Open Source DFIR

I found  /usr/bin/lesspipe.sh  and  ~/.lessfilter . ⚠️ This post is in no way detailing a vulnerability or exploit . I am sharing a novel persistence mechanism that I was not aware of until recently. I am writing this post because I do not believe many defenders — SOC, DFIR and system administrators alike — know about this. Not MITRE ATT&CK nor GTFOBins.com include this level of detail in their respective repositories, either. Re-Introducing the less Command The less program, normally located at /usr/bin/less , is a well-known pager that comes prebaked in *nix operating systems. The less program allows a user to view a file via mouse scroll, to regex search, and even list the contents of compressed archives. We’ll talk more about that last part later. Recently I was perusing my environment variables (envar) on my Linux-based system and found this “.sh” file that was just screaming for me to investigate further. env ...skipping LESSOPEN=||/usr/bin/lesspipe.sh %s PAG...

What is GRR? GRR Rapid Response (or GRR) is an incident response framework focused on remote live forensics. It is a tool that communicates with its deployed endpoint agents to collect and deliver forensics artifacts to an incident responder for analysis from one machine or thousands. This article assumes you’re already familiar with using GRR in a production environment. GRR is GRReat! But... GRR is a beneficial tool to have available, but it does have some limitations: Browsing the Virtual File System (VFS) In the Web UI can be time consuming for in-depth analysis. Upon browsing to a directory, a new ListDirectory flow is launched, and the operator must wait for that flow to complete before continuing. For repeated directory navigations, this time adds up. Finding a file of an unknown location requires a ClientFileFinder flow. The exact syntax can be challenging to remember, resulting in needing to check the documentation frequently. Launching artifact collection flows is located...

  Many of the concepts and the definitions mentioned in this blog post are referenced from [Brian (2005)] File System Forensic Analysis and libfsntfs documentation by Joachim Metz.   If you’re new to Digital Forensics a first question you might be asking is: why do I need to learn how file systems work as a digital forensics analyst? And how much do I need to know about it? Why do we need File System Forensics? Let’s answer that question starting with a very simple definition of digital forensics. Digital forensics is typically used to determine what happened after the fact. Throughout a digital forensics investigation this question will very likely be broken down to multiple smaller questions. For example an analyst might start their investigation with an alert from a network based intrusion detection system, warning them that a certain host in their network is communicating with a malicious domain attributed to an active threat group, known to be targeting their industry. ...