{"id":55429,"date":"2022-08-09T09:00:58","date_gmt":"2022-08-09T01:00:58","guid":{"rendered":"https:\/\/version-2.com\/?p=55429"},"modified":"2022-08-29T14:53:45","modified_gmt":"2022-08-29T06:53:45","slug":"security-tools-pt-1","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2022\/08\/security-tools-pt-1\/","title":{"rendered":"Security Tools \u2013 Pt. 1"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n\n

Intro<\/h3>\n

On first glance, the collection of tools that I chose for this article might seem all over the place. However, the idea behind this article is to talk more about some of the most important and well-known tools in the Infosec space.<\/p>\n

Thus, I talk about Volatility (DFIR tool) and Metasploit (exploitation and exploit development) as well as Yara(Malware research & analysis) MITRE(Threat Intel knowledge base) and Sysmon(Advanced logging tool, that we can also use to hunt for threats).<\/p>\n

Volatility<\/h3>\n

Volatility is a memory forensics tool, developed by Volatility labs. It is a standard tool in virtually every Incident Responder\u2019s\/Blue Teamer\u2019s toolkit, it can be easily expanded through a bunch of plugins that are available, and, most importantly, it is completely free.<\/p>\n

There are many ways to acquire memory captures from a system, and we won\u2019t go into that. We\u2019ll just mention that the tools would differ depending on our system\u2019s state (on\/off). For example, for offline systems, specifically Windows OS, we can do this through the hiberfil.sys <\/em><\/strong>which is located in %SystemDrive%<\/em><\/strong> – <\/em>if the disks are unencrypted.<\/p>\n

This file is the compressed image of the previous boot, but that doesn\u2019t mean we can\u2019t do some forensics on it!<\/p>\n

<\/p>\n

Notice I am using volatility standalone (because I am running Window\/CMD in the image) otherwise the command would just be volatility<\/strong>.<\/em><\/p>\n

Imageinfo<\/em><\/strong> is the command that gives the profile on which we can work. You need to identify the right one.<\/p>\n

Further, we can look for hidden processes with psxview<\/em><\/strong>, <\/em>we can use ldrmodules <\/em><\/strong>if we need more details \u2013 it will show inMem<\/em><\/strong>, <\/em>inInit<\/em><\/strong>, <\/em>inLoad<\/em><\/strong> (if they are False<\/em>)\u2026 <\/em>and all of these are quite bad as they indicate that module has been injected. Injected code is obviously very bad and we can look for it with malfind<\/em><\/strong>, <\/em>and even dump it to a file.<\/em><\/p>\n

Also, some of the usual hypervisor formats are:<\/p>\n