Open Source DFIR

I found  /usr/bin/lesspipe.sh  and  ~/.lessfilter . ⚠️ This post is in no way detailing a vulnerability or exploit . I am sharing a novel persistence mechanism that I was not aware of until recently. I am writing this post because I do not believe many defenders — SOC, DFIR and system administrators alike — know about this. Not MITRE ATT&CK nor GTFOBins.com include this level of detail in their respective repositories, either. Re-Introducing the less Command The less program, normally located at /usr/bin/less , is a well-known pager that comes prebaked in *nix operating systems. The less program allows a user to view a file via mouse scroll, to regex search, and even list the contents of compressed archives. We’ll talk more about that last part later. Recently I was perusing my environment variables (envar) on my Linux-based system and found this “.sh” file that was just screaming for me to investigate further. env ...skipping LESSOPEN=||/usr/bin/lesspipe.sh %s PAG...

  Introduction There are billions of billions of SQLite instances in the world (ref: https://www.sqlite.org/mostdeployed.html ), and many examples can be found on virtually every active phone, laptop or workstation. In this blog post we will discuss a method by which investigators can perform a search of SQLite database files using GRR Rapid Response (GRR), osquery and dfTimewolf.  We assume the reader has an understanding of these tools. What is GRR? GRR is an incident response framework focused on remote live digital forensic analysis. GRR was built to run at scale so that analysts are capable of effectively collecting and processing data from large numbers of machines concurrently. It achieves this through flows (asynchronous calls to execute client code and retrieve results from a single machine) and hunts (flows scheduled to run on many machines).  What is Osquery? Osquery is an open source tool that exposes an operating system as a query-able interface like SQL for ...