Cheatsheet V2.4.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
! ! 2.4!Edition! Cross!reference!processes!with!various!lists:! Scan!a!block!of!code!in!process!or!kernel!memory! psxview! for!imported!APIs:! ! impscan!! Show!processes!in!parent/child!tree:! !!!!Hp/HHpid=PID!!!!!!!!!Process!ID!! pstree! !!!!Hb/HHbase=BASE!!!Base!address!to!scan! & !!!!Hs/HHsize=SIZE!!!!!!!Size!to!scan!from!start!of!base! Process&Information& ! ! Logs&/&Histories& Specify!–o/HHoffset=OFFSET!or!Hp/HHpid=1,2,3!! ! ! Recover!event!logs!(XP/2003):! Display!DLLs:! evtlogs!! ! ! dlllist! !!!!HS/HHsaveHevt!!!!!!!!!!!!!!!!!!!!Save!raw!event!logs! Development!build!and!wiki:! ! !!!!HD/HHdumpHdir=PATH!!!Write!to!this!directory! github.com/volatilityfoundation!! Show!command!line!arguments:! ! ! cmdline! Recover!command!history:! Download!a!stable!release:! ! cmdscan!and!consoles!! volatilityfoundation.org!! Display!details!on!VAD!allocations:! ! ! vadinfo![HHaddr]! Recover!IE!cache/Internet!history:! Read!the!book:! ! iehistory!! artofmemoryforensics.com! Dump!allocations!to!individual!files:! ! ! vaddump!HHdumpHdir=PATH![HHbase]! Show!running!services:! Development!Team!Blog:! ! svcscan!! http://volatilityHlabs.blogspot.com!! Dump!all!valid!pages!to!a!single!file:! !!!!Hv/HHverbose!!!!Show!ServiceDll!from!registry! ! memdump!HHdumpHdir=PATH! ! (Official)!Training!Contact:! ! Networking&Information& Display!open!handles:! [email protected]!! ! handles!! ! Active!info!(XP/2003):! !!!!Ht/HHobjectHtype=TYPE!!!Mutant,!File,!Key,!etc…! Follow:!@volatility! connections!and!sockets!! !!!!Hs/HHsilent!!!!!!!!!!!!!!!!!!!!!!!!!!!Hide!unnamed!handles! Learn:!www.memoryanalysis.net!! ! ! ! Scan!for!residual!info!(XP/2003):! Display!privileges:! connscan!and!sockscan! Basic&Usage& privs!! ! ! !!!!Hr/HHregex=REGEX!!!!!!!!!!!Regex!privilege!name! Network!info!for!Vista,!2008,!and!7:& Typical!command!components:!! !!!!Hs/HHsilent!!!!!!!!!!!!!!!!!!!!!!!!!!!Explicitly!enabled!only! netscan! #!vol.py!Hf![image]!HHprofile=[profile]![plugin]! ! ! ! Display!SIDs:! Display!profiles,!address!spaces,!plugins:! getsids! Kernel&Memory& #!vol.py!HHinfo! ! ! ! Display!environment!variables:! Display!loaded!kernel!modules:! Display!global!commandHline!options:! envars! modules! #!vol.py!HHhelp! ! !& ! PE&File&Extraction& Scan!for!hidden!or!residual!modules:! Display!pluginHspecific!arguments:! modscan! ! #!vol.py![plugin]!HHhelp! ! Specify!HD/HHdumpHdir!to!any!of!these!plugins!to! ! Display!recently!unloaded!modules:& identify!your!desired!output!directory.!! Load!plugins!from!an!external!directory:! unloadedmodules! ! #!vol.py!HHplugins=[path]![plugin]!! ! Dump!a!kernel!module:! ! Display!timers!and!associated!DPCs:& moddump!! Specify!a!DTB!or!KDBG!address:! timers!! !!!!Hr/HHregex=REGEX!!!Regex!module!name!! #!vol.py!HHdtb=[addr]!HHkdbg=[addr]! ! !!!!Hb/HHbase=BASE!!!!!!!Module!base!address!! ! Display!kernel!callbacks,!notification!routines:! ! Specify!an!output!file:! callbacks!! Dump!a!process:! #!vol.py!HHoutputHfile=[file]! !! procdump!! Audit!the!SSDT!& ! !!!!Hm/HHmemory!!!!!!!!!!!Include!memory!slack! ssdt!! ! Image&Identification& !!!!Hv/HHverbose!!!!Check!for!inline!API!hooks! Dump!DLLs!in!process!memory:! & ! dlldump!! Get!profile!suggestions!(OS!and!architecture):! Audit!the!IDT!and!GDT:! !!!!Hr/HHregex=REGEX!!!Regex!module!name!! imageinfo!! idt!(x86!only)! !!!!Hb/HHbase=BASE!!!!!!!Module!base!address!! & gdt!(x86!only)! & Find!and!parse!the!debugger!data!block:! ! kdbgscan! Injected&Code& Audit!driver!dispatch!(IRP)!tables:& ! ! driverirp!! Processes&Listings& Specify!–o/HHoffset=OFFSET!or!Hp/HHpid=1,2,3! !!!!Hr/HHregex=REGEX!!!Regex!driver!name! ! ! ! Basic!active!process!listing:! Find!and!extract!injected!code!blocks:! Display!device!tree!(find!stacked!drivers):! pslist! malfind!! devicetree! ! !!!!HD/HHdumpHdir=PATH!!!!Dump!findings!here!! ! Scan!for!hidden!or!terminated!processes:! ! Print!kernel!pool!tag!usage!stats:! psscan! CrossHreference!DLLs!with!memory!mapped!files:! pooltracker! ! ldrmodules! !!!!!!Ht/HHtags=TAGS!!!!!!!List!of!tags!to!analyze! ! ! !!!!!!HT/HHtagfile=FILE!!!pooltag.txt!for!labels! Copyright!©!2014!The!Volatility!Foundation! ! ! 2.4!Edition! Kernel&Objects& Display!a!type/structure:! Dump!the!contents!of!the!clipboard:! >>>!dt(“_EPROCESS”,!recursive!=!True)! clipboard! ! ! ! Scan!for!driver!objects:! Display!a!type/structure!instance:! Detect!message!hooks!(keyloggers):! driverscan! >>>!dt(“_EPROCESS”,! 0x820c92a0)! messagehooks! ! ! ! ! Scan!for!mutexes:! Create!an!object!in!kernel!space:! Take!a!screen!shot!from!the!memory!dump:! mutantscan!! >>>!thread!=!obj.Object(“_ETHREAD”,!offset!=! screenshot!HHdumpHdir=PATH! !!!!Hs/HHsilent!!!!!Hide!unnamed!mutants! ! 0x820c92a0,!vm!=!addrspace())& ! ! & Display!visible!and!hidden!windows:! Scan!for!used/historical!file!objects:! windows!and!wintree! filescan! Dump&Conversion& ! ! ! Scan!for!symbolic!link!objects!(shows!drive! Create!a!raw!memory!dump!from!a!hibernation,! Strings& mappings):& crash!dump,!firewire!acquisition,!virtualbox,! ! symlinkscan! vmware!snapshot,!hpak,!or!EWF!file:! Use!GNU!strings!or!Sysinternals!strings.exe:& ! imagecopy!–O/HHoutputHimage=FILE! strings!Ha!Htd!FILE!>!strings.txt!! ! Registry& strings!Ha!Htd!Hel!FILE!>>!strings.txt!(Unicode)! Convert!any!of!the!aforementioned!file!types!to!a! ! ! Windows!crash!dump!compatible!with!Windbg:! Display!cached!hives:& strings.exe!Hq!Ho!>!strings.txt!(Windows)! raw2dmp!–O/HHoutputHimage=FILE! hivelist! ! & ! Translate!the!string!addresses:! Print!a!key’s!values!and!data:& API&Hooks&& strings! printkey!! ! !!!!Hs/HHstringHfile=FILE!!!!Input!strings.txt!file! !!!Ho/HHhive_offset=OFFSET!!!Hive!address!(virtual)! Scan!for!API!hooks:! !!!!HS/HHscan!! !!!HK/HHkey=KEY!!!!!!!!!!!!!!!!!!!!!!!!!Key!path!! apihooks!! ! ! !!!!HR/HHskipHkernel!!!!!!!!Don’t!check!kernel!modules! Password&Recovery& Dump!userassist!data:! !!!!HP/HHskipHprocess!!!!!!Don’t!check!processes!! userassist! !!!!HQ/HHquick!!!!!!!!!!!!!!!!!!!!Scan!faster!! & ! ! Dump!LSA!secrets:! Dump!shellbags!information:! Yara&Scanning&& lsadump!! shellbags! ! ! ! Dump!cached!domain!hashes:! Scan!for!Yara!signatures:! Dump!the!shimcache:! cachedump!! yarascan!! shimcache! !!!!Hp/HHpid=PID!!!!!!!!!!!!!!!!!!!!!!!Process!IDs!to!scan!! ! ! !!!!HK/HHkernel!!!!!!!!!!!!!!!!!!!!!!!!!!Scan!kernel!memory! Dump!LM!and!NTLM!hashes:! Timelines& !!!!HY/HHyaraHrules=RULES!!!String,!regex,!bytes,!etc.! hashdump!(x86!only)! & !!!!Hy/HHyaraHfile=FILE!!!!!!!!!!!Yara!rules!file!! ! !!!!HW/HHwide!!!!!!!!!!!!!!!!!!!!!!!!!!!Match!Unicode!strings! Extract!OpenVPN!credentials:! To!create!a!timeline,!create!output!in!body!file! !!!!Hs/HHsize!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Size!of!preview!bytes! openvpn!(github.com/Phaeilo)! format.!Combine!the!data!and!run!sleuthkit’s! ! mactime!to!create!a!CSV!file.! ! ! File&System&Resources& Extract!RSA!private!keys!and!certificates:! timeliner!HHoutput=body!>!time.txt! ! dumpcerts! shellbags!HHoutput=body!>>!time.txt!! Scan!for!MFT!records:! !!!!Hs/HHssl!!!!!!!Parse!certificates!with!openssl!! mftparser!HHoutput=body!>>!time.txt! mftparser!! ! ! !!!!HHoutput=body!!!!Output!body!format! Disk&Encryption&& !!!!HD/HHdumpHdir!!!!Dump!MFTHresident!data!! mactime!–b![time.txt]![Hd]!>!csv.txt! ! ! & Extract!cached!files!(registry!hives,!executables):! Recover!cached!TrueCrypt!passphrases:! Volshell& dumpfiles!! truecryptpassphrase!! ! !!!!HD/HHdumpHdir=PATH!!!!!!!Output!directory!! ! List!processes:! !!!!Hr/HHregex=REGEX!!!!!!!!!!!!!Regex!filename!! Triage!TrueCrypt!artifacts:! >>>!ps()! ! truecryptsummary! ! Parse!USN!journal!records:! ! Switch!contexts!by!pid,!offset,!or!name:! usnparser!(github.com/tomspencer)! Extract!TrueCrypt!master!keys! >>>!cc(pid!=!3028)! & truecryptmaster! >>>!cc(offset!=!0x3eb31340,!physical=True)! GUI&Memory& ! >>>!cc(name!=!“explorer.exe”)! ! Malware&Specific& ! Sessions!(shows!RDP!logins):!! ! Acquire!a!process!address!space!after!using!cc:! sessions! Dump!Zeus/Citadel!RC4!keys:! >>>!process_space!=! ! zeusscan!and!citadelscan! proc().get_process_address_space()! Window!stations!(shows!clipboard!owners):! ! ! wndscan! Find!and!decode!Poison!Ivy!configs:! Disassemble!data!in!an!address!space! ! poisonivyconfig! >>>!dis(address,!length,!space)! Desktops!(find!ransomware):! ! ! Deskscan! Decode!Java!RAT!config:! Dump!bytes,!dwords!or!qwords:! ! javaratscan!(github.com/Rurik)! >>>!db(address,!length,!space)! Display!global!and!session!atom!tables:! ! >>>!dd(address,!length,!space)! atoms!and!atomscan! >>>!dq(address,!length,!space)! ! ! ! ! Copyright!©!2014!The!Volatility!Foundation! ! ! 2.4!Edition! ! ! General!Investigations! Dump!the!system’s!raw!registry!hive!files! dumpfiles!Dp!4!DDregex='(config|ntuser)'!DDignoreDcase!DDname!DD!./! Create!a!Graphviz!diagram!of!processes! psscan!DDoutput=dot!DDoutputDfile=graph.dot! Create!a!color!coded!diagram!of!processes!memory! vadtree!Dp!PID!DDoutput=dot!DDoutputDfile=graph.dot! Translate!an!account!SID!to!user!name! printkey!DK!"Microsoft\\Windows!NT\\CurrentVersion\\ProfileList\\[SID]"!|!grep!ProfileImagePath! List!run!keys!for!HKLM!and!all!users! printkey!DK!"Microsoft\\Windows\\CurrentVersion\\Run"! printkey!DK!"Software\\Microsoft\\Windows\\CurrentVersion\\Run"! Find!Unicode!hostnames!or!URLs! yarascan!DY!"/(www|http).+\.(com|net|org)/"!DDwide![DDkernel]! Find!nullDterminated!ASCII!dot!quad!IP!addresses! yarascan!DY!"/([0D9]{1,3}\.){3}[0D9]{1,3}\x00/"!DDwide![DDkernel]! Locate!and!extract!the!HOSTS!file!to!local!directory! filescan!|!egrep!hosts$!|!awk!'{print!$1}'! ! 0x0000000005e3c6d8! dumpfiles!DQ!0x0000000005e3c6d8!DDname!DD!./! Extract!the!admin!password!hash!