DFIR & automation

Forensics
1

@dave @mike.mitchell
Which DFIR steps have you automated?

2

There are several steps you can automate during the DFIR process, but there are still some processes that are typically done in a manual fashion. Some of the more routine steps that I will automate include:

  1. Ingesting the Alerts
  2. Enriching the data using threat intel sources
  3. Gather host/user information
    *4) Gather process and memory dumps from the affect host
  4. Notifying stakeholders of the incident
  5. Open/Update/Close tickets centered around incident
  • Automating the retrieval of process and memory dumps can be achieved using third party EDR solutions or using the community sourced Powershell scripts. However, running analysis of those dumps is typically done be an analyst with some reverse engineering background.
2 Likes
3

@mike.mitchell and @john.grigg provided a three part blog series on the topic that provides a step-by-step overview of doing so with Powershell and Swimlane:
Enhance the DFIR Process with Powershell and Swimlane – Part 1
Enhance the DFIR Process with Powershell and Swimlane – Part 2
Enhance the DFIR Process with Powershell and Swimlane – Part 3

1 Like
4

@mike.mitchell

Where can I find community-sourced Powershell scripts?

5

Here are a few scripts on Github that are widely used…

PS Recon:

Powershell Empire

Kansa:

A really good article about Live Response from SANS:
https://www.sans.org/reading-room/whitepapers/forensics/live-response-powershell-34302