First post of 2017 and it’s a big one! Also, thanks to everyone who retweeted/mentioned my site in the last week. Really saw a jump in the numbers 🙂

SOFTWARE UPDATES

• Oxygen Forensics updated their Detective product to version 9.1.1, adding a SIM card extraction module, additional application and device support as well as other minor improvements. They also produced a YouTube video showcasing the update.
  Oxygen Forensic® Detective extracts current and deleted SIM card data
  
  
• Kevin Breen at Tech Anarchy has updated VolUtility to version 1.2 adding an optional Authentication module and fixing some issues.
  VolUtility Release v1.2 – With Authentication Module
  
  
• Phil Harvey updated ExifTool to version 10.38 (developmental release) adding additional tags and bug fixes.
  Jan. 5, 2017 – Version 10.38
  
  
• Paraben Corporation have released E3:Universal Aurora Edition 1.1 improving artefact support, data acquisition and import, and fixing various bugs.
  E3 1.1 is now available!
  
  
• 0x4D at Seclist advises that Xplico, an open source network forensic analysis tool has been updated to version 1.2.0 fixing various bugs.
  Xplico V1.2.0 – Open Source Network Forensic Analysis Tool (NFAT)

• Also on Seclist, HoChi-Minh announced the update for Powermemory to version 1.4. The update allows users to “dump local passwords hashes with last logon time and password last set.”
  Powermemory V1.4 – Exploit The Credentials Present In Files And Memory
  
  
• Eric Zimmerman updated a number of his tools (AmcacheParser 0.9.1.0, AppCompatCacheParser 0.9.5.0, JLECmd 0.9.8.0, LECmd 0.9.5.0, PECmd 0.9.0.0). The major change is the ability for JLECmd to take AppIds from an external list (also on that topic can everyone that reads appid lists standardise on a format, bar separated is good). I also found that you can install all of Eric’s tools using Chocolatey on Windows.
  Check Out @EricRZimmerman’s Tweet
  
  
• Philippe Lagadec updated his olefile python package to version 0.44, “fixing several bugs, removing support for Python 2.5, added support for incomplete streams and incorrect directory entries (to read malformed documents), added getclsid,” and has moved the documentation to ReadTheDocs.
  olefile 0.44
  
  
• Get Data updated Forensic Explorer to version 3.9.7.6152 adding minor updates.
  8 Jan 2017 – v3.9.7.6152
  
  
• X-Ways Forensics updated version 18.9 to SR-12 to incorporate many of the fixes from later versions.
  X-Ways Forensics 18.9 SR-12
  
  
• X-Ways Forensics SR-11 was released, fixing various bugs.
  X-Ways Forensics 19.0 SR-11
  
  
• X-Ways Forensics Beta 1 was released adding some new features such as “Event extraction from Apple FSEvent logs” and new options regarding hash sets, as well as various minor improvements and bug fixes.
  X-Ways Forensics 19.1 Beta 1

SOFTWARE/PRODUCT RELEASES

• David Dym at Easy Meta Data has released a command line barebones version of his MetaDiver tool
  Added Source For Simple Console App To Dump Metadata And Content Using #tika Using .NET
  
  
• Didier Stevens at NVISO labs introduces decompile-py2exe which allows users to decompile Python 3 programs compiled with py2exe.
  Decompiling py2exe Executables
  
  
• Yogesh Khatri at Swift Forensics has released a Python script to parse the microsoftRegistrationDB.reg SQLite database created by Office for Mac using recursive SQLite queries. The post shows how to perform the task manually before providing the script.
  Flexing SQL muscle for parsing an MS db on OSX
  
  
• Michael Bailey at FireEye introduces “flare-qdb, a command-line utility and Python module based on vivisect for querying and altering dynamic binary state conveniently, iteratively, and at scale”
  FLARE Script Series: Querying Dynamic State Using The Fireeye Labs Query-oriented Debugger (flare-qdb)
  

PRESENTATIONS/PODCASTS

• Joshua James at Cybercrime Technologies shares a video showing how to conduct a preliminary analysis of a disk image using The Sleuth Kit (TSK) command line tools.
  [How to] Beginner Introduction to The Sleuth Kit (command line)
  
  
• Joshua also uploaded a video showing how to compile code, in this case The Sleuth Kit, in Linux.
  Compiling Software in Linux: The Sleuthkit
  
  
• Forensic Focus has uploaded a webinar by Olga Koksharova from Elcomsoft on the “available acquisition methods and … iOS acquisition tools for legacy (32bit) and new (64bit) Apple mobile devices”.
  iOS acquisition methods
  
  
• Lee Reiber spent this Mobile Forensic Minute talking about the logs.db file found on Samsung Android devices (found at the path /data/com.sec.android.logsprovider/databases/logs.db). This file may contain call logs, sms’s, and e-mail snippets.
  Mobile Forensic Minute 104
  
  
• Victoria Berry provided a quick overview of the 8 webinars that Magnet Forensics produced in 2016.
  A Round-Up of the Rich Library of Webinars Magnet Forensics Offered in 2016
  
  
• On this week’s Digital Forensics Survival Podcast, Michael talks about the areas examiners can choose if they’d like to pick something new to focus on in 2017.
  The first is to set up a regimented self-training program. Michael continues to suggest people look into mobile, virtual machine, and memory forensics, as well as learning to code and planning your certification route.
  DFSP # 046 – DFIR New Year
  
  
• Douglas Brush at Cyber Security Interviews has done a quick recap of what he’s taken from the last 5 interviews that were conducted on the show.
  #007 – What I Am Learning So Far

FORENSIC ANALYSIS

• Russ McRee has provided his commentary on Matt Swans Incident Response Hierarchy of Needs, and maps the “Center for Internet Security Critical Security Controls Version 6.1 (CIS CSC) … to each of Matt’s hierarchical entities and phases”.
  The DFIR Hierarchy of Needs & Critical Security Controls
  
  
• Ted Smith at X-Ways Clips has a post showing how to use X-Ways to generate file listings (including adding your own comments).
  Narrative 54 – Creating Data Schedules of Your Reviewed Evidence
  
  
• Cyber Forensicator shared a number of articles this week
  • They shared a throwback segment from Paul’s Security Weekly where Heather Mahalik presented on advanced mobile device forensics.
    Advanced Mobile Device Forensics with Heather Mahalik
  • They shared “Patrick Wardle’s presentation from RSA Conference USA 2016 on practical OS X malware detection and analysis”.
    Practical OS X Malware Detection and Analysis
  • They shared “Andrew Case’[s] presentation on memory forensics of Linux and Mac systems from Enfuse 2016”.
    Memory Forensics of Linux and Mac Systems
  • They shared a paper by Pankaj Choudhary, Upsana Singh, Nitesh K Bharadwaj, and Bhupendra Singh presented at the 11th Annual Symposium on Information Assurance (Asia ’16) on Facebook Forensics for Windows 10. This paper covers the Facebook app on Win10 that utilises the Universal App platform feature and maintains its data in an SQLite database.
    Facebook Forensics for Windows 10
  • They shared a paper by the European Union Agency for Network and information Security that provides an “overview of the current status of the forensic analysis techniques and processes of cloud incidents”
    Exploring Cloud Incidents
    
    
• Digital Forensics Corp shared a number of articles this week
  • They shared NIST’s “updated guidance on cyber security events”. From the looks of things, NIST updated a number of documents. They can be found here.
    NIST Shared A Cyber Incident Recovery Guide
  • They shared an article by William Tan at CrowdStrike from earlier last year about using “OS X FSEvents to discover deleted malicious artifacts”.
    Using OS X FSEvents to Discover Deleted Malicious Artifacts
  • They shared links to Alexandre Borges’ presentation on reversing malware
    Alexandre Borges’ Presentations
  • They shared a Python script that attempts to brute force files that have been modified using Steghide.
    Steg Brute Force Tool V1.0 Is Available Now
    
    
• John H. at 909Forensics shares some “useful one-liners to extract info from Windows logs with PowerShell.”
  Windows Log Hunting with PowerShell
  
  
• Jonathon Poling talks about the importance of understanding your tools. He also lists a series of questions that you should ask yourself when evaluating a tool. Jonathon’s belief is that the examiner should understand what the tool is providing them, and what it’s missing. At the same time, once an examiner identifies an issue they should attempt to contact the vendor/author to fix it.  
  Knowing Your Tools
  
  
• Patrick J. Siewert at Pro Digital Forensics covers the various ways that an investigator can determine “that emails were [or weren’t] sent from a particular device at a specific location”.
  Conducting an Electronic Investigation: A Case Study in Virginia Politics
  
  
• Matt Bromiley continues the Zeltser challenge!
  • This post explains DHCP including “the four key steps in a DHCP initial lease allocation: Discover, Offer, Request, Acknowledge (or ACK) (DORA)
    Full Packet Friday: DHCP
  • This post explains the new “inspect” feature in RedSketch which will “parse a SQLite table and see what tables have any data in them”.
    Scripting Saturday: Continuing Redsketch Development
  • This post covers Matt’s effort to index his posts; thankfully he’s started it at the beginning of his challenge. The index can be found here.
    Happy New Year!
  • This post showcases a tool called Regshot which “allows an analyst to perform before and after snapshots of the Windows Registry.” Regshot also has the ability to monitor a folder for changes. “If the analyst had a suspicion about their malware dropping or altering files, you could place a directory under watch and see what changes were made.”
    Malware Monday: Regshot
  • This post unpacks the identification of “exposed, unsecured MongoDB instances”, resulting in them being held for ransom. This has occurred because the attack is very easy to perform, and can be very expensive to recover from. Matt explains how to perform the attack and a rough timeframe in which it can occur (read: it doesn’t take long) and thankfully provides some remediation steps to either limit the damage or identify the potential problem.
    It’s 10PM; Do You Know Where Your MongoDB Is?
  • Continuing on from the previous days post on MongoDB, Matt explores the logging available on the platform and expands in the greater DFIR lessons that can be learned. The lessons, which are expanded on in the post, are: “Don’t make a statement about results if you aren’t looking at all the evidence”, “Understand the complexities of your evidence”, “Explore alternative options to achieve XYZ”, and “consider the context of the situation”.
    MongoDB Ransoms: Part 2
  • Returning to regularly scheduled programming, Matt talks about the tools that come with Joachim Metz’s libewf library. These tools include ewfmount (mounting EWF files), ewfinfo (displaying metadata found within EWF files), ewfrecover (recovering data from corrupt EWF files), ewfacquire/ewfacquirestream (creating EWF files), and ewfexport (exporting data from an EWF file). Jonathon Poling also made mention of ewfverify to verify EWF files.
    Tooling Thursday: libewf
  • Building on last weeks post on understanding DHCP, Matt looks at parsing DHCP traffic from a PCAP file using Python.
    Full Packet Friday: Parsing DHCP Traffic
  • And we’re back to Mongo! Matt setup a honeypot to capture some automatic ransom scripts and has a look at the resultant data.
    MongoDB Ransoms: Round 3
    
    
• Cheeky4n6Monkey provides an overview of Hak5’s LAN Turtle. Monkey explains how to setup the device, and then progresses to examine the artefacts it leaves behind when connected.
  Monkey Plays (LAN) Turtle
  
  
• Josh Liburdi at Sqrrl demystifies the threat hunting concepts he feels trip up practitioners.
  Demystifying Threat Hunting Concepts
  
  
• Josh also shows an example of using visualisations to assist in a hunt for malicious PowerShell activity on your network.
  Hunting for PowerShell Using Heatmaps
  
  
• Robin Brocks at Forensic Focus documents how to create a Win10 Portable Edition boot disk to use in digital forensic examinations.
  Windows 10 PE for Digital Forensics
  
  
• Adam at Hexacorn shares another persistence mechanism, this time regarding PowerShell’s PSScripts.ini. Apparently, autoruns will detect the system-specific scripts, but not the user-specific ones.
  Beyond good ol’ Run key, Part 52
  
  
• Benoit Hamelin at Arc4dia talks about detecting process hollowing through a couple of case studies.
  Process hollowing analysis for malware detection
  
  
• Anton at Have You Secured shows how to use Sysmon to detect the use of the tool Responder. He then shows how to use a PowerShell script to attempt to determine if the IP that the computer has connected to is nefarious.
  (Attempting) to Detect Responder with Sysmon
  
  
• Matt at Enigma0x3 “set out to find an alternate way of pivoting to a remote system” that doesn’t use the usual WMI/psexec/at etc. To do so he utilises a “DCOM application [MMC20.Application] and the ExecuteShellCommand method to obtain code execution on a remote host”. Apparently though Windows Firewall will detect this by default.
  Florian Roth advises that Sysmon will be of assistance in detecting child processes spawning off a main process.
  Lateral Movement Using The Mmc20.application COM Object
  

MALWARE

• The folks at ClearSky examine malicious files dropped after a spear phishing campaign by Iranian threat agent OilRig. “The entire bundle (VPN client and malware) was digitally signed with a valid code signing certificate issued by Symantec to AI Squared, a legitimate software company that develops accessibility software”.
  Iranian threat agent OilRig delivers digitally signed malware, impersonate University of Oxford
  
  
• Robert Lipovsky and Peter Kálnai report that “ESET researchers have discovered a Linux variant of the KillDisk malware”, which “renders Linux machines unbootable, after encrypting files and requesting a large ransom”. The authors then explain that the malware traverses from the root directory up to 17 subdirectories down, and encrypts files, also rendering the computer unbootable. The worst part is that the researchers determined that the keys were generated on the host, and not sent to the C&C, which means that even if you pay the malicious actors aren’t able to provide you with the decryption key.
  KillDisk now targeting Linux: Demands $250K ransom, but can’t decrypt
  
  
• Carrie Roberts at Black Hills Info Sec shows how to modify the Invoke-Mimikatz PowerShell script to avoid AV detection.
  How to Bypass Anti-Virus to Run Mimikatz
  
  
• Nicholas Griffin at Forcepoint examines two new version of the MM Core “file-less APT” malware, “which is executed in memory by a downloader component”. This malware is also Cheryl Biswas’ Catch of the Day
  MM Core In-memory Backdoor Returns As “bigboss” And “sillygoose”
  
  
• Zhouyuan Yang at Fortinet examines the recent PHPMailer vulnerability which affects versions prior to 5.2.18 and shows how to reproduce the attack.
  Analysis of PHPMailer Remote Code Execution Vulnerability (CVE-2016-10033)
  
  
• Patrick Wardle at Objective-See posted a couple of articles about malware analysis this week
  • He examines the use of document handlers on OS X as a persistence mechanism, as seen in the ‘Mac File Opener’ malware. The post covers “how an application can register to be a ‘document handler’, how the OS processes such an app to automatically register it as a handler, [and] at runtime, how such a handler is resolved, then invoked”.
    Click File, App Opens
  • He compares various Mac-based malware samples from 2016 as a preview for his RSA 2017 talk. The samples include KeRanger, Eleanor, Keydnap, Fake File Opener, Mokes, and Komplex.
    Mac Malware of 2016
    
    
• There were a couple articles of interest on the Palo Alto Networks blog
  • Dominik Reichel unpacks the latest version of the Shifu Banking Trojan.
    2016 Updates to Shifu Banking Trojan
  • Josh Grunzweig investigates the DragonOK group and lists various indicators of interest as well as C2 infrastructure that has been identified. The appendices break down the various malware/exploits used.
    DragonOK Updates Toolset and Targets Multiple Geographic Regions
    
    
• Hasherezade and Jérôme Segura at Malwarebytes Labs examine “an atypical case of Sundown EK in the wild”. “The landing page for this variant has almost no obfuscation” which is unusual. They then analysed the dropped malware, which is a cryptocurrency miner (Monero instead of BitCoin). After a bit of analysis, they were even able to find the malware on GitHub.
  The curious case of a Sundown EK variant dropping a Cryptocurrency Miner
  
  
• Adam at Hexacorn suggests that when monitoring a sandbox using Unfollow “may be quite beneficial for readability and processing purposes.” This allows an analyst to hide certain data which removes clutter from their final report.
  Enter Sandbox – part 13: Sometimes it’s better to unfollow…
  
  
• There were a couple of posts of interest on the SANS ISC Handler Diaries
  • Didier Stevens shows how to determine that an exe has been compiled with Py2Exe and can be reversed using unpy2exe.
    py2exe Decompiling – Part 1
  • John Bambenek advises that anyone looking to build their own malware lab should have a look at “Robert Simmons’ of ThreatConnect’s talk at VirusBulletin from a few months ago”.
    New Year’s Resolution: Build Your Own Malware Lab?
    
    
• Amanda at Secured.org examines a PHP web-shell she was provided.
  Just a PHP Web-Shell Sold in Dark Forums

MISCELLANEOUS

• Various people in the DFIR/InfoSec community have shared their thoughts on the Grizzly Steppe report.
  • Robert M. Lee – Critiques of the DHS/FBI’s GRIZZLY STEPPE Report
  • Andrew Morris – Reflections on Grizzly Steppe
  • Mehul Revankar – GRIZZLY STEPPE Detection with SecurityCenter
  • Jonathan Zdziarski – On NCCIC/FBI Joint Report JAR-16-20296
  • Jake Williams – The JAR did more harm than good

• Jake has also put together a survey to gather intel about how companies are using the Grizzly Steppe data. His company, Rendition Infosec, will publish the report aggregating the responses in the coming week.
  Putting science in CTI with GRIZZLY STEPPE usage
  
  
• William Ritch at WitFoo expounds the importance of having an investigative mindset in the InfoSec community. William explains that InfoSec practitioners should be doing more than just “detect and report” and draws a comparison to police detective work.
  The Importance of having an Investigative Mindset

• Kevin Breen at Tech Anarchy posted a few times this week
  • First, he provides a brief review of his 2016 achievements and lists his plans for 2017.
    Happy New Year 2017
  • Next, he shows the steps needed to allow a bootable version of Kali Linux to run on a Chromebook.
    Kali Linux on Acer Chromebook 14
  • Lastly, he will be revising his SpearPhisher web app and updating it with the lessons he’s learnt from creating VolUtility.
    Resurrecting SpearPhisher
    
    
• Chris Sanders has started a series on understanding bias. This first post explains the fundamentals of bias and “why it can negatively influence investigations”.
  Know your Bias – Foundations
  
  
• Corey Harrell returns after a short hiatus and compares his foray into gardening with guiding “a security analyst’s journey into DFIR”.
  Changing Perspectives
  
  
• Brett Shavers tackles the topic of breaking into DFIR. Many jobs have base requirements, so getting those ticked off first will probably make your life easier. If the job requires a degree, then unfortunately without one you may get overlooked. Without proper experience or training, one can turn to the various resources to expand your knowledge and prove interest and competence outside of a work environment.
  Want to know how to break into DF/IR?

• Andreas Sfakianakis at Tilting at Windmills shares his favourite DFIR presentations from 2016 along with synopses and links.
  My favorite DFIR presentations for 2016

• John Patzakis, Esq. advises that data presented in court after December 1st this year will have to abide by the new Federal Rule of Evidence 902(14), regardless of its collection date. John also summarises some of David Cohen’s key points from the webinar on the topic.
  Federal Evidence Rule 902(14) is Immediately Applicable for ESI Collections

• L3G10n at Seclist shares a tool called Kraut Salad, which is “a proof of concept implementation of a cyber threat intelligence and incident management platform”.
  Kraut Salad – A Cyber Threat Intelligence And Incident Management Platform
  
  
• Matt Seyer continues his Rust-learning journey; explaining that his current roadblock is Python bindings and requesting a mentor. If anyone knows Rust and wants to help him out, give him a shout.
  My Next Steps in Rust for DFIR
  
  
• The Blackbag Training Team advise to “store case and evidence files on different data buses” to improve performance.
  Configuring A Blacklight Case For Optimal Performance
  
  
• The Call For Papers for OPCDE 2017 is open. OPCDE is held 26th-27th April 2017 in Dubai, UAE. The CFP ends Jan 31, 2017.
  OPCDE’17 – Call For Papers
  
  
• Rich Adams at Pager Duty announces that the company has open sourced (most of – excluding proprietary/personal info) their internal IR documentation.
  Open-Sourcing Our Incident Response Documentation
  
  
• Samuel Alonso at Cyber IR has provided his commentary on the above release.
  Exploring incident response procedures with PagerDuty.
  
  
• Corey Tomlinson at Nuix has spoken to Michael Staggs and Michael Chance on the value of IoT devices to an investigation. And if the requests by LE for Amazon Echo to go by, this is only the beginning.
  The Devices Are Listening
  
  
• IntaForensics have produced a “Do’s and Don’ts of Computer Forensic Emergencies” poster.
   The Do’s and Don’ts of Computer Forensic Emergencies
  
  
• DFIR Guy at DFIR.Training has expanded his list of college DFIR programs but advises that he had to stop because it was getting unmanageable. Many programs that were there last year aren’t anymore, and new programs are popping up all the time. Unfortunately, this statement always holds true: “finding the golden nugget of good information has become a lot harder”.
  Colleges and DFIR Programs
  
  
• Scott Piper at Summit Route was kind enough to mention my site in his recent post on news summary sites. Scott writes Down Climb, a summary of the weekly infosec news, among other blogposts.
  News summaries
  

And that’s all for Week 1! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!