Windows IR methodology

[Harlan Carvey <keydet89 () yahoo com>]

Per my earlier post...

Incident Response Methodology

The purpose of this methodology is to provide a
checklist for incident responders when collecting and
analyzing information from potentially compromised
systems.  This methodology will focus on the
collection and analysis of volatile information from
Windows NT/2000/XP/2003 systems.

This methodology separates data collection and
analysis into distinct and mutually exclusive phases. 
These phases will often be performed in geographically
and temporally disparate locations.

RFC 32271, "Guidelines for Evidence Collection and
Archiving", should be reviewed.

Data Collection (by order of volatility)
1. System Time
a. Current system time
b. Time Zone Information 
c. Uptime
2. Process Information
a. Pslist.exe, tlist.exe (MS Debugger Tools), Perl
scripts (WMI)
b. Handle.exe 
c. Key information - PID, executable path, command
line
d. Information on execution time, when compared to the
system uptime, may give a clue as to when the
incident/compromise took place
3. Network Information
a. Identification/status of NICs
i. IP addresses - iplist.exe, Perl
ii. Promiscuous mode?  Promiscdetect.exe
b. Network connections - netstat.exe
c. Available shares, including permissions - Perl
d. Mapped drives - Perl
4. Process-to-port mapping
a. Openports.exe
b. Fport.exe (requires admin account)
5. Memory contents
a. Pmdump.exe
b. Dd.exe (??)
c. Require use of additional storage medium
(USB-connected thumb drive, previously mapped share)
6. Service/device driver information - determine
current state, may have been changed since the system
was last booted.
a. WMI
b. Sc.exe (SCM query)
c. Perl scripts (WMI/SCM)
7. System Identification
a. NetBIOS name, OS version, patch level, applications
b. Psinfo.exe, Perl 
8. User Information
a. User currently logged on - psloggedon.exe
b. Local users - last logon, etc.
c. User group assignments and privileges
9. Registry Information
a. Contents of specific keys (need list)
b. LastWrite times
10. Audit information
11. Event Log contents
a. Copy .evt files
b. Psloglist.exe
12. Pertinent file information
a. Application logs
b. StartUp folder contents
c. Scheduled jobs (at.exe, schtasks.exe, Perl)
d. Before copying any files, get MAC times, etc.

Depending upon how stringent the investigation needs
to be, the above tools can be run from a CD and
written to a USB-connected thumb drive or an already
mapped drive.  Another means is to use Perl as a
wrapper around the commands to transport the output of
each command through a socket to a waiting server. 
The server handles data storage,
generation/verification of hashes, documentation, etc.

Data Analysis
1. Check for disparities in process information,
including process-to-port mapping information.  Also
check for disparities between processes and services,
using "tlist -s".
2. Check for disparities in network connection
information (specifically LISTENING sockets) and port
scans; include process-to-port mapping information.

Thoughts?