Hbgary Responder Community Edition

Our focus this week is on live response, memory forensics, and triage. New tools from Mandiant (Redline) and HBGary (Responder Community Edition) jump into the live response and memory forensics arena and appear to hold some promise for those who need to delegate first response activities to IT support staff who don't have prior Incident Response of Digital Forensics training. In 'Good Reads,' I've highlighted four articles that I think qualify as must-read. Mark Russinovich has posted a 3-part series over the past few months detailing the process of analyzing Stuxnet (and, by extension, other malware) with Sysinternals tools. Follow that up with Corey Harrell's excellent post on forensic triage, which details a process for answering key questions quickly. If you have an interesting item you think should be included in the Digital Forensics Case Leads posts, you can send it to caseleads@sans.org. Tools: • v1.1.0 was released last week.

This version adds several new features, including the ability to extract mailbox contents from PST, OST, and PAB files. For more details about the release, check out the. • Mandiant recently released, a new Windows memory forensics and triage tool that 'analyzes and rates every running process on a system according to risk.'

• HBGary has released, a free version of their Windows memory analysis tool. • Several last week, including VMMap, RAMMap, and Process Explorer. • Mark McKinnon has made all of the ForensicArtifacts.com posts available as an. As the Forensic Artifacts site grows, this Evernote port will become increasingly useful if kept in sync with the web site. I see the most value coming from this in off-line scenarios, where you could still have the Forensic Artifacts data available via the Evernote application for your mobile device. • Yesterday, Harlan Carvey posted a fairly comprehensive that have caught his attention of late. There's some overlap with my short list above, plus a lot more. Contoh Program Inventory Berbasis Webkinz.

HBGary, Inc., has introduced Responder™ Community Edition, a new, free version of its flagship Responder™ product for physical memory analysis. Limited copies of. CounterTack’s Responder PRO forensics tool is the preeminent tool for reverse engineers. With powerful memory forensics and malware identification capabilities, Responder PRO enables incident response professionals to collect and analyze attack residue and artifacts from memory.

I suspect most will find at least one tool on Harlan's list that they weren't previously aware of, so it's well worth the time. Good Reads: • Over the past few months, Mark Russinovich has written an excellent series of articles on. The three part series is both an interesting look at how Stuxnet works and, more importantly, an outstanding crash course on how to use the Sysinternals tools for malware analysis. I highly recommend reading it, then reading it again. Here are the links to all three parts:,,. • Corey Harrell recently posted over on his blog, Journey Into Incident Response. The post presents both the high-level thought process and the specific steps needed to triage user activity 'in under two minutes' on a Windows computer.

I particularly like this post because it reveals process. Rather than isolating on a specific tool or artifact, Corey narrates the process and demonstrates how to get from question to answer. News: • The Norwegian military announced last week that it shortly after beginning bombing operations in Libya. Seize The Day By Saul Bellow Pdf To Excel. The attack arrived as a spear phishing campaign targeting '100 military employees, some of them high-ranking' with a malware-laden attachment. Not many details are available, and the incident is still under investigation. But this article implies that the attack was related to Norway's participation in bombing attacks against Moammar Gaddafi's forces. • Los Angeles Times - - This article is a uniquely personal look at the impact of data breaches.

• The has been posted. This year's challenge consists of two distinct scenarios for Android forensics. • Voting for the is open until June 5. Check out the nominees and vote for your favorites.

Winners will be announced at the SANS Forensics and Incident Response Summit in Austin, TX. Levity • Dilbert - Coming Events: •! • - Myrtle Beach, SC, June 5-8, 2011 • - Austin, TX, June 7 - 8, 2011 • - McLean, VA - June 14, 2011 • The ACFE is holding a fraud conference in San Diego, CA on June 12-17, 2011. Track E of the conference is geared specifically toward investigators performing digital forensics. More info on the conference is available. • Dave Hull will be teaching in Vancouver, BC on June 20 - 24, 2011.

Digital Forensics Case Leads for 20110526 was compiled by, forensicator, incident responder, and jack-0f-all-security at Virginia Commonwealth University. If you have an article to suggest for case leads please email it to caseleads@sans.org.