mark hallman's Process-EventLogs.ps1 tool that will parse important event id's from bulk event logs leveraging evtxecmd tool.  https://github.com/ma...

 Kape is a triage collection and post-processing application written by Eric Zimmerman. Remember its just the triage collection tool ok? We will analyze the collection later.  https://github.com/EricZimmerman/KapeFiles Kape download: Kroll Artifact Parser And Extractor (KAPE) | Cyber Risk | Kroll Besides full disk image/acquired disk image, this tool allows us to create smaller triage image where important forensic data is present . In case the scenario is divide and conquer , meaning if you want smaller triage image from big size disk image then you can use this and share with your DFIR team to investigate together. The main reason of using kape is now you don't need to wading or sift through into the full image where 10% actual artifacts are present. Kape will allow you to collect those 10% before taking full image. Now you can analysis those 10% of data.  If you want to learn more, please open for508 workbook and labs section 1-2.pdf file and look for page 28. This is...

 Kansa is an IR framework. https://github.com/davehull/Kansa For enterprise data collection, you need to do this first from the admin system: Set-NetConnectionProfile -NetworkCategory Private (In private network) Enable-PSRemoting  from powershell on the system where you want to run this tool. This will enable winrm service with port 5985 and 5986. Check: netstat -naob | findstr "5985"   Also allow tcp port 5985 and 5986 for winrm through the network. You can use  GPO. Though winrm is communicating over http and https but authentication will be happened using kerberos in domain environment.  After downloading it  from the github and unzip it, you need to unlock it using powershell. Need powershell v3 or later. ls -r *.ps1 | Unblock-File Powershell policy bypass: Set-ExecutionPolicy AllSigned | RemoteSigned | Unrestricted From FOR508 course: .\kansa.ps1 -OutputPath .\Output\ -TargetList .\hostlist -TargetCount 250 -Verbose -Pushbin -Pushbin is requir...

  Perform the following steps from a non-root user. We will go for manual installation.  https://github.com/scnr/installer?tab=readme-ov-file#manual-installation https://github.com/scnr/installer/releases wget https://github.com/scnr/installer/releases/download/v1.7.3/scnr-v1.7.3-linux-x86_64.tar.gz   (Download using normal user) tar -xvzf scnr-v1.7.3-linux-x86_64.tar.gz cd scnr-v1.7.3 cd bin Now go to their website ( https://ecsypno.com/products/scnr ) and subscribe for community edition license from your official email.  ./scnr_activate 6XQ97FW3LVBECD0UJ5H214 ./scnr https://www.example.net/Login.aspx --system-slots-override Now they generate .ser format report after testing the application by default which is hard to read. We need html report. So for example, to generate an HTML report: ./scnr_reporter --report=html:outfile=my_report.html.zip /home/user/.scnr/reports/report.ser Avi