noorqureshi/security-skills/defense-forensics

Deep forensic artifact analysis

When it applies

Triage (defense-dfir-triage) has scoped the incident and you now hold preserved evidence — a memory dump, a disk image (E01/raw), a PCAP, or exported host artifacts — and must prove, artifact by artifact, what the attacker did: which process ran, what persisted, what left the network. This is deep analysis of dead-box/dead-disk evidence, not live first response.

Why it works

Attackers can delete logs, but memory, filesystem metadata ($MFT, USN journal), and packet captures retain artifacts the attacker never controlled. Parsing them with purpose-built tools reconstructs execution, persistence, and exfiltration even after the live system was cleaned — and hashing plus chain of custody makes the conclusions defensible.

Method

1. Preserve before you parse. SHA-256 every image/capture, record timezone + acquisition

command, work on a copy with the original read-only. Write chain-of-custody notes into your timeline as you go — every conclusion must trace back to an artifact path.

1. Memory (Volatility 3) — situational awareness first, then chase anomalies:

``bash vol -f mem.dmp windows.info # OS profile, build, timezone vol -f mem.dmp windows.pslist # processes — unknown names, odd parents vol -f mem.dmp windows.netscan # connections — beacons, lateral SMB/RDP vol -f mem.dmp windows.cmdline # full command lines ` Follow with windows.malfind (injected code) and dlllist/handles on suspects; dump a suspicious PID (--pid <pid> --dump) for defense-malware-triage / reverse-eng-malware`.

1. Disk & super-timeline — run Plaso (log2timeline.py) over the image and filter around

the known-bad window in Timeline Explorer; correlate $MFT, USN journal, Shimcache, Amcache, and Prefetch into one ordered view. Autopsy / FTK Imager for carving and deleted files.

1. Windows host artifacts (Eric Zimmerman's toolset) — the execution/persistence core:

• Execution: Amcache, Prefetch, BAM, Shimcache.
• Persistence: Run keys, services, scheduled tasks, WMI subscriptions.
• Logs: Security, PowerShell 4104 script-block, Sysmon — feed defense-log-analysis.

1. Network (PCAP) — tshark conversation/protocol/DNS statistics first, then carve

suspicious streams and export objects. Custom protocol payloads → reverse-eng-protocol; C2 implants → defense-malware-triage.

1. Hand off — extract IOCs with confidence + provenance, map to ATT&CK, feed detections to

defense-detection-sigma, and run reporting-evidence-review before the incident report.

Gotchas

• Never analyze the original — one mount without a write blocker and the evidence is

challengeable. Hash first, analyze a copy, re-hash after to prove nothing changed.

• Timezone skew kills timelines — Volatility, Plaso, and event logs each default

differently; normalize everything to UTC before correlating.

• Wrong Volatility profile = garbage output — confirm windows.info before trusting

pslist. Linux/macOS dumps need symbol tables (ISF) built for that exact kernel.

• Prefetch proves execution happened, not who ran it — corroborate with logs/accounts.
• Absent artifact ≠ absent activity — log clearing and timestomping are themselves

findings; record gaps explicitly instead of reading them as "clean".

• Raw IOCs can tip the attacker or leak victim data — grade and redact before sharing.

Verify success

A reviewable timeline (Time | Host | Artifact | Finding | Confidence | Evidence path) where every claim names the artifact that proves it, before/after analysis hashes match, and IOCs + ATT&CK mapping are ready for detection engineering and reporting.

References

Volatility 3 docs; Plaso/log2timeline; Eric Zimmerman's tools; SANS DFIR posters; NIST SP 800-86.

_Portions adapted from reverse-skill by zhaoxuya520, MIT License._