Image forensics

steganography 

Tools and tips

• strings, file [bash]
• cat[only works for embedded txt files]
• exiftool
• stegsolve [here]
• zsteg [here]
• gimp [Color> Set color maps>palette]
• unzip [use 7za if it fails]
• binwalk (files in image, not zip) [binwalk]
• Any hex editor [check google for mandatory image field, optional fields may have flags ]
  ubuntu - wxhexeditor, bless
  windows -Hxd hex editor
• Look at headers(chunks,pixels,optional headers,end of file IEND)
• Change width,height bytes [output visible in windows only]
• PNG Filter type extraction: https://github.com/f1nsternacht/libpng
  
  References :
  https://www.youtube.com/watch?v=KUZVIBXfoeA
  http://www.libpng.org/pub/png/spec/1.2/PNG-Contents.html
  https://www.guillermito2.net/stegano/

CTF

CTFs

https://tjctf.org
https://ctf.hacker101.com/ctf

Red Team

Blue Team

https://tjctf.org

Splunk Lookup quirks

Some of the splunk lookup related quirks are:

1. filename must be .csv
2. cloumn_name for lookup must be = a field name in splunk. Should be exactly the same.

Example 1

index="whatever" sourcetype="dns"
   NOT [| inputlookup whitelist.csv
    | fields query ]

*whitelist.csv must have the column name as query.

Example 2
Lookup in secondary search

index="whatever" sourcetype="dns"
| eval DomainName={Logic........}
| search   NOT [| inputlookup whitelistdomain.csv
    | fields DomainName ]

| stats dc(Host) AS HostsPerDomain BY DomainName

*whitelistdomain.csv must have the column name as DomainName.

AWS AssumeRole

From AWS Docs:

AssumeRoleReturns a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to. These temporary credentials consist of an access key ID, a secret access key, and a security token. Typically, you use AssumeRole within your account or for cross-account access.

This can be abused to enumerate cross account IAM roles and then possibly assume access given the attacker knows the AWS Account ID of the victim.

RhinoLabs has created a script for enumeration which can be found on their website from the link in the references[I have not tested the script].

References
https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
https://rhinosecuritylabs.com/aws/aws-iam-user-enumeration/

Brute Force Word List

Directories :
darkc0de

splunk

• Username from linux secure:
  for(?:\suser)?(?:\sinvalid user)?\s(?<user>\S+)
• NOT vs !=
  if the field does not exist in a row. then row will not be included for "!=", however NOT search will include rows which do not have that field.
  

Line of Inquiry

Data Exposure

• Exposure
  What was exposed?
  What caused the exposure? Application? DB?
  How was exposure discovered?
  Duration of exposure with time stamps?
  What is the application for? What data does the application possess or was exposed?
  Get exposed data?
• Abuse
  Who accessed the data during exposure?
  What was accessed during exposure?
  Validate the data is deleted by unauthorized users. 
• Lights On
  Is the application or misconfiguration causing the exposure has been stopped?
  Is the application fixed and back up?
  Service down time?
• Controls
  What access controls were in place?
  What kind of logging was in place?
  What monitoring was in place?
  What security endpoints were in place?
• Hygiene
  What assets are in scope?
  What does the dat flow look like? Design documents
  What are the ingress/Egress point?
• Compliance - Legal
  Is data related to PCI? PII?Financial?Strategical?
  Vendor involvement?
  Legal requirement?
  Communications?  
• Remediations
  What are the new security controls?
  Are the security controls reviewed or tested?
  
  Additional questions should be expected as information is reviewed.

Interesting Event codes

Some Interesting IR eventCodes are:

Login: 4624
Service install : 4697 ,7045
Service Start Type changed: 7040
New Process created: 4688

Cyber Security Frameworks

Here is the list of some of the very helpful Cybersecurity frameworks for aligning security endeavors in the organization

• Attack Matrix for Enterprise
  URL: https://attack.mitre.org/
  Purpose: Break up attack sequence in parts and list tools and relevant details for each. Identify Attack milestones, help identify gaps and align defense strategy
  Tags: BlueTeam,  Strategy
• Attack Eval for Enterprise
  URL: https://attackevals.mitre.org/
  Purpose: Evaluate how tools fit in overall defense strategy. Product Evaluations
  Tags: BlueTeam, Product evaluations
• Effectiveness ScoreCard - Cyber Kill Chain, Lockheed Martin
  URL: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
  https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493920778.pdf
   
  
  Purpose: Measure control effectiveness, where and how the controls fit in. Identify control gaps
  Tags: BlueTeam, Analyst, Strategy
  
• PCI Forensics Investigation report Template
  URL: https://www.pcisecuritystandards.org/documents/Final_PFI_Report_v2.1.pdf?agreement=true&time=1552226789177
  Tags: Reporting Template 

More WireShark

This is going to be a more of working notes style of post for various filters I use in WireSkark for different use cases and references to awesome material.

• Potential Flash Malware download:
  http.content_type == "application/x-shockwave-flash"
• Potential executable download:
  frame contains "DOS mode"
• Find hostname frames:
  nbns.nb_flags.group == 0
• Http Methods:
  http.request.method == "POST"
• Http Redirects
  http.response.code gt 300 && http.response.code lt 400
• Find Usernames in Kerberos tickets:
  kerberos.cname_string == 1
• IRC traffic
  tcp.port == 6666 || tcp.port == 6667 || tcp.port == 6668 || tcp.port == 6669
• DNS query: dns.qry.name
• Multiple Dns Answers : dns.count.answers gt 5
  
• Custom Fields:
• http.header.True-Client-IP
• http.header.WL-Proxy-Client-IP
• kerberos.CNameString

Pcap analysis - packettotal, security onion

References:

https://www.wiresharkbook.com/studyguide.html

https://www.wiresharkbook.com/troubleshooting.html