Windows Incident Response: Live Forensics, Memory Analysis con Volatility e Artefatti NTFS

🧰 Materiali necessari

• Forensic workstation Windows con tool installed
• Volatility 3 framework
• Eric Zimmerman tools suite (MFTECmd, EvtxECmd, RECmd, AmcacheParser, PECmd, SrumECmd)
• KAPE per artifact collection
• Magnet RAM Capture per memory acquisition
• DumpIt come alternative
• Sysinternals Suite (Process Explorer, Autoruns, TCPView)
• RegRipper per registry parsing
• Hayabusa per EVTX threat hunting
• Chainsaw per Sigma rule on EVTX
• BrowsingHistoryView (NirSoft)
• Timeline Explorer (Eric Zimmerman)
• PyWMIPersistenceFinder per WMI
• External USB ad alta capacita per evidence
• Lab Windows VM con Sysmon installed

📋 Passi

1. 1
   Setup forensic workstation e lab Windows
   {"step":1,"title":"Setup forensic workstation e lab Windows","description":"Configura forensic workstation Windows con tools: Volatility 3, Eric Zimmerman tools (MFTECmd, EvtxECmd, RECmd, AmcacheParser, PECmd, SrumECmd), KAPE, Sysinternals suite, Hayabusa, Chainsaw, RegRipper. Lab target: Windows 10\/11 VM con Sysmon installed e SwiftOnSecurity config. Crea scenario incident: simula compromise con execute Mimikatz (credential dump), drop webshell, stabilisci persistence via Run key e scheduled task. Snapshot pre-incident per ground truth comparison durante analisi."}
2. 2
   Triage iniziale e collection con KAPE
   {"step":2,"title":"Triage iniziale e collection con KAPE","description":"Su target machine compromessa eseguire triage. Connetti USB esterno con tool. Run KAPE in collection mode: kape.exe --tsource C: --target KapeTriage --tdest E:KAPEOutput. Collection time tipicamente 15-30 minuti per workstation. Output strutturato per artifact category: registry hives, event logs, prefetch, web browser, etc. Hash output con sha256. Documenta collection: time, examiner, target machine name, hash. Trasferisci a forensic workstation per analysis preservando chain of custody."}
3. 3
   Memory acquisition Windows con Magnet RAM Capture
   {"step":3,"title":"Memory acquisition Windows con Magnet RAM Capture","description":"Usa Magnet RAM Capture (free download da Magnet Forensics). Single-button acquisition: launch tool, specifica output path su external USB, click capture. Tempo 5-15 minuti dipendente da RAM size. Alternativa DumpIt: DumpIt.exe scrive nella current directory. Verifica output: file .raw o .dmp, dimensione approssimativa uguale a system RAM. Hash: certutil -hashfile memory.raw SHA256. Documenta: tool version, acquisition timestamp, target system, hash. Trasferisci a forensic workstation e verifica hash match post-transfer."}
4. 4
   Volatility 3 analysis processi Windows
   {"step":4,"title":"Volatility 3 analysis processi Windows","description":"Su forensic workstation: vol -f memory.raw windows.pslist.PsList mostra process. Esamina PID, PPID, name, user, start time. vol -f memory.raw windows.pstree.PsTree mostra hierarchy. Identifica anomalia: cmd.exe child di w3wp.exe (IIS worker) suggerisce webshell, powershell.exe child di winword.exe suggerisce macro execution. vol -f memory.raw windows.cmdline.CmdLine mostra full command line: encoded PowerShell, suspicious arguments. vol -f memory.raw windows.psscan.PsScan trova terminated process nascosti da rootkit."}
5. 5
   Detection DLL injection e codice malevolo in memory
   {"step":5,"title":"Detection DLL injection e codice malevolo in memory","description":"Plugin windows.malfind.Malfind rileva suspicious memory region (executable e writable simultaneamente). Output: process, virtual address, protection, hex dump. Esamina hex: MZ header indica PE iniettato. Plugin windows.dlllist.DllList mostra DLLs loaded per process: DLL inusuale in legitimate process e suspicious. Plugin windows.handles.Handles mostra handle table. Estrai injected code: windows.dumpfiles --pid PID --virtaddr ADDRESS. Static analysis follow-up con Detect It Easy o x64dbg per identification."}
6. 6
   Network analysis da memory dump
   {"step":6,"title":"Network analysis da memory dump","description":"Plugin windows.netscan.NetScan lista network connection. Esamina: stato ESTABLISHED verso external IP da internal workstation, beacon pattern (connessione regolare ogni N secondi), unusual local listening port. Identifica process associato. Connessione da svchost verso C2 IP: malware likely. Connessione da powershell.exe verso external: PowerShell-based malware. Plugin windows.cachedump.Cachedump estrae cached credential dalla LSASS memory region per identificare credential theft."}
7. 7
   MFT analysis con MFTECmd
   {"step":7,"title":"MFT analysis con MFTECmd","description":"Da KAPE output estrai MFT file (C $MFT). Parse: MFTECmd.exe -f MFT --csv outputdir --csvf MFT.csv. Output enorme CSV con ogni file record. Apri in Timeline Explorer (companion tool) per filtering e visualization. Filtra per timestamp: incident window. Esamina recently created file in unusual location (C:Users Public, C:Windows Temp, C:ProgramData hidden directory). Cerca executable con nome random, file eliminati con inode ancora visibile. Cross-reference filename con threat intelligence per known malware."}
8. 8
   Registry forensic con RegRipper
   {"step":8,"title":"Registry forensic con RegRipper","description":"KAPE colleziona registry hives. Parse con RegRipper: rip.exe -r SYSTEM -p services > services.txt estrae service entries. rip.exe -r SOFTWARE -p run estrae Run keys. rip.exe -r NTUSER.DAT -p userassist estrae user activity. Per Run key: esamina ogni entry, legitimate (vendor known) vs unknown. UserAssist traccia executable launched da user con timestamp: evidence che utente ha avviato specifico .exe. ShellBags traccia folder accessibili via Explorer: mostra path che attacker ha navigato."}
9. 9
   Persistence enumeration scheduled task e WMI
   {"step":9,"title":"Persistence enumeration scheduled task e WMI","description":"KAPE colleziona scheduled task XML files (C Windows System32 Tasks). Esamina manualmente XML: cerca task con suspicious Action (encoded PowerShell, dropper executable), Trigger (logon, time interval), flag hidden true. WMI persistence: parse OBJECTS.DATA da C Windows System32 wbem Repository. Tool PyWMIPersistenceFinder.py automatizza ricerca. Output: __EventConsumer, __EventFilter, __FilterToConsumerBinding triple identifica persistence WMI subscriptions."}
10. 10
    Prefetch e execution evidence
    {"step":10,"title":"Prefetch e execution evidence","description":"Parse Prefetch con PECmd: PECmd.exe -d C:WindowsPrefetch --csv outputdir. Output: executable name, last 8 run times, run count, file accessed durante execution. Critical timeline information: malware Prefetch presente prova execution anche se binario poi eliminato. File path accessed puo rivelare C2 config file, dropped payload. AmCache parse: AmcacheParser.exe -f Amcache.hve --csv outputdir fornisce additional execution evidence con SHA1 hash per cross-reference con VirusTotal."}
11. 11
    Event log analysis Sysmon e Security
    {"step":11,"title":"Event log analysis Sysmon e Security","description":"Parse Security log con EvtxECmd: EvtxECmd.exe -f Security.evtx --csv outputdir. Filtra event 4624 successful logon: identifica lateral movement (LogonType 3 network, 10 RDP). Event 4688 process creation con full command line se audit abilitato. Event 1102 indica log cleared (anti-forensic indicator da investigare). Sysmon log parsato similmente: Event 1 process creation con command line e parent process, Event 3 network connection. Tool Chainsaw applica Sigma rules a EVTX: rileva known malicious pattern automaticamente."}
12. 12
    Volume Shadow Copy investigation
    {"step":12,"title":"Volume Shadow Copy investigation","description":"Verifica VSS disponibile: vssadmin list shadows da command prompt. Se VSS disponibile, monta shadow per browsare versioni precedenti tramite Shadow Explorer GUI tool. Confronta current files vs shadow: identifica malware files NON nel shadow (deployati post-snapshot), legitimate file modificati post-snapshot. Recupera file eliminati da shadow: documento legittimo e malware encrypted file recuperabili se shadow e precedente a encryption. Documenta VSS state: numero snapshot, date, dimensioni come evidence critica."}
13. 13
    Browser artifact e phishing investigation
    {"step":13,"title":"Browser artifact e phishing investigation","description":"Parse Chrome history: apri Chrome History file (C Users USER AppData Local Google Chrome User Data Default History) con DB Browser for SQLite. Tabelle: urls, downloads, visits. Filtra timestamp incident window. Identifica phishing URL visitato (confronta con dominio allegato email). Downloads table mostra file scaricato da utente: origine malware. Browser cache puo contenere screenshot della phishing page. Cross-reference download timestamp con MFT creation time di malware per confermare attack vector."}
14. 14
    Lateral movement evidence reconstruction
    {"step":14,"title":"Lateral movement evidence reconstruction","description":"Identifica lateral movement cronologicamente. Da event log Security 4624 Logon Type 3 (network) o 10 (RDP): quale user ha loggato da dove verso dove. PsExec evidence: Event 5145 share access ADMIN$, Event 7045 service installed (PsExec crea remote service). WMI lateral: WMI-Activity Operational log mostra remote WMI invocation. Costruisci timeline lateral movement: workstation A ore 09:30 attacker initial access, 10:15 lateral verso server B via PsExec, 10:45 Mimikatz execution, 11:00 lateral verso DC. Visualizza con timeline tool."}
15. 15
    Report finale e remediation guidance
    {"step":15,"title":"Report finale e remediation guidance","description":"Struttura final report: Executive Summary (high level impact, business context), Incident Timeline (sequenza cronologica degli eventi), Initial Access Vector (come attacker e entrato), Persistence Mechanisms (come attacker rimane), Lateral Movement (spreading nel network), Data Impact (cosa ha acceduto e esportato), Recommendations (immediate containment, eradication, long-term improvement). Includi screenshot evidence, hash table IOC, attack chain diagram. Remediation: isola host compromessi, ruota credential toccate da attacker specialmente Domain Admin, patcha vulnerabilita sfruttate."}