Chapter 1     Malware Incident Response

In Chapter 1 (excerpted in the Linux Malware Incident Response: A Practitioner's Guide to Forensic Collection and Examination of Volatile Data, hereinafter "Practitioner's Guide") we examined the incident response process step-by-step, using certain tools to acquire different aspects of stateful data from subject system. There are a number of tool suites specifically designed to collect digital evidence in an automated fashion from Windows systems during incident response, and generate supporting documentation of the preservation process.

        • Some of these local incident response tool suites execute commands on the compromised computer, and rely on system libraries on the compromised system.

      • Other programs, commonly known as “remote forensics tools,” address some of the limitations of local incident response suites and use a servlet that enables remote evidence gathering while trying to rely on the compromised operating system as little as possible (with varying degrees of  success).

      • Using remote forensic tools, digital investigators can access many machines from a central console, making more effective use of your expertise than spending time running around to touch each machine physically.

      • Furthermore, using a remote forensics tool is more subtle than running various commands on the system and is less likely to alert the subject of investigation. 

      • These tool options, including the strengths and weakness of these tools, are covered in this section.

Recall that in some instances, to reduces system interaction, it is preferable and conducive to deploy live response tools from your trusted toolkit locally on a subject system but collect the acquired data remotely. This process requires establishing a network connection, typically with a netcat or cryptcat listener, and transferring the acquired system data over the network to a collection server.  Remember, that although this method reduces system interaction, it relies on the ability of being able to traverse the subject network through the ports established by the netcat listener.

The Practioner's Guide emphasizes the importance of first acquiring a full memory dump from the subject system prior to gathering data using the various tools in your live response toolkit. This is important, particularly due to the fact that running incident response on the subject system will alter the contents of memory.   To get the most digital evidence out of physical memory, it is advisable to perform a full memory capture prior to running any other incident response processes.  There are a variety of tools to accomplish this task, described below.

System details are a fundamental aspect of understanding a malicious code crime scene.  In particular, system details will inevitably be crucial in establishing an investigative timeline, and identifying the subject system in logs and other forensic artifacts.  In addition to the tools mentioned in this book, others tools consider include:

Remember that identifying users logged into the subject system servers a number of investigative purposes: 1) help discover any potential intruders logged into the compromised system; 2) identify additional compromised systems;  3) provide insight into a malicious insider malware incident;  and provides additional investigative context by being correlated with other artifacts.  Some other tools to consider for this task include:

Malware network connectivity is a critical factor to identify and document; connectivity from a subject system may be to communicate with an attacker’s command and control structure, download additional malicious files, or to exfiltrate data from the system, among other things. In addition to netstat and lsof, other to consider are fuser, route, socklist and ss.

As many malware specimens (such as worms, viruses, bots, key loggers, and Trojans) often manifest on the subject system as a process, collecting information relating to processes running on a subject system is essential in malicious code live response forensics.  Process analysis should be approached holistically—examine all relevant aspects of a suspicious process, as outlined in this Practitioner's Guide.  Below are additional tools to consider for your live response toolkit.