Table Of ContentNetwork Intrusion Analysis, ISBN 978-1-59749-962-0. Trim 191mmx235mm Spine 10.7mm
N I A
ETWORK NTRUSION NALYSIS
S S S®
Y Y S
Methodologies, Tools, and Techniques for Incident N N E
G G R N I
Analysis and Response ETWORK NTRUSION
R R G
E E N
S S Y
A
Learn the hands-on methodologies, tools, and techniques for network intrusion analysis and response. S S S NALYSIS
®
®
“Not only does this book teach you about network • Provides real-world examples of network
Methodologies, Tools, and Techniques for Incident
intrusion analysis, it also gives you knowledge of how intrusions, along with associated workarounds
intrusions are performed. This inside information N
• Walks you through the methodology and Analysis and Response
helps give you a better picture of what’s really going E
practical steps needed to conduct a thorough T
on when you are investigating a compromise.” W
intrusion investigation and incident response,
– DERRICK ROUNTREE, CISSP, CASP, MCSE including a wealth of practical, hands-on tools O
R
for incident assessment and mitigation K
Nearly every business depends on its network
to provide information services and to carry out Joe Fichera is a Sr. Consultant for a global forensic IN
essential activities, and network intrusion attacks corporation. He is a former computer forensic leader, T
R
have been growing increasingly frequent and severe. instructor and curriculum developer for the Defense U
When network intrusions do occur, it’s imperative Cyber Investigations Training Academy. He holds the S
I
that a thorough and systematic analysis and following certifications: CISSP, EnCE, EnCEP, CCE, ACE, O
N
investigation of the attack is conducted to determine CTT+, SCNS, A+, Network+, and MCP.
A
the nature of the threat and the extent of information
Steven Bolt is currently a Sr. Incident Response
N
lost, stolen, or damaged during the attack. A
and Forensics Team Leader for a global corporation. A
thorough and timely investigation and response can Previously he worked as a Security Operations Center L
Y
serve to minimize network downtime and ensure
Manager and as a Computer Forensics Leader, S
that critical business systems are maintained in full Instructor and course developer at the Defense Cyber IS
operation.
Investigations Training Academy. He holds several
industry certifications, including CISSP, CCE, EnCE,
Network Intrusion Analysis teaches the reader
ACE, CHFI and CEH.
about the various tools and techniques to use during
a network intrusion investigation. The book focuses
on the methodology of an attack as well as the
investigative methodology, challenges, and concerns. Joe Fichera
This is the first book that provides such a thorough
Steven Bolt
analysis of network intrusion investigation and
response.
Derrick Rountree, Technical Editor
• Provides a step-by-step guide to the tools
and techniques used in the analysis and
investigation of a network intrusion NETWORKS
ISBN 978-1-59749-962-0 Joe Fichera
54995
Steven Bolt
www.syngress.com 9 781597 499620 FICHERA
BOLT
Network Intrusion
Analysis
Methodologies, Tools, and
Techniques for Incident
Analysis and Response
This page is intentionally left blank
Network Intrusion
Analysis
Methodologies, Tools, and
Techniques for Incident
Analysis and Response
Joe Fichera
Steven Bolt
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Syngress is an Imprint of Elsevier
Acquiring Editor: Chris Katsaropoulos
Development Editor: Meagan White
Project Manager: Priya Kumaraguruparan
Designer: Joanne Blank
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
Copyright © 2013 Elsevier, Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying, recording, or any information storage and
retrieval system, without permission in writing from the publisher. Details on how to seek
permission, further information about the Publisher’s permissions policies and our arrange-
ments with organizations such as the Copyright Clearance Center and the Copyright Licensing
Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the
Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experi-
ence broaden our understanding, changes in research methods or professional practices, may
become necessary. Practitioners and researchers must always rely on their own experience and
knowledge in evaluating and using any information or methods described herein. In using such
information or methods they should be mindful of their own safety and the safety of others,
including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors,
assume any liability for any injury and/or damage to persons or property as a matter of p roducts
liability, negligence or otherwise, or from any use or operation of any methods, products,
instructions, or ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Application Submitted
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
ISBN: 978-1-59749-962-0
Printed in the United States of America
13 14 15 10 9 8 7 6 5 4 3 2 1
For information on all Syngress publications visit our website at www.syngress.com
Oriyano
Acknowledgement
This book would not have been possible without the love and support from
our families. It goes without saying that they are our inspiration for everything
we do. We would not be where we are today in our careers without them.
We also need to thank all the people we have worked with in the past. There
is not a single one who we have not learned something from. We have
encountered countless talented people in this industry and they should all be
applauded for their hard work and dedication. We have yet to meet someone
in this line of business that is no longer striving to learn more or enhance their
own skillset. This even holds true for the former inhabitants of “the cave”.
v
This page is intentionally left blank
Contents
Acknowledgement ....................................................................................v
Preface ................................................................................................xi
Chapter 1 Introduction ............................................................................1
Introducing Network Intrusion Analysis ........................................1
Chapter 2 Intrusion Methodologies and Artifacts ................................5
Stage 1: Pre-Intrusion Actions: AKA Reconnaissance .................5
Stage 2: Intrusion Methods .............................................................6
Phase 1: Pre-Intrusion Actions, Active ....................................10
Phase 2: Attack ..........................................................................12
Phase 3: Maintaining Access/Entrenchment ..........................16
References ......................................................................................32
Chapter 3 Incident Response ...............................................................33
Introduction ....................................................................................33
Section 1: Methodology .................................................................34
Trusted Toolset ..............................................................................35
Commercial Triage Tools ...............................................................37
US-LATT Configuration .............................................................44
Witness Devices .........................................................................49
Section 2: Memory Acquisition .....................................................50
Introduction ....................................................................................51
Acquisition ......................................................................................52
Mdd_1.3.Exe ...................................................................................52
Usage ...............................................................................................53
Win32dd ..........................................................................................55
Sample Syntax for Win32dd: .....................................................57
FTK Imager .....................................................................................59
Memoryze ...................................................................................64
Conclusion ......................................................................................69
References ......................................................................................70
vii
viii Contents
Chapter 4 Volatile Data Analysis .........................................................71
Introduction ....................................................................................71
What is Volatile Data? ....................................................................72
What is Non-Volatile Data? ...........................................................72
Section 1: Collection Tools ............................................................72
Commercial Triage Tools ...............................................................81
EnCase Portable, Guidance Software, Inc. ..................................81
US-LATT, WetStone Technologies, Inc. ........................................85
Section 2: Memory Analysis ..........................................................88
Introduction ................................................................................88
RAM Analysis .................................................................................89
Data Carving Tools and Techniques ........................................95
Disk Digger .................................................................................95
GetDataBack for NTFS and FAT ...............................................97
Mandiant’s Redline ..................................................................106
HBGary Responder Community Edition ................................110
References ....................................................................................117
Chapter 5 Network Analysis ..............................................................119
Introduction ..................................................................................119
Methodology .................................................................................120
Network Traffic .............................................................................120
Snort ..............................................................................................121
Packet Analysis Tools ..................................................................123
Wireshark ......................................................................................123
Analyzing Data with Wireshark ..................................................127
Netwitness Investigator ..............................................................131
Analyzing Data with Netwitness ................................................132
Collection Summary .................................................................133
Filtering.....................................................................................133
Rules ..........................................................................................133
Drilling ......................................................................................134
Custom Drill ..............................................................................135
Intellisense ...............................................................................135
Report Icon ...............................................................................135
Options ......................................................................................136
Report Value .............................................................................136
Session List ...............................................................................136
Breadcrumbs ............................................................................136
Searching ..................................................................................136
Accessing the Search Function ...............................................137
Simple Search Window ............................................................137
Contents ix
Advanced Search Window ......................................................137
Search Preferences ...................................................................137
Simple Search ...........................................................................137
Advanced Search .....................................................................139
Exporting Sessions ..................................................................139
Log Analysis .................................................................................141
Witness Devices ...........................................................................147
Viewing, Acquiring, Triaging Devices over the
Network ........................................................................................149
EnCase CyberSecurity [1] ............................................................150
References ....................................................................................151
Chapter 6 Host Analysis .....................................................................153
Introduction ..................................................................................153
Methodology .................................................................................153
Host Based Analysis ................................................................153
Hash Analysis...........................................................................154
Malware Scanning ...................................................................154
Signature Analysis ...................................................................154
Alternate Data Streams ...........................................................154
AutoRun Locations ..................................................................158
Log Files....................................................................................159
Windows Event Logs ...............................................................159
Schedule Task Logs .................................................................163
Antivirus Logs ..........................................................................163
$MFT .........................................................................................163
Deleted Files .............................................................................164
Attacker Created Directories ..................................................165
Prefetch Directory and Included Prefetch Files .....................165
References ....................................................................................167
Chapter 7 Malware Analysis ..............................................................169
Introduction ..................................................................................169
Malware Sandbox Creation .........................................................170
Downloading and Configuring the Required Virtualized
Machines...................................................................................170
Configure of the Virtual Machines to Add Additional
Protections From Infection ......................................................179
Installation and Configuration of Analysis
Applications..............................................................................180
System Monitoring ...................................................................182
Code Analysis Applications ....................................................185
