When conducting incident response in the cloud, there often comes a point when logs alone aren’t enough, and we need direct access to data from the affected machine . A cquiring an image of a virtual machine (VM) in Azure and analyzing it in the cloud can save both time and egress costs compared to downloading it . This guide will walk you through each step in setting up and performing forensic analysis in the cloud, using a dedicated “Forensic VM” to examine a disk image created from a “Victim VM.” https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-service Steps to Perform In-Cloud Forensic Analysis: Step 1: Snapshot the OS Disk from the Victim VM To start, take a snapshot of the VM’s disk. A snapshot is a full, read-only copy of the disk at a specific point in time. Locate the Victim VM  in the Azure portal and navigate to its disk. Create a Snapshot:  Select the “Snapshot” option for the disk . Make sure the VM is running, as snapshots can be created on active VMs. Choose Snapshot Type:   Select “Full” for a complete copy of the disk . Use “Incremental” if you’re doing routine backups. Name the Snapshot:  Assign a descriptive name ( e.g., victim) to avoid confusion in later steps. Azure storage costs apply to snapshots ($0.05/GB/month for standard and $0.132/GB/month for premium). For most investigations, snapshotting only the OS disk is sufficient . However, if the VM has data disks, you may need snapshots of these too. Step 2: Create a New Disk from the Snapshot The snapshot data now needs to be applied to a new disk, making it accessible for analysis. Create a Disk from the Snapshot:  In the Azure portal, go to “Create Disk” and select “Snapshot” as the source type. Name the Disk:  Name it similarly to the snapshot, adding -disk at the end (e.g., victim-vm-os-disk) for easy identification. Select Disk Type:  Choose Premium SSD for faster data processing speeds during forensic analysis. If cost is a concern, you can delete the snapshot after this step, but keeping it is advisable as a backup. Create Disk:  Confirm and create the disk. This disk now holds all data from the snapshot and is ready to be attached to a VM for analysis. Once created search for disks (You will find created disk there) Step 3: Create the Forensic VM To analyze the imaged disk, create a separate VM called the “Forensic VM” with adequate resources for your forensic tools. Select VM Specifications:  Choose a VM size with a robust CPU (4 vCPUs) and memory (16GB) to handle the processing demands of forensic tools. Create OS Disk:  During setup, the Forensic VM will have its own OS disk where you can install forensic software and store results. Data Disk Selection:   Under “Data Disks,” select “Attach an Existing Disk” and attach the disk you created in Step 2. If you forget this step, shut down the VM before attaching the disk to prevent corruption. Location and Region:  Make sure the Forensic VM is created in the same region as the victim VM disk for performance optimization. This VM will host your forensic tools, such as KAPE, and provide an isolated environment for analysis. Step 4: Mount the Disk in the Forensic VM Once the Forensic VM is running, access the imaged disk by mounting it. Access Disk Management:  In the VM’s Disk Management window, you will see: Disk 0: The Forensic VM’s OS disk (typically C:). Disk 1: Temporary storage (typically D:), which is not persistent. Disk 2: The attached disk from the victim VM. Bring Disk 2 Online:   Right-click on Disk 2 and select “Online.” Windows will assign a letter to each partition. Access the OS Partition:  The OS partition will appear as another drive (e.g., G:), which you can now investigate. Ensure you avoid writing to this disk during analysis to maintain the integrity of the data. If any corruption occurs, simply repeat from Step 2 using the original snapshot. Step 5: Run Forensic Tools on the Forensic VM With the disk mounted, you can now use forensic tools to analyze the image. Install Forensic Tools:  Tools like KAPE, FTK Imager, or any preferred forensic software can be installed on the Forensic VM’s OS disk. Perform Analysis:  Analyze the OS partition to retrieve relevant evidence. Remember that this disk is writable, so take care not to alter the contents unintentionally. If you need a point-in-time copy for future analysis, consider using the snapshot or taking another snapshot of the newly created disk. ------------------------------------------------------------------------------------------------------------- Optional: Alternative Snapshot Access Methods For scenarios that require additional tools, downloading the snapshot as a virtual hard disk (VHD) can be useful. Export the Snapshot:  Select the snapshot in the Azure portal, navigate to “Snapshot Export,” and generate a one-time URL for downloading. Use AzCopy for Speed:  To accelerate the download, use the AzCopy tool with the command: azcopy cp "--snapshot URL--" "c:\programfiles\snapshot.vhdx" --check-md5 nocheck VHD Advantages:  Direct VHD access enables automation and integration with tools that may require offline data access. However, be mindful of the potential data egress costs and long download times. Forensic VM Image Creation for Future Use To streamline future investigations, Azure offers ways to create and share VM images. Create an Image:  Create a VM with all your forensic tools installed, then save it as an image in the Azure Compute Gallery. This enables quick setup of similar VMs for future investigations. Use Azure Image Builder (Advanced):  If you prefer customization, use Azure Image Builder to craft an image from scratch. This setup is ideal if you need to transfer or reuse the Forensic VM across different regions, subscriptions, or resource groups. ------------------------------------------------------------------------------------------------------------- Summary Using Azure’s in-cloud investigation capabilities, you can create snapshots, build forensic VMs, and attach imaged disks to streamline your incident response process. By performing forensic analysis in the cloud, you can bypass data egress costs, reduce transfer times, and work efficiently on even large data sets. With this guide, you have a complete roadmap for setting up in-cloud forensic analysis and enhancing your response capabilities in Azure. Akash Patel ---------------------------------------------------------------------------------------------------------- Special Thanks (Iqra) I would like to extend my heartfelt gratitude to one of my dearest colleagues, a Microsoft Certified Trainer, for her invaluable assistance in creating these articles. Without her support, this would not have been possible. Thank you so much for your time, expertise, and dedication! https://www.linkedin.com/in/iqrabintishafi/ -------------------------------------------------------------------------------------------------------------

Since the 1950s, Iran has pursued nuclear energy, initially with Western support, aiming to harness nuclear power for electricity. B ut after the 1979 Iranian Revolution , m any countries grew wary, fearing Iran’s nuclear program might be a cover for weaponization. Concerns escalated when the International Atomic Energy Agency (IAEA) found evidence in 2003 that Iran might be pursuing nuclear-grade materials. Amid this tension, Stuxnet—a piece of malware created to interfere with nuclear capabilities —became the world’s first known digital weapon. ------------------------------------------------------------------------------------------------------------- How Stuxnet Disrupted Iran’s Nuclear Program Stuxnet was designed with one primary goal: to sabotage Iran’s nuclear enrichment by infecting specific computers controlling the centrifuges used for uranium enrichment . Centrifuges must spin at precise frequencies to enrich uranium. The malware targeted Programmable Logic Controllers (PLCs) managing this process, altering their behavior to subtly sabotage the centrifuges without immediately raising suspicion. One challenge was accessing these PLCs, as they were offline from the internet and heavily secured . But Stuxnet’s creators—reportedly backed by nation-states (likely the U.S. and Israel)— found a way around this. Stuxnet initially spread through Windows computers via infected USB drives, exploiting vulnerabilities that allowed it to remain dormant until it detected Siemens Step 7 software, which was used to program the Iranian PLCs . ------------------------------------------------------------------------------------------------------------- Stuxnet’s Attack Strategies: An Unprecedented Use of Zero-Day Exploits Stuxnet’s authors used four zero-day vulnerabilities —highly valuable and rare exploits that had no known fixes—to ensure it could infect, propagate, and escalate privileges across Iran’s networks. Here’s a closer look: USB Autorun via .lnk File Exploit (MS10-046) : Stuxnet used a vulnerability in Windows’ shortcut files (.lnk) to execute a malicious DLL file just by having the USB drive connected and visible in Windows Explorer. This zero-day allowed infection without any user interaction, exploiting older autorun behaviors in Windows. Print Spooler Service Vulnerability (MS10-061) : Another exploit enabled Stuxnet to spread across a trusted local network by compromising the Print Spooler service . This “worm-like” feature allowed Stuxnet to reach more systems quickly and without user involvement. Keyboard Layout Vulnerability (MS10-073 ) : Stuxnet needed higher privileges to make changes to critical files, and this local privilege escalation vulnerability allowed it to elevate its access on infected machines. Task Scheduler Vulnerability (MS10-092) : By modifying task files, Stuxnet could exploit the Windows Task Scheduler and achieve SYSTEM-level access, giving it near-total control over the infected systems. ------------------------------------------------------------------------------------------------------------- A New Era of Cyber Warfare Stuxnet’s design, sophistication, and reliance on high-value zero-days were a clear indication of nation-state backing, marking it as a new kind of digital weapon with geopolitical aims. By successfully disrupting Iran’s nuclear program, Stuxnet didn’t just attack computers—it sent a message about the power of cyber warfare, setting a precedent that digital weapons could now influence global politics. Stuxnet’s impact was profound, serving as both a technical and strategic innovation in cybersecurity and warfare. It forced the world to acknowledge that, in the digital age, malware could be used for not only espionage but also as a weapon with real-world effects​ ------------------------------------------------------------------------------------------------------------- Stuxnet: A Closer Look at the Attack Mechanisms Stuxnet's attack on Iran's nuclear enrichment facilities used a combination of zero-day vulnerabilities, rootkits, and PLC-targeted manipulation to disrupt centrifuge operations. 1. Overcoming the Air-Gap with Zero-Days To penetrate Iran’s isolated networks, Stuxnet utilized multiple zero-day exploits: MS10-046 (USB Autorun Vulnerability) : This exploit allowed Stuxnet to execute its code via infected USB drives without requiring user interaction. Once introduced to the network, the malware sought out computers running Siemens’ Step 7 software, commonly used in industrial settings. MS10-061 (Print Spooler Service Vulnerability) : After reaching the air-gapped network, Stuxnet spread to other machines by exploiting this vulnerability, which allowed it to propagate through the network using the Printer Spooler Service. The malware’s worm-like behavior was controlled, infecting only a limited number of machines and set to self-terminate by June 24, 2012, to limit unintended spread. MS10-073 and MS10-092 (Privilege Escalation Vulnerabilities) : Stuxnet used these vulnerabilities to escalate its privileges to SYSTEM-level, gaining full control over infected Windows systems and establishing persistence. 2. Concealing Its Presence with Rootkits Once SYSTEM-level access was secured, Stuxnet deployed rootkits to avoid detection : Kernel and User-Mode Rootkits : These rootkits were installed using malicious device drivers, which were signed with stolen digital certificates from companies like Realtek . The rootkits concealed Stuxnet’s files and processes, effectively hiding it from users and security tools. T arget-Specific Behavior : Stuxnet was designed to only target Siemens S7-300 PLCs connected to specific types of variable-frequency drives, particularly those used to control centrifuges. This targeting was tailored to equipment commonly used in Iran’s uranium enrichment facilities, limiting the malware’s potential to harm unrelated systems. 3. Command and Control (C2) Without Internet Connectivity Stuxnet operated within air-gapped environments but maintained basic communication capabilities: Primary C2 Domains : Infected systems attempted to connect to domains like todaysfutbol[.]com and mypremierfutbol[.]com , transmitting basic system information and verifying the presence of Step 7 software. Peer-to-Peer Communication via RPC : Stuxnet could update itself and exfiltrate information through a peer-to-peer network. Infected systems with internet access could pass along updates and data to isolated systems via RPC (Remote Procedure Call), allowing Stuxnet to function even without direct internet access. 4. Hijacking and Manipulating PLCs Stuxnet's most sophisticated attack involved directly manipulating Siemens PLCs: DLL Hijacking of s7otbxdx.dll : Stuxnet replaced the Siemens DLL s7otbxdx.dll with a modified version , intercepting and manipulating communications between Step 7 and the PLC. It injected malicious STL (Statement List) code into the PLC while concealing these modifications from operators. Frequency Manipulation : Stuxnet periodically altered the frequency of the centrifuge motors, forcing them to speed up or slow down, which caused physical damage to the centrifuges over time . The malware then spoofed the original frequency data to avoid detection by monitoring systems, creating the first-known rootkit on a PLC. 5. Targeted Criteria and Fail-Safe Mechanisms Stuxnet’s targeting was precise, avoiding interference with non-Iranian PLCs: Selective Interference : It only affected centrifuges operating within specific frequency ranges (807 Hz to 1210 Hz) and ignored systems that didn’t meet this criterion, minimizing collateral damage. Stuxnet also refrained from reinfecting systems that had previously been compromised.' Stuxnet’s Legacy Stuxnet was a groundbreaking cyber weapon that demonstrated the potential for malware to cause physical damage to critical infrastructure. Its design, incorporating stealth, selective targeting, and air-gap-penetration strategies, underscored the growing sophistication of state-sponsored cyber warfare​ ------------------------------------------------------------------------------------------------------------- Conclusion the Stuxnet attack stands as a groundbreaking instance of cyber warfare, demonstrating an unprecedented level of sophistication in both its design and its ability to evade detection.  Stuxnet set a precedent for future cyber operations by combining espionage, network infiltration, and physical sabotage. It underscores the critical need for advanced cybersecurity measures in protecting industrial control systems and highlights the potential reach and impact of cyber warfare on national infrastructure. Akash Patel ​

In recent years, the landscape of cybercrime has drastically changed, evolving from random attacks to highly organized, human-operated campaigns. Unlike traditional ransomware attacks, which were often opportunistic, human-operated ransomware is carefully orchestrated by groups that target specific organizations, often with a high level of planning and precision. 1. Human-Operated Ransomware: A New Level of Targeted Attack In the early days of ransomware, attackers often used “scattershot” approaches like phishing emails, aiming to infect as many victims as possible. However, some ransomware groups now conduct targeted attacks, sometimes called “human-operated ransomware.” Instead of random infections, attackers thoroughly research and choose victims, gaining access to networks and strategically deploying ransomware when it’s likely to cause the most damage. Key Steps in a Human-Operated Ransomware Attack: Initial Compromise:  Attackers typically gain entry through straightforward means: phishing emails with malicious attachments, weak or reused credentials, or exploiting systems with internet-facing vulnerabilities (like exposed RDP). Establishing Persistence:  Once inside, attackers often use t ools like Cobalt Strike (a penetration testing tool frequently used by attackers) to maintain access , or they may install “web shells” ( programs that allow remote access ) to give them backdoor entry whenever they need it. Privilege Escalation:  Attackers then work to gain more control over the network. They may look for saved passwords or use tools like Mimikatz to steal login credentials. Tools like Bloodhound and Pingcastle are often used to map out and find ways to escalate privileges within Active Directory environments. Reconnaissance and Data Collection:  Before encrypting data, attackers often steal sensitive information . This tactic, called “double extortion,” is a strategy where attackers can threaten to release stolen data if the ransom is not paid . Cobalt Strike scripts, nslookup, and other network tools are used to locate and gather valuable data. Lateral Movement:  Attackers spread across the network to infect more devices using tools like Cobalt Strike, Metasploit, and sometimes even old exploits like EternalBlue (which was part of the WannaCry attack). They may also tunnel RDP connections using ngrok or other services. Execution of Objectives:  After gaining full control over the domain, attackers reach their final objectives: Data Exfiltration:   Using FTP, WinSCP, or cloud file hosting services , they steal sensitive data. Ransomware Deployment:   Ransomware is deployed across the network via tools like WMIC, PSExec, and sometimes manually. This strategic deployment often occurs at a time that maximizes impact, such as during off-hours or holidays. --------------------------------------------------------------------------------------------------------- I have create a complete series on Ransomware from Evolution to impact. Might possible you know more than me But Who knows you might learn something new. Kindly do check under course tab -------------------------------------------------------------------------------------------------------- 2. LockBit 2.0: Ransomware-as-a-Service with a Double-Extortion Twist LockBit, first seen in 2019, resurfaced in 2021 as LockBit 2.0 , introducing new strategies and enhancements to ransomware deployment. LockBit 2.0 operates as a Ransomware-as-a-Service (RaaS) model , where the developers offer the ransomware to affiliates, who carry out the actual attacks. When a ransom is paid, both the developer and the affiliate profit, making ransomware more accessible to less technically skilled criminals. Key Tactics of LockBit 2.0: Double Extortion:  Similar to Maze, LockBit 2.0 leverages double extortion, where attackers first encrypt a victim’s files and then threaten to leak the stolen data if the ransom isn’t paid. Affiliate Program:  LockBit 2.0 actively recruits insiders within target companies to provide login credentials, like RDP access . This insider help streamlines initial entry into networks and often bypasses basic security controls. Network-Wide Distribution via GPOs:   Once the attackers gain access to the domain controller, they use Group Policy Objects (GPOs) to distribute the ransomware across the entire network . This allows them to disable security tools and push LockBit 2.0 ransomware to every connected device efficiently. StealBit for Data Exfiltration:  LockBit 2.0 includes a built-in tool called StealBit, designed to locate and exfiltrate sensitive corporate data. This feature automates data theft, ensuring maximum leverage over the victim. Rapid Encryption Techniques:  LockBit 2.0 uses advanced encryption tactics like multithreading and partial file encryption. These methods allow it to encrypt large amounts of data very quickly, making recovery more difficult for victims. ---------------------------------------------------------------------------------------------------------- Kindly Note The LockBit ransomware group has been significantly impacted by recent law enforcement actions under " Operation Cronos," involving international agencies like Europol, the FBI, and the UK's National Crime Agency (NCA). As of February 2024, several key LockBit infrastructure components have been taken down, including their Tor sites, and a series of high-profile arrests have occurred. These operations have disrupted LockBit's network, leading to a major loss of affiliates and a tarnished reputation, as the group has been forced to duplicate victim claims to maintain credibility. Authorities have arrested multiple LockBit affiliates, including those behind large-scale ransomware attacks . Charges were filed against prominent figures associated with LockBit and affiliated groups like Evil Corp, and several LockBit members have faced sanctions in the U.S., UK, and Australia. Notably, D imitry Yuryevich Khoroshev, allegedly the main operator of LockBit, was identified, and a reward was offered for information leading to his capture. Despite these efforts, LockBit has continued some operations , though their activity level and visibility have diminished, with some attacks attributed to the group potentially being exaggerated to mask the true impact of the takedown ---------------------------------------------------------------------------------------------------------- 3. Crypto Mining Malware: Silent Profiteers Unlike ransomware, which is loud and disruptive, crypto mining malware works quietly in the background. This type of malware hijacks system resources to mine cryptocurrency , potentially running for extended periods without detection. While crypto mining may seem less harmful, it can still cause major issues, draining resources, slowing down systems, and increasing power costs. Types of Crypto Mining Malware: Browser-Based Crypto Mining: Typically, this type is implemented through JavaScript on a website, mining cryptocurrency while the user is on the site. Many sites using browser-based miners are streaming sites or content portals where users stay for extended periods, maximizing the mining time. Host-Based Crypto Mining: This type of malware behaves more like traditional malware, arriving through phishing emails or malicious downloads. Once installed, it often uses PowerShell scripts or other methods to persist on the system, ensuring it can continue mining even after the system restarts. Though crypto mining may not seem as destructive as ransomware, some c rypto mining malware includes additional features like worm-like spreading capabilities, password stealing, and other data theft functions. This added functionality can allow attackers to sell compromised data or escalate attacks later, making crypto mining malware a threat that goes beyond resource theft. ---------------------------------------------------------------------------------------------------------- Key Takeaways: Staying Ahead of Modern Cyber Threats The rapid evolution of cybercrime demonstrates that organizations must adapt their security measures to meet these advanced threats. Here’s a summary of key strategies for defense: Enhance Network Security:   Segment your network to limit attackers’ lateral movement. Protect internet-facing systems with strong credentials and multi-factor authentication. Monitor and Detect Early:  D eploy endpoint detection and response (EDR) solutions to spot unusual activities like lateral movement, credential dumping, or unknown tools. Educate Employees:  Phishing is still a major entry point for attackers. Regular training can help employees recognize and avoid phishing attempts. Limit Privilege Escalation Opportunities:   Use tools like Bloodhound to identify and mitigate vulnerabilities in privilege management, and limit the number of users with administrative access. Patch Regularly:  Many ransomware attacks exploit known vulnerabilities. Keeping systems updated is one of the simplest and most effective defenses. Back Up Data:  Regular, secure backups are essentia l. They allow you to recover quickly without paying ransoms in case of a successful ransomware attack ---------------------------------------------------------------------------------------------------------- Akash Pate l

The Unified Kill Chain (UKC) is an evolution of earlier cyber kill chain models , addressing key limitations of traditional frameworks, such as the Lockheed Martin Cyber Kill Chain and Dell SecureWorks Cyber Kill Chain. It provides a holistic perspective on modern cyberattack s, emphasizing the complexities of advanced persistent threats (APTs) and multi-stage intrusions. By organizing an attack into three broad phases— Initial Foothold , Network Propagation , and Actions on Objectives —the Unified Kill Chain accommodates diverse threat scenarios , including insider threats and supply chain attacks. Limitations of Traditional Kill Chains The Lockheed Martin Cyber Kill Chain, introduced in 2011 , remains a v aluable model for understanding adversarial methods . However, its static structure reveals significant limitations in addressing modern, dynamic attack vectors: Payload-Centric Approach : The traditional model assumes an external payload delivery mechanism , neglecting the rise of insider threats and supply chain attacks . Lateral Movement Overlooked : Modern attackers often propagate through internal networks using t echniques like credential theft and lateral movement, which are inadequately addressed in the traditional framework. Inflation of Action on Objectives : Critical attack steps, such as privilege escalation and persistence, are grouped under "Actions on Objectives, " diluting their importance. To address these gaps, alternative frameworks such as the Unified Kill Chain were developed. ---------------------------------------------------------------------------------------------------------- Phases of the Unified Kill Chain The UKC defines 18 attack phases , grouped into three overarching stages : In , Through , and Out . 1. In (Initial Foothold) Focuses on breaching the organizational perimeter to gain initial access. Key Phases : Reconnaissance Resource Development Delivery Social Engineering Exploitation Persistence Defense Evasion Command & Control Example : An attacker performs phishing (Social Engineering) to deliver malware (Exploitation) that establishes a Command & Control channel. 2. Through (Network Propagation) Involves activities to escalate privileges and move laterally across the network . Key Phases : Discovery Privilege Escalation Credential Access Lateral Movement Execution Pivoting Example : Attackers use stolen credentials (Credential Access) to escalate privileges (Privilege Escalation) and pivot to other systems. 3. Out (Actions on Objectives) Covers activities for achieving the attacker's final goals, such as exfiltration or system impact. Key Phases : Collection Exfiltration Impact Objectives Example : Data is exfiltrated (Exfiltration) from compromised servers, or ransomware disrupts operations (Impact). ---------------------------------------------------------------------------------------------------------- Structure of the Unified Kill Chain The Unified Kill Chain divides an attack into three phases: 1. Initial Foothold This phase includes techniques used to gain access to the target environment . It encompasses reconnaissance and exploitation methods. Example Techniques : Phishing emails with malicious attachments or links. Exploitation of public-facing vulnerabilities, such as Log4Shell. Insider threats gaining unauthorized access using stolen credentials. Real-World Example : In the SolarWinds attack, adversaries used a compromised update mechanism to inject malicious code into thousands of victims’ environments. 2. Network Propagation Once initial access is established, attackers seek to move laterally, escalate privileges, and access critical systems. Example Techniques : Credential harvesting and Pass-the-Hash attacks. Exploiting trust relationships between systems, such as Active Directory misconfigurations. Deployment of remote administration tools like Cobalt Strike. Real-World Example : During the WannaCry ransomware outbreak, attackers exploited the EternalBlue vulnerability to propagate rapidly across networks. 3. Actions on Objectives In this final phase, attackers accomplish their goals, such as data exfiltration, sabotage, or deploying ransomware. Example Techniques : Encrypting critical files for ransom demands. Stealing sensitive data for espionage or financial gain. Disrupting critical operations by destroying system backups. Real-World Example : The NotPetya attack targeted organizations globally, encrypting data irrecoverably and causing billions in damages. ---------------------------------------------------------------------------------------------------------- Now we will look into Comparison b/w Unified kill chain and Traditional kill chain Unified Kill Chain vs. Traditional Kill Chain ---------------------------------------------------------------------------------------------------------- How to Use the Unified Kill Chain for Defense Organizations can leverage the Unified Kill Chain to strengthen their cybersecurity posture: Threat Detection : Monitor logs and network activity to identify patterns consistent with Initial Foothold techniques. Lateral Movement Prevention : Implement micro-segmentation and restrict unnecessary inter-system communication. Incident Response : Use the framework to categorize and prioritize remediation efforts based on the attack phase. ---------------------------------------------------------------------------------------------------------- Example Attack Mapped to the Unified Kill Chain Attack Scenario : Ransomware targeting a corporate network. Unified Kill Chain Phase Attack Steps Initial Foothold Spear-phishing email delivers a malicious macro document. Network Propagation Harvested credentials are used to move laterally via RDP and exploit SMB vulnerabilities. Actions on Objectives Files are encrypted, and a ransom note is delivered, demanding cryptocurrency payment for decryption. ---------------------------------------------------------------------------------------------------------- Conclusion The Unified Kill Chain equips organizations with a modern and robust framework for understanding and defending against complex cyberattacks. Its comprehensive, flexible, and actionable nature makes it an invaluable tool for enhancing cybersecurity resilience in an ever-evolving threat landscape. For more details, refer to the Unified Kill Chain White Paper . Akash Patel

Monetary Gain as the Core Driver of Cybercrime Cyber criminals are motivated by financial profit, making their targets somewhat predictable—they go where the money is. These attackers prefer l ow-effort, high-reward methods and often avoid challenging targets. A classic saying summarizes their approach: “ You don’t have to be the fastest; just don’t be the slowest.” Common Attack Techniques in Financial Cybercrime 1. Online Banking Trojans Banking Trojans target online banking users, aiming for mass infections and small-value thefts. Notable examples include: Zeus, Citadel, Emotet, and Dridex:  These Trojans infect users’ devices to steal small amounts of money from each infected account. POS and ATM Malware:  Tailored malware targeting point-of-sale systems and ATMs to steal data and cash. 2. Advanced Attacks Against Financial Institutions Criminals are targeting banks directly, infecting business users involved in handling large fund transfers: Carbanak Attack (2015):  Cybercriminals infiltrated bank networks, learning fund transfer procedures and stealing millions. Bangladesh Bank Heist (2016):  Attackers exploited the SWIFT system, resulting in an attempted theft of $951 million. 3. Targeted Ransomware Since 2015, ransomware has surged, targeting any entity that values its data: Victims:  From individuals to corporations and government bodies, anyone with data worth protecting is a potential target if they’re willing to pay to retrieve it. Key Online Banking Trojans Zeus Trojan: The "King" of Banking Malware Overview:  Zeus, a versatile Trojan, performs various attacks, including keylogging and "man-in-the-browser" (MitB) attacks, which intercept and manipulate data in a user’s browser. Tech Support Scams:  Zeus also supported fake virus warnings, leading users to pay for fraudulent antivirus services. Open-Source Adaptation:   In 2011, Zeus’s source code was leaked , giving rise to many new variants like Citadel. ZitMo (Zeus-in-the-Mobile):  This mobile version intercepts authentication codes to facilitate fraudulent transactions. Emotet Trojan: Evolving Financial Malware First Identified (2014):  Initially, Emotet bypassed security to steal banking credentials, later evolving with features like self-propagation through email. Infection via Spam:  Emotet spreads via email with malicious Office documents , often disguised as invoices or delivery notices. Notable Attack (2019):  In Lake City, Florida, Emotet infected the city’s network, later dropping Trickbot and leading to Ryuk ransomware deployment, resulting in a $460,000 ransom payment. Carbanak: The First APT Against Banks Discovery (2015):  Carbanak, an APT (Advanced Persistent Threat) campaign, targeted financial institutions, amassing $500 million through fraudulent transactions. Attack Method:   Phishing emails with malicious attachments led to malware installation, allowing remote control and surveillance of bank operations. Techniques:  Carbanak gang learned banking procedures by recording screens and keystrokes, enabling them to conduct transactions themselves. Cash-Out Techniques:  These included programming ATMs to dispense cash on command, transferring funds to mule accounts, manipulating the SWIFT network, and creating fake bank accounts. Summary of Financial Losses : Carbanak alone caused losses of up to $10 million per institution, potentially totaling $1 billion across all affected banks. In Next Article we will talk about the Bangladesh Bank Heist via swift network in depth. Until than stay safe and keep learning!

Search engines are incredible tools for finding information online, but they can also be used by attackers for reconnaissance. How Attackers Use Search Engines for Reconnaissance Search engines like Google and Bing provide a vast amount of information that attackers can exploit. By using specific search commands, they can uncover sensitive data, find vulnerabilities, and prepare for attacks. Google Hacking Database (GHDB): The Google Hacking Database (GHDB) is a collection of search queries that help find vulnerabilities and sensitive data exposed by websites. It's a valuable resource for attackers and can be found on the Exploit Database website. https://www.exploit-db.com/google-hacking-database Key Search Commands Attackers Use site:  Searches a specific domain. Example: site: example.com  restricts the search to example.com . link:  Finds websites linking to a specific page. Example: link: example.com  shows all sites linking to example.com . intitle:  Searches for pages with specific words in the title. Example: intitle: "login page"  finds pages with "login page" in the title. inurl:  Looks for URLs containing specific words. Example: inurl: admin  finds URLs with "admin" in them. related:  Finds pages related to a specific URL. Often less useful but can sometimes uncover valuable information. cache:  Accesses the cached version of a webpage stored by Google. Example: cache: example.com  shows Google's cached copy of example.com . filetype/ext:  Searches for specific file types. Example: filetype: pdf  or ext: pdf  finds PDF files, useful for locating documents that might contain sensitive information. Practical Reconnaissance Techniques 1. Searching for Sensitive Files: Attackers search for files that might be accidentally exposed, such as: Web Content:   site: example.com asp , site: example.com php Document Files:   site: example.com filetype: xls , site: example.com filetype:pptx 2. Using Cache and Archives: Google Cache:  Retrieves recently removed pages using the cache:  command. Wayback Machine:  Archives webpages over time, available at archive.org . https://archive.org/ 3. Automated Tools: FOCA/GOCA:  Finds files, downloads them, and extracts metadata, revealing usernames, software versions, and more. https://github.com/gocaio/Goca SearchDiggity:  Provides modules for Google, Bing, and Shodan searches, malware checks, and data leakage assessments. Recon-ng:  A framework that queries data from multiple services and manages data across projects. https://github.com/lanmaster53/recon-ng Conclusion Search engine reconnaissance is a powerful tool for attackers, providing them with a wealth of information to plan their attacks. By understanding these techniques and implementing robust defensive measures, you can significantly reduce your exposure and protect your critical data. Stay vigilant, stay informed, and continuously audit your public-facing assets to maintain a strong security posture. Akash Patel

Lets talk about Fifth category called: Virtual Machine Logs Azure provides a range of logging options for virtual machines (VMs ) to support monitoring, troubleshooting, and incident response. Here’s an overview of the log types, agents, and configuration options for both Windows and Linux VMs, along with specific considerations for application logs. Logging Agents Azure offers several agents for collecting VM logs, each suited to different needs: Monitor Agent  : Designed to replace older agents, it supports Data Collection Rules (DCR)  for granular log collection . Diagnostic Extension (WAD) : Known as Windows Azure Diagnostics, this agent can write data directly to a storage account or an Event Hub . It remains a go-to choice for direct storage integration. Azure Monitor for VMs : Collects performance data and logs across VMs but may require additional configuration for more specialized needs. For data retention in Azure, understanding which agent best aligns with your storage and monitoring requirements is key. Configuring Windows Azure Diagnostics (WAD) for Windows VMs Initial Setup : Navigate to Azure Monitor  in the Azure portal. Create a Data Collection Rule (DCR)  for specific logs. Configuration Steps : Diagnostic Settings : Configure diagnostic settings for the VM and select the event logs and levels you want to collect (e.g., system, security, and application logs). Agent Settings : Assign a storage account to store the logs and set a disk quota to manage storage limits. Types of Logs Collected : Windows Event Logs : Stored in WADWindowsEventLogsTable , which contains OS-level event logs. Application Logs : Capture IIS logs, .NET application traces, and Event Tracing for Windows (ETW)  events . ETW provides insights into kernel and application-level events, useful for performance and security monitoring. Accessing Logs : Azure Storage Explorer : Use this tool to navigate to the storage account’s Tables  section, a ccess WADWindowsEventLogsTable , and export logs to a .csv file if needed. Configuring Logging for Linux VMs Diagnostic Settings : S et diagnostic settings for the Linux VM, similar to the Windows setup. Choose the target storage account for log storage. Log Options : Metrics : Configure metrics for key system parameters such as CPU, memory, network, file system, and disk usage. These can indicate suspicious activity patterns, such as high CPU usage for crypto mining or elevated disk usage during ransomware incidents. Syslog : Collect system logs stored in auth.log, kern.log, syslog, etc. All logs are combined into a single table, LinuxSyslogVer2v0 in the Azure storage account. https://datatracker.ietf.org/doc/html/rfc5424 Accessing Linux Logs : Use Azure Storage Explorer  to access LinuxSyslogVer2v0  under the Tables  section of the designated storage account. Application Logging Tracing for .NET and ETW : Application logs generated from .NET applications and ETW (Event Tracing for Windows)  capture both system and application performance data. Logs are stored in plaintext, differing from other logs stored in JSON format, and can be accessed via Azure’s storage services. ------------------------------------------------------------------------------------------------------------- Summary of Log Sources Windows VMs : Windows event logs (WADWindowsEventLogsTable) IIS and application logs, ETW events Linux VMs : System metrics (CPU, memory, etc.) Syslog events (LinuxSyslogVer2v0) Application Logs : .NET tracing output and ETW logs in plaintext -------------------------------------------------------------------------------------------------------- Key Takeaways Choosing Agents : Decide based on whether storage account integration or advanced data collection rules are required. Logging Setup : Configure storage quotas to avoid excessive costs and log noise. Accessing Logs : Use Azure Storage Explorer  for NoSQL table-based logs, which provide structured access to Windows and Linux logs. ------------------------------------------------------------------------------------------------------ Conclusion: In Azure, securing storage accounts and virtual machines requires vigilant access management, policy-driven logging, and careful monitoring of data access activities. By enabling StorageRead logs and configuring diagnostic agents for VMs, organizations can detect potential data exfiltration and unusual activity. Centralizing logs and applying policies across environments strengthens incident response and supports comprehensive visibility across resources. Akash Patel ---------------------------------------------------------------------------------------------------------- Special Thanks (Iqra) I would like to extend my heartfelt gratitude to one of my dearest colleagues, a Microsoft Certified Trainer, for her invaluable assistance in creating these articles. Without her support, this would not have been possible. Thank you so much for your time, expertise, and dedication! https://www.linkedin.com/in/iqrabintishafi/ -------------------------------------------------------------------------------------------------------------

Lets Talk about Third category called: Resource Azure offers a variety of logging resources to support incident response, monitoring, and security analytics. Two key components are Network Security Group (NSG) Flow Logs  and Traffic Analytics —essential tools for analyzing network activity and identifying potential security incidents in your Azure environment. https://learn.microsoft.com/en-us/azure/azure-monitor/reference/logs-index Key Components of Azure Network Security Network Security Groups (NSG) : NSGs are used to control network traffic flow to and from Azure resources by setting up security rules . Rules specify the source, destination, port, and protocol, either allowing or denying traffic. Rules are prioritized numerically, with lower numbers having higher priority. https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview NSG Flow Logs : Flow logs capture important network activity at the transport layer (Layer 4) and are a vital resource for tracking and analyzing network traffic . They include: Source and destination IP, ports, and protocol : This 5-tuple information helps identify connections and patterns . Traffic Decision (Allow or Deny) : Specifies whether traffic was permitted or blocked. Logging Frequency : Flow logs are captured every minute. Storage : Logs are stored in JSON format, retained for a year, and can be configured to stream to Log Analytics or an Event Hub for SIEM integration . Note: NSG flow logs are enabled through the Network Watcher service, which must be enabled for each region in use. NSG Flow Log Configuration To enable NSG flow logs: Enable Network Watcher : Set up in each Azure region where NSG monitoring is needed. Register Microsoft.Insights Provider : The "Insights" provider enables log capture and must be registered for each subscription. Enable NSG Flow Logs : Use Version 2 for enhanced details , including throughput information. https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-tutorial https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics --------------------------------------------------------------------------------------------------------- Traffic Analytics Traffic Analytics  is a powerful tool that enhances NSG flow logs by providing a visual representation and deeper insights into network activity . By using a Log Analytics workspace, it allows organizations to: Visualize Network Activity : Easily monitor traffic patterns across subscriptions. Identify Security Threats : Detect unusual traffic patterns that could signify attacks or unauthorized access. Optimize Network Deployment : Analyze traffic flows to adjust resource configurations for efficiency. Pinpoint Misconfigurations : Quickly identify and correct settings that might expose resources to risk. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics Setup : Traffic Analytics is configured via the Network Watcher and requires the NSG logs to be sent to a Log Analytics workspace. --------------------------------------------------------------------------------------------------------- Practical Applications in Incident Response and Forensics For incident response, NSG flow logs and Traffic Analytics provide a detailed view into Azure network activity, allowing you to: Track unusual or unauthorized traffic patterns. Quickly spot and investigate potential lateral movement within the network. Assess security posture by reviewing allowed and denied traffic flows, helping ensure configurations align with security policies. --------------------------------------------------------------------------------------------------------- Now Lets Talk about Fourth category called: Storage Account Logs In Azure, storage accounts  are crucial resources for storing and managing data, but they require specific configurations to secure access and enable effective monitoring through logs. Here’s a breakdown of key practices for setting up and securing storage accounts in Azure: Enabling Storage Account Logs Azure does not enable logging for storage accounts by defaul t, but you can enable logs through two main options: Diagnostic Settings – Preview : This is the preferred option , offering granular logging settings. Logs can be configured for each data type—blob, queue, table, and file storage— and sent to various destinations such as a Log Analytics workspace, another storage account, an Event Hub, or a partner solution. Diagnostic Settings – Classic : An older option with limited customization compared to the preview settings. Logging Categories : Logs can capture Read, Write, and Delete operations . For security and forensic purposes, it’s especially important to enable the StorageRead  log to track data access, as this can help detect data exfiltration attempts (e.g., when sensitive data is downloaded from a blob). Key Logging Considerations for Security Data Exfiltration Tracking : Monitoring Read operations is critical for detecting unauthorized data access. Filtering for specific operations, such as GetBlob, allows you to identify potential data exfiltration activities. Microsoft Threat Matrix : Azure’s threat matrix for storage, based on the MITRE ATT&CK framework, highlights data exfiltration as a significant risk. Monitoring for this by configuring relevant logs helps mitigate data theft. https://www.microsoft.com/en-us/security/blog/2021/04/08/threat-matrix-for-storage/ --------------------------------------------------------------------------------------------------------- Storage Account Access Controls Access to storage accounts can be configured at multiple levels: Account Level : Overall access to the storage account itself. Data Level : Specific containers, file shares, queues, or tables. Blob Level : Individual blob (object) access, allowing the most restrictive control. Access Keys : Each storage account comes with two access keys . Regular rotation of these keys is highly recommended to maintain security. Shared Access Signatures (SAS) : S AS tokens allow restricted access to resources for a limited time and are a safer alternative to using account keys , which grant broader access. SAS tokens can be scoped down to individual blobs for more restrictive control. Public Access : It’s critical to avoid public access configurations unless absolutely necessary, as this can expose sensitive data to unauthorized users. --------------------------------------------------------------------------------------------------------- Internet Access and Network Security for Storage Accounts By default, Azure storage accounts are accessible over the internet , which poses security risks: Global Access : Storage accounts exist in a global namespace, making them accessible worldwide via a URL (e.g., https://mystorageaccount.blob.core.windows.net). Restricting access to specific networks or enabling a private endpoint is recommended to limit exposure. Private Endpoints and Azure Private Link : For enhanced security, private endpoints can be used to connect securely to a storage account via Azure Private Link. This setup requires advanced planning but significantly reduces the risk of unauthorized internet access. Network Security Groups (NSG) : Although NSGs do not directly control storage account access, securing virtual networks and subnets associated with storage accounts is essential . Best Practices for Incident Response and Forensics For effective incident response: Enable and monitor diagnostic logs for Read operations to detect data exfiltration. Regularly review access control configurations to ensure minimal exposure. Use private endpoints and avoid public access settings to minimize risk from the internet. These configurations and controls enhance Azure storage security, protecting sensitive data from unauthorized access and improving overall network resilience. --------------------------------------------------------------------------------------------------------- In Azure, protecting against data exfiltration in storage accounts requires a layered approach, involving strict control over key and SAS token generation , careful monitoring of access patterns , and policies that enforce logging for audit and response purposes . Here’s a detailed breakdown: Data Exfiltration Prevention and Monitoring Key and SAS Management Key Generation : Access keys or SAS tokens are critical for accessing data in storage accounts and can be generated through various methods: Azure Console : Provides an intuitive UI for key generation and monitoring. PowerShell and CLI : Useful for scripting automated key management tasks. Graph API : Suitable for integrating key management into custom applications or workflows. For example: Access Keys : Azure generates two access keys per storage account to allow for seamless key rotation. Shared Access Signatures (SAS) : SAS tokens can be generated at different levels (blob, file service, queue, and table), granting temporary, limited access. Generating SAS tokens at the most granular level, such as for individual blobs, reduces the risk of misuse. Monitoring Key Enumeration : To detect potential data exfiltration, look for specific operations that indicate credential enumeration: LISTKEYS/ACTION Operation : Any instance of "operationName": " MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION "  in the logs suggests that a principal has listed the keys. This is a red flag, as unauthorized access to these keys could enable data exfiltration. Configuring Applications for Secure Access Once a threat actor obtains storage credentials, it becomes straightforward to access and exfiltrate data through a pplications like Azure Storage Explorer . This tool allows quick configuration using access keys or SAS tokens, so it’s vital to: Limit Key Distribution : Only authorized users should have access to SAS tokens or keys, ideally with restricted permissions and limited expiry. Enable StorageRead Logs : The StorageRead  log captures read activities, providing visibility into data access. If this log isn’t enabled, data exfiltration activity goes undetected. Automating Log Enabling with Policies For organizations with extensive storage account usage, enabling StorageRead logs on each account individually can be infeasible . To streamline this, you can: Create a Policy for Storage Logs : Set a policy at the management group  or subscription  level to automatically enable logs for all current and future storage accounts. Predefined Policies : Azure offers several predefined policies, but currently, none enforce storage account logging by default. Custom Policy : If needed, a custom policy can be created (e.g., to enable StorageRead logging and direct logs to an Event Hub, a Log Analytics workspace, or other storage). This policy can ensure storage accounts remain compliant with logging requirements. Policy Constraints and Configuration : Regional Limitation : When configuring a policy to send logs to an Event Hub, both the Event Hub and the storage account must be in the same region. To capture logs across multiple regions, create corresponding Event Hubs. Flexible Destinations : Customize the policy to send logs to various destinations, such as Log Analytics or a storage account, depending on organizational needs. --------------------------------------------------------------------------------------------------------- Further we will talk in next blog, Until than stay safe and keep learning Akash Patel ---------------------------------------------------------------------------------------------------------- Special Thanks (Iqra) I would like to extend my heartfelt gratitude to one of my dearest colleagues, a Microsoft Certified Trainer, for her invaluable assistance in creating these articles. Without her support, this would not have been possible. Thank you so much for your time, expertise, and dedication! https://www.linkedin.com/in/iqrabintishafi/ -------------------------------------------------------------------------------------------------------------

While the Log Analytics Workspace  is an excellent tool for monitoring and analyzing logs in Azure, storing logs in a Storage Account  provides a more cost-effective and flexible solution for long-term retention and external access. This setup allows organizations to store logs for extended periods and export them for integration with other tools or services. Why Export Logs to a Storage Account? There are several benefits to exporting tenant logs  and other Azure logs to a Storage Account : Long-Term Retention : You can define a retention policy to keep logs for months or years, depending on compliance and operational requirements. Cost Efficiency : Compared to storing everything in a Log Analytics Workspace, which is more costly for extensive data, Storage Accounts  offer lower-cost alternatives for long-term log retention. Accessibility : Logs stored in a storage account can be accessed through APIs, or via tools like Azure Storage Explorer , allowing easy download, transfer, and external analysis. However, each organization must balance storage needs with costs, as larger volumes of data will increase storage costs over time. ------------------------------------------------------------------------------------------------------------- Steps to Export Tenant Logs to a Storage Account Step 1: Set Up Diagnostic Settings to Export Logs Navigate to Diagnostic Settings : In the Azure portal, search for Azure Active Directory  and select it. Under the Monitoring  section, select Diagnostic settings . Create a New Diagnostic Setting : Click Add diagnostic setting . Name your setting (e.g., "TenantLogStorageExport"). Select Log Categories : Choose the logs you want to export , such as Audit Logs , Sign-in Logs , and Provisioning Logs . Select Destination : Choose Archive to a storage accoun t  and select the storage account where the logs will be stored. Confirm and save the settings. Once configured, the selected logs will start streaming into the specified storage account. ------------------------------------------------------------------------------------------------------------- Accessing Logs with Azure Storage Explorer Azure Storage Explorer  is a free, graphical tool that allows you to easily access and manage data in your storage accounts, including logs stored as blobs . Using Azure Storage Explorer: Download and Install : Install Azure Storage Explorer  on your local machine from here . Connect to Your Azure Account : Launch Storage Explorer and sign in with your Azure credentials. Browse to your storage account  and locate the blobs  where your logs are stored (e.g., insights-logs-signinlogs). View and Download Logs : Use the explorer interface to view the logs. You can download these blobs to your local machine for offline analysis, or even automate log retrieval using tools like AzCopy  or Python scripts. Logs are typically stored in a hierarchical structure, with each log file containing valuable data in JSON or CSV formats. Examples of Log Types in Storage Accounts Here are some common logs that you might store in your storage account : insights-logs-signinlogs : Logs of all user and service sign-in activities. insights-logs-auditlogs : Logs of administrative changes such as adding or removing users, apps, or roles. insights-logs-networksecuritygrouprulecounter : Tracks network security group rules and counters. insights-logs-networksecuritygroupflowevent : Monitors NSG traffic flows. These logs are stored as blobs, while certain logs (e.g., OS logs) might be stored in tables  within the storage account. https://azure.microsoft.com/en-us/products/storage/storage-explorer/ https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema#schema-from-storage-account-and-event-hubs ------------------------------------------------------------------------------------------------------------- Sending Logs to Event Hub for External Systems If you need to export tenant logs or other logs to a non-Azure system , Event Hub  is a great option . Event Hub is a real-time data ingestion service that can process millions of events per second and is often used to feed external systems such as SIEMs  (Security Information and Event Management). How to Configure Event Hub Export: Create Event Hub : Set up an Event Hub  within Azure Event Hubs  service. Configure Diagnostic Settings : Just as you did for the storage account, go to Diagnostic settings  for Azure Active Directory and select Stream to an event hub  as the destination. Enter the namespace  and event hub name . This setup allows you to forward Azure logs in real-time to any system capable of receiving data from Event Hub, such as a SIEM or a custom log analytics platform. https://azure.microsoft.com/en-us/products/event-hubs/ https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-stream-logs-to-event-hub?tabs=splunk ------------------------------------------------------------------------------------------------------------- Leveraging Microsoft Graph API for Log Retrieval In addition to Storage Accounts  and Event Hubs , Azure also supports the Microsoft Graph API  for retrieving tenant logs programmatically. This API allows you to pull log data directly from Azure and Microsoft 365  services. The Graph API  supports many programming languages, including Python, C#, and Node.js, making it highly flexible. It’s commonly used to integrate Azure logs into custom applications or third-party systems. https://developer.microsoft.com/en-us/graph ------------------------------------------------------------------------------------------------------------- All Above logs were part of the tenant logs: Lets start with second log category called Subscription Logs What are Subscription Logs? Subscription logs track and log all activities within your Azure subscription . They record changes made to resources, providing a clear audit trail and insight into tenant-wide services. The primary information recorded includes details on operations, identities involved, success or failure status, and IP addresses. Accessing Subscription Logs Subscription logs are available under the Activity log  in the Azure portal . You can use the logs in multiple ways: View them directly in the Azure portal  for a quick, interactive inspection. Store them in a Log Analytics workspace  for advanced querying and long-term retention. Archive them in a storage account , useful for maintaining a long-term log history. Forward them to a SIEM  (Security Information and Event Management) solution via Azure Event Hub for enhanced security monitoring and correlation. To access the logs in the Azure portal, use the search bar to look for Activity log . This will provide a quick summary view of activities within the portal. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell ------------------------------------------------------------------------------------------------------------- Key Elements of the Subscription Log Schema Each activity log entry has several key fields that can help in monitoring and troubleshooting. When an action, such as creating a new virtual machine (VM), is logged, the following fields provide detailed information: resourceId : This is a unique identifier for the resource that was acted upon, allowing precise tracking of the specific VM, storage account, or network security group. operationName : Specifies the action taken on the resource. For example, creating a VM might appear as MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE. resultType  and resultSignature : These fields show whether the operation succeeded, failed, or was canceled, with additional error codes or success indicators in resultSignature. callerIpAddress : The IP address from which the action originated, identifying the source of the request. correlationId : A unique GUID that ties together all sub-operations in a single request, allowing you to trace a sequence of actions as part of a single change or request. claims : Contains identity details of the principal making the change, including any associated authentication data. This can include fields from an identity provider like Azure AD, giving insight into the user or service making the request. Each log entry captures critical details that aid in understanding who , what , when , and where  changes were made. ------------------------------------------------------------------------------------------------------------- Subscription Log Access Options Azure offers different access and filtering methods for subscription logs. Here’s a breakdown of how you can utilize the portal effectively: Azure Portal : The Azure portal offers a quick, visual way to explore logs . You can select a subscription, set the event severity level (e.g., Critical, Error, Warning, Informational), and define a timeframe for the log entries you need. The Export Activity Logs  option on the top menu or the Diagnostic Settings  on the left allows you to set up data export or view diagnostic logs. Log Analytics Workspace : The Log Analytics workspace offers a more robust and flexible environment for log analysis . By sending your logs here, you can perform advanced queries, create dashboards, and set up alerts. This workspace enables centralized log management, making it an ideal choice for larger organizations or those with specific compliance requirements. Programmatic Access : Using the PowerShell cmdlet Get-AzLog  or the Azure CLI with az monitor activity-log , you can query the activity logs programmatically . This is useful for automated scripts or integrating logs into third-party solutions. Event Hub Integration : For real-time analysis, integrate subscription logs with Event Hub and forward them to a SIEM for security insights and anomaly detection . This setup is beneficial for organizations that require constant monitoring and incident response. https://learn.microsoft.com/en-us/powershell/module/az.monitor/?view=azps-12.4.0#retrieve-activity-log https://learn.microsoft.com/en-us/cli/azure/service-page/monitor?view=azure-cli-latest#view-activity-log ------------------------------------------------------------------------------------------------------------- Subscription Logs in Log Analytics workspace For Detailed analysis, it's best to set up a Log Analytics workspace . This enables centralized log storage and querying capabilities, combining subscription logs with other logs (such as Azure Active Directory logs (Entra ID Logs) ) for a comprehensive view. The setup process is identical to the one for the tenant logs : select the log categories you wish to save and the Log Analytics workspace to send them to. Subscription Log Categories The main log categories available are: Administrative : Tracks actions related to resources, such as creating, updating, or deleting resources via the Azure Resource Manager. Security : Logs security alerts generated by Azure Security Center. Service Health : Reports incidents affecting the health of Azure services. Alert : Logs triggered alerts based on predefined metrics, such as high CPU usage. Recommendation : Records Azure Advisor recommendations for resource optimization. Policy : Logs policy events for auditing and enforcing subscription-level policies. Autoscale : Contains events from the autoscale feature based on usage settings. Resource Health : Provides resource health status, indicating whether a resource is available, degraded, or unavailable. ------------------------------------------------------------------------------------------------------------- Querying Subscription Logs in Log Analytics The logs are stored in the AzureActivity table in Log Analytics . Here are some example queries: Identify Deleted Resources : AzureActivity | where OperationNameValue contains "DELETE" This query is useful for investigating deletions, such as a scenario where a malicious actor deletes a resource group, causing all contained resources to be deleted. Track Virtual Machine Operations : AzureActivity | where OperationNameValue contains "COMPUTE" | distinct OperationNameValue This query lists unique operations related to virtual machines, helpful for getting an overview of VM activity. Count VM Operations : AzureActivity | where OperationNameValue contains "COMPUTE" | summarize count() by OperationNameValue By counting operations, this query provides insights into the volume of VM activities, which can reveal patterns such as frequent VM creation or deletion. ------------------------------------------------------------------------------------------------------------- Archiving and Streaming Logs To save logs for long-term storage or send them to a SIEM: Configure diagnostic settings to specify the storage account or Event Hub for archiving and real-time streaming. Logs stored in a storage account appear in a structured format, often in JSON files within deeply nested directories, which can be accessed and processed using tools like Azure Storage Explorer. By effectively leveraging subscription logs and these configurations, Azure administrators can enhance monitoring, identify security issues, and ensure accountability in their environments. ----------------------------------------------------------------------------------------------------------- Further we will talk in next blog, Until than stay safe and keep learning Akash Patel ---------------------------------------------------------------------------------------------------------- Special Thanks (Iqra) I would like to extend my heartfelt gratitude to one of my dearest colleagues, a Microsoft Certified Trainer, for her invaluable assistance in creating these articles. Without her support, this would not have been possible. Thank you so much for your time, expertise, and dedication! https://www.linkedin.com/in/iqrabintishafi/ -------------------------------------------------------------------------------------------------------------

Microsoft Azure provides a wide range of compute services, organized based on workload types and categorized as Infrastructure as a Service (IaaS) , Platform as a Service (PaaS) , or Software as a Service (SaaS) . For incident response and forensic investigations, the focus is typically on virtual machines (VMs)  and the related networking infrastructure. ----------------------------------------------------------------------------------------------------------- Virtual Machines: Types and Applications Azure offers various classes of virtual machines tailored for different workloads, all with specific performance characteristics. Here’s a breakdown of the most common VM types you'll encounter during an investigation: Series A (Entry Level) : Use Case : Development workloads, low-traffic websites. Examples : A1 v2, A2 v2. Series B (Burstable) : Use Case : Low-cost VMs with the ability to "burst" to higher CPU performance when needed. Examples : B1S, B2S. Series D (General Purpose) : Use Case : Optimized for most production workloads. Examples : D2as v4, D2s v4. Series F (Compute Optimized) : Use Case : Compute-intensive workloads, such as batch processing. Examples : F1, F2s v2. Series E, G, and M (Memory Optimized) : Use Case : Memory-heavy applications like databases. Examples : E2a v4, M8ms. Series L (Storage Optimized) : Use Case : High throughput and low-latency applications. Examples : L4s, L8s v2. Series NC, NV, ND (Graphics Optimized) : Use Case : Visualization, deep learning, and AI workloads. Examples : NC6, NV12s. Series H (High Performance Computing) : Use Case : Applications such as genomic research, financial modeling. Examples : H8, HB120rs v2. https://azure.microsoft.com/en-us/pricing/details/virtual-machines/windows/ https://azure.microsoft.com/en-us/pricing/details/virtual-machines/linux/ VM Storage: Managed Disks Managed Disks  in Azure operate similarly to physical disks but come with a few key distinctions relevant for incident response: Types of Managed Disks : Standard HDD : Slow, low-cost. Standard SSD : Standard for most production workloads. Premium SSD : High performance, better suited for intensive workloads. Ultra Disk : Highest performance for demanding applications. Each VM can have multiple managed disks , including an OS disk, temporary disk (for short-term storage), and one or more data disks. Forensics often involves snapshotting the OS disk  of a compromised VM, attaching that snapshot to a new VM for further analysis. Costs are associated with: Disk type and size. Snapshot size (critical for investigations). Outbound data transfers (when retrieving forensic data). I/O operations (transaction costs). https://learn.microsoft.com/en-us/azure/virtual-machines/managed-disks-overview https://learn.microsoft.com/en-us/azure/virtual-machines/disks-types ----------------------------------------------------------------------------------------------------------- Azure Virtual Network (VNet): The Glue Behind Azure Resources An Azure Virtual Network ( VNet)  allows Azure resources like VMs to communicate with each other and with external networks . During an incident response, it’s essential to understand the network topology  to see how resources were connected, what traffic was allowed, and where vulnerabilities might have existed. Key points about VNets: Private Addressing : Azure assigns a private IP range (typically starting with 10.x.x.x). Public IP Addresses : Required for internet communication, but comes with extra charges. On-Premises Connectivity : Point-to-Site VPN : Connects individual computers to Azure. Site-to-Site VPN : Connects an on-premises network to Azure. Azure ExpressRoute : Private connections that bypass the internet. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview ----------------------------------------------------------------------------------------------------------- Network Security Groups (NSG): Traffic Control and Incident Response NSG Overview : Azure automatically creates NSGs to protect resources, like virtual machines (VMs), by allowing or blocking traffic based on several criteria: Source/Destination IP : IP addresses from which the traffic originates or to which it is sent. Source/Destination Port : The network ports involved in the connection. Protocol : The communication protocol (e.g., TCP, UDP). Rule Prioritization : NSG rules are processed in order of their priority , with lower numbers having higher priority. Custom rules have priorities ranging from 100 to 4096 , while Azure-defined rules have priority in the 65000 range. Incident Response Tip : Ensure that firewall rules are correctly prioritized. A common issue during investigations is discovering that a misconfigured or improperly prioritized rule allowed malicious traffic to bypass protections. Flow Logs :Network flow logs , which capture traffic information, are essential for understanding traffic patterns and investigating suspicious activity . Flow logs are generated every minute, and the first 5GB per month is free. After that, the cost is $0.50 per GB plus storage charges. Example : If an attack involved unauthorized access through a compromised port, flow logs would help you trace the origin and nature of the traffic, providing critical forensic data. https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#network-security-groups ----------------------------------------------------------------------------------------------------------- Network Virtual Appliances (NVA): Advanced Network Security Azure provides additional options for advanced traffic management and security beyond basic NSGs: Azure Load Balancer : Distributes incoming network traffic across multiple resources to balance load. Azure Firewall : Offers advanced filtering, including both stateful network and application-layer inspections. Application Gateway : Protects web applications by filtering out vulnerabilities like SQL injection and cross-site scripting (XSS). VPN Gateway : Connects on-premises networks securely to Azure. Many third-party Network Virtual Appliances  are also available on the Azure Marketplace , such as firewalls, VPN servers, and routers, which can be vital components in your investigation. https://azuremarketplace.microsoft.com/en-us/marketplace/apps/category/networking?page=1&subcategories=all ----------------------------------------------------------------------------------------------------------- Azure Storage: Central to Forensics and Logging Azure storage accounts  are integral to how logs and other data are stored during investigations. Proper storage setup ensures data retention and availability for analysis. Storage Account Types : Blob Storage : Scalable object storage for unstructured data, such as logs or multimedia. File Storage : Distributed file system storage. Queue Storage : For message storage and retrieval. Table Storage : NoSQL key-value store, now part of Azure Cosmos DB . Blob Storage : Blobs  (Binary Large Objects) are highly versatile and commonly used for storing large amounts of unstructured data, such as logs during forensic investigations. Blobs come in three types: Block Blobs : Ideal for storing text and binary data, can handle up to 4.75TB per file. Append Blobs : Optimized for logging, where data is appended rather than overwritten. Page Blobs : Used for random access data, like Virtual Hard Drive (VHD) files. Direct Access and Data Transfers :With the appropriate permissions, data stored in blob storage can be accessed over the internet via HTTP or HTTPS. Azure provides t ools like AzCopy  and Azure Storage Explorer  to facilitate the transfer of data in and out of blob storage. Example : Investigators may need to download logs or snapshots stored in blobs for offline analysis. Using AzCopy  or Azure Storage Explorer , these files can be easily transferred for examination. ----------------------------------------------------------------------------------------------------------- How This Script Helps: VM Information for Analysis : The extracted data (VM ID and VM size) is essential for identifying and analyzing the virtual machines involved in an incident. $results = get-azlog -ResourceProvider "Microsoft.Compute" -DetailedOutput $results.Properties | foreach {$_} | foreach { $contents = $_.content if ($contents -and $contents.ContainsKey("responseBody")) { $fromjson = ($contents.responseBody | ConvertFrom-Json) $newobj = New-Object psobject $newobj | Add-Member NoteProperty VmId $fromjson.properties.vmId $newobj | Add-Member NoteProperty Vmsize $fromjson.properties.hardwareprofile.vmsize $newobj } } ----------------------------------------------------------------------------------------------------------- Conclusion: In Azure, combining effective Network Security Group (NSG)  management with automated VM log extraction  provides essential visibility for incident response. Understanding traffic control through NSGs and using PowerShell scripts for VM log retrieval empowers organizations to investigate security incidents efficiently, even without advanced security tools like SIEM. Akash Patel ---------------------------------------------------------------------------------------------------------- Special Thanks (Iqra) I would like to extend my heartfelt gratitude to one of my dearest colleagues, a Microsoft Certified Trainer, for her invaluable assistance in creating these articles. Without her support, this would not have been possible. Thank you so much for your time, expertise, and dedication! https://www.linkedin.com/in/iqrabintishafi/ -------------------------------------------------------------------------------------------------------------

Alright, let’s dive into a straightforward guide to memory analysis using Volatility. Memory forensics is a vast field, but I’ll take you through an overview of some core techniques to get valuable insights. Let’s go Notes: "This is not a complete analysis; it’s an overview of key steps. In memory forensics, findings can be hit or miss—sometimes we uncover valuable data, sometimes we don’t, so it’s essential to work carefully." Step 1: Basic System Information with windows.info Let’s start by getting a basic overview of the memory image using the windows.info plugin. This gives us essential details like the operating system version, kernel debugging info, and more , which helps us ensure the plugins we’ll use are compatible. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.info Step 2: Listing Active Processes with windows.pslist Now, I’ll list all active processes using windows.pslist and save the output . This helps identify running processes, their parent-child relationships, and a general look at what’s happening in memory. p ython3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.pslist > ./testing/pslist.txt I’m storing the output so we can refer back to it easily . With pslist, we can identify processes and their parent-child links , which can help detect suspicious activity if any processes don’t align with expected behavior. (I am using the SANS Material to make sure processes aligned with parent child) Step 3: Finding Hidden Processes with windows.psscan Next, we move to windows.psscan, which scans for processes, even hidden ones that pslist might miss. This is especially useful for finding malware or processes that don’t show up in regular listings. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.psscan > ./testing/psscan.txt After running psscan, I’ll sort and compare the results with pslist  to see if anything stands out. A quick diff can reveal processes that may be hiding: sort ./testing/psscan.txt > ./testing/a.txt sort ./testing/pslist.txt > ./testing/b.txt diff ./testing/a.txt ./testing/b.txt In my analysis, I found some suspicious processes like whoami.exe and duplicate mscorsvw.exe  entries, which I’ll dig into further to verify their legitimacy. (Later analysis mscorsvw is legit ) Step 4: Examining Process Trees with windows.pstree To get a clearer view of how processes are linked, I’ll use windows.pstree. This shows the process hierarchy, making it easier to spot unusual or suspicious chains, like a random process launching powershell.exe  under a legitimate parent. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.pstree > ./testing/pstree.txt During my analysis, I noticed a powershell.exe instance that used encoded commands to connect to a suspicious IP (http[:]//192.168.200.128[:]3000/launcher.ps1). This could be an indicator of compromise, possibly indicating a malicious script being downloaded and executed. Step 5: Checking Command-Line Arguments with windows.cmdline Now, I’ll use the windows.cmdline plugin to check command-line arguments for processes. This is helpful because attackers often use command-line parameters to hide activity. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.cmdline > ./testing/ cmdline.txt Here, I’m filtering out standard system paths(System 32) to make it easier to focus on anything that might look unusual . If there’s any suspicious execution path, this command can help spot it quickly. (Make sure it doesn't means attacker run processes from comandline) cat ./testing/cmdline.txt | grep -i -v 'system32' Step 6: Reviewing Security Identifiers with windows.getsids To understand the permissions and user context of the processes we’ve identified as suspicious, I’ll check their Security Identifiers (SIDs) using windows.getsids . This can tell us who ran a specific process, helping narrow down potential attacker accounts. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.getsids > ./testing/getsids.txt I’m searching for the user that initiated each suspicious process to see if it’s linked to an unauthorized or unusual account. (For example if you see above screenshot we have identifed powershell and cmd execution) So i have searched through text file: cat ./testing/getsids.txt | grep -i cmd.exe Step 7: Checking Network Connections with windows.netscan Next, I’ll scan for open network connections with windows.netscan to see if any suspicious processes are making unauthorized connections . This is crucial for detecting any malware reaching out to a command-and-control (C2) server. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.netscan > ./testing/netscan.txt In this case, I found some closed connections to a suspicious IP (192.168.200.128:8443), initiated by powershell.exe. This further confirms the likelihood of malicious activity Step 8: Module Analysis with windows.ldrmodules To see if there are unusual DLLs or modules loaded into suspicious processes, I’ll use windows.ldrmodules. This can help catch injected modules or rogue DLLs. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.ldrmodules > ./testing/ldrmodule.txt cat ./testing/ldrmodule.txt | egrep -i 'cmd|powershell' In very simple language: If you see even single one false you have to analyse it manually whether its legit or not (Mostly you will got lot of false positive. This is where DFIR examiner is there to identify if this is legit) Step 9: Detecting Malicious Code with windows.malfind Finally, I’ll scan for potential malicious code within processes using windows.malfind . This command helps by detecting suspicious memory sections marked as PAGE_EXECUTE_READWRITE, which attackers often use. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.malfind > ./testing/malfind.txt Next step I have looked into PID for power shells/cmd. So i can dump those and run antivirus scan or use strings or bstrings. cat ./testing/malfind.txt | grep -i 'PAGE_EXECUTE_READWRITE' I have identified powershell PID and noted down dump an the powershell related malfind processes: (One by One) for PID 5908,6164,8308,1876 (as per screemshot) python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.malfind --dump --pid 5908 Once done now u can run string or bstring to identify character in them or run full disk scan again dump or give it to reverse engineer(Thats on you) (There are commnds avaible you can use those, Again this is an overview you can dig deeper. More commmands you can find in my previous article) https://www.cyberengage.org/post/unveiling-volatility-3-a-guide-to-extracting-digital-artifacts -------------------------------------------------------------------------------------------------------- Digging into Registry Hives Step 1 Moving on to the registry, I’ll first check which hives are available using windows.registry.hivelist. Important hives like NTUSER.DAT can hold valuable info, including recently accessed files. python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.registry.hivelist If you see above screenshot we have most important hives usrclass.dat and Ntuser.dat Fist get a offset of usrclass.dat - 0x9f0c25e75000 and ntuser.dat - 0x9f0c25be8000  in our case Than to check which data is avaible under these two hives: python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.registry.printkey --offset 0x9f0c25be8000  As you can see screenshot little data is intact: After this you can do two things First dump these hives and use tool like registry explorer to analyse further like normal windows registry analysis or You can do is dump all the output in txt file and analyse it here your choice: Lets do with txt file: python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.registry.printkey --offset 0x9f0c25be8000 --recurse > ./testing/ntuser.txt Step 2 Checking User Activity with UserAssist Plugin The userassist plugin helps verify i f specific applications or files were executed by the user— like PowerShell commands. Results may vary, and in this case, it might not yield any findings. Lets suppose this does not work out for me: than use the above ntuser.dat method dumping all userassist into .txt using --recurse and analyse manually (Just change the offset) example: python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.registry.printkey --offset 0x9f0c25e75000 --recurse > ./testing/usrclss.txt Step 3 Scanning for Key Files with Filescan python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.filescan > ./testing/filescan.txt See this is not necessary but why its important .(you can simply use above first and second steps to extract and dump for analysis using registry explorer or examining manually its on you Lets suppose you ran filescan and saved output and you want to check which if you hives like SAM hives or security hives: cat ./testing/filescan.txt | grep -i 'usrclass.dat' | grep 'analyst' This above command will grep usrclass,dat and then grep user analyst, because the powershell executed under user account analyst. Now after going through i have identified multiple hives there that might be useful. I have noted all the offset and what i am going to do is dump all the hives and analyse using registry explorer. Step 4 Dumping Specific Files (Like NTuser.dat, usrclass.dat) python3 vol.py -f /mnt/d/practice_powershell_empire/practice_powershell_empire.vmem windows.dumpfiles --virtaddr Use this for additional files or executable of interest. If data is retrieved, analyze it with tools like RegRipper. Step 5 Similar to above you can search for keyword "history" in filescan.txt if you find history files related to browser or psreadline.txt dump it out analyse it. If u dumping browser history us can browserhistory viewer from nirsoft Step 6 Logs Analysis you can search for logs in our case cat ./testing/filescan.txt | grep -i '.evtx' you can dump the logs and use evtxcmd to parse the logs and analyse it. ------------------------------------------------------------------------------------------------------------- Once done with volatility what i always do. run the strings or bstrings.exe against my Memory images using the IOC i have identified to look for if i can get extra hit and i missed out something example: (If you look above i have found launches.ps1 in IOCs) running strings and bstring again the memory image bstring | grep -i 'launcher.ps1' Below screenshot i looked for IP we have identified as IOC This is what i do after running volatility you do not have do it but its on you! How to run strings/bstrings.exe there is article created link below do check it out https://www.cyberengage.org/post/memory-forensics-using-strings-and-bstrings-a-comprehensive-guide ------------------------------------------------------------------------------------------------------------- Next I have run MemProc5 Analyzer: Dirty Logs in MemProcFS Examining logs, such as those found in MPLogs\Dirty\, reveals possible threats, like PowerShell Grampus or Mimikatz: There are legit files as well u have to defined its legit or not How to run MemProc5 there is article created link below do check it out https://www.cyberengage.org/post/memprocfs-memprocfs-analyzer-comprehensive-analysis-guide ------------------------------------------------------------------------------------------------------------- Conclusion Alright, so we’ve walked through a high-level approach to memory forensics here. E ach tool and plugin we used, like Volatility and MemProcFS, gave us a way to dig into different artifacts, whether it was registry entries, logs, or user files. Some methods hit, some miss—memory analysis can be like that, but the key is to stay thorough. Remember, you may or may not find everything you’re looking for. But whatever you do uncover, like IOCs or specific user actions, adds to your investigation . Just keep at it, keep testing, and let each artifact guide your next step. This is all part of the process—memory forensics is about making the most out of what you have, one artifact at a time. Akash Patel

MemProcFS  is a powerful memory forensics tool that allows forensic investigators to mount raw memory images as a virtual file system . This enables direct analysis of memory artifacts without the need for heavy processing tools. It simplifies the process by converting the memory dump into a filesystem with readable structures like processes, drivers, services, etc. This guide covers best practices for using MemProcFS, from mounting a memory image to performing in-depth analysis using various tools and techniques. -------------------------------------------------------------------------------------------------------- Mounting the Image with MemProcFS The basic command to mount a memory dump using MemProcFS is: MemProcFS.exe -device c:\temp\memdump-win10x64.raw This mounts the memory dump as a virtual file system. However, the best way to use MemProcFS is by taking advantage of its built-in Yara rules  provided by Elastic. These Yara rules allow you to scan for Indicators of Compromise (IOCs) such as malware signatures, suspicious files, and behaviors within the memory image. Command with Elastic Yara Rules To mount a memory image and enable Elastic's Yara rules, use the following command: MemProcFS.exe -device -forensic 1 -license-accept-elastic-license-2.0 The -forensic 1 flag ensures that the image is mounted with forensic options enabled, while the -license-accept-elastic-license-2.0 flag accepts Elastic's license terms for the built-in Yara rules. -------------------------------------------------------------------------------------------------------- Methods for Analysis There are multiple ways to analyze the mounted memory image. Below are the three most common methods: Using WSL (Windows Subsystem for Linux) Using Windows Explorer Using MemProcFS Analyzer Suite 1. Analyzing with WSL (Windows Subsystem for Linux) One of the most efficient ways to analyze the memory dump is by using the Linux shell within Windows, i.e., WSL . By doing this, you can easily use Linux tools such as grep, awk, and strings to filter and search through the mounted image. Step 1: Create a Directory in WSL First, create a directory in WSL where you will mount the memory image: sudo mkdir /mnt/d Step 2: Mount the Windows Memory Image to WSL Next, mount the Windows memory image to the directory you just created. Assuming the image is mounted on the M: drive in Windows, you can mount it to WSL with the following command: sudo mount -t drvfs M: /mnt/d This command mounts the M: drive (where MemProcFS has mounted the memory image) to the /mnt/d directory in WSL . Now you can access the mounted memory dump via WSL for further analysis using grep, awk, strings, and other Linux-based utilities. -------------------------------------------------------------------------------------------------------- 2. Analyzing with Windows Explorer MemProcFS makes it easy to browse the memory image using Windows Explorer  by exposing critical memory artifacts in a readable format. Here’s what each folder contains: Key Folders and Files Sys Folder : Proc : Proc.txt: Lists processes running in memory. Proc-v.txt: Displays detailed command-line information for the processes. Drivers : ers.txt: Contains information about drivers loaded in memory. Net : Netstat.txt: Lists network information at the time of acquisition. Netstat-v.txt: Provides details about network paths used by processes. Services : Services.txt: Lists installed services. Subfolder /byname: Provides detailed information for each service. Tasks : Task.txt: Contains information about scheduled tasks in memory. Name Folder : Contains folders for each process with detailed information such as files, handles, modules, and Virtual Address Descriptors (VADs). PID Folder : Similar to the Name Folder , but uses Process IDs (PIDs) instead of process names. Registry Folder : Contains all registry keys and values available in memory during the dump. Forensic Folder : CSV files  (e.g., pslist.csv): Easily analyzable using Eric Zimmerman's tools. Timeline : Contains timestamped events related to memory activity, available in both .csv and .txt formats. Files Folder : Attempts to reconstruct the system's C: drive from memory. NTFS Folder : Attempts to reconstruct the NTFS file system structure from memory. Yara Folder : Contains results from Yara scans, populated if Yara scanning is enabled. FindEvil Folder: You must determine if files are malicious or legitimate. -------------------------------------------------------------------------------------------------------- 3. Using MemProcFS Analyzer Suite For more automated analysis, MemProcFS comes with an Analyzer Suite that simplifies the process by running pre-configured scripts to extract and analyze data from the memory image. Step 1: Download and Install Analyzer Suite First, download the MemProcFS Analyzer Suite . Inside the suite folder, you will find a script named updater.ps1. Run this script in PowerShell  to d ownload all the necessary binaries and tools for analysis: Step 2: Run the Analyzer Once the setup is complete, you can begin your automated analysis by running the MemProcFS-Analyzer.ps1 script: .\MemProcFS-Analyzer.ps1 This will launch the GUI  for MemProcFS Analyzer . You can then select the mounted memory image and (optionally) the pagefile if it is available. Once you run the analysis, MemProcFS will automatically extract and analyze the data . -------------------------------------------------------------------------------------------------------- Output and Results After running the MemProcFS analysis, the results will be saved in a folder under the script directory. Make sure that you have 7-Zip  installed, as some of the output may be archived. The default password for the archives is MemProcFS . Key Output Files : Parsed Files : Contains all the data successfully parsed by MemProcFS. Unparsed Files : Lists data that could not be parsed by the tool. For further analysis, you can manually review these files using tools like Volatility 3  or by leveraging WSL tools. By reviewing both parsed and unparsed files, you can ensure that no critical information is missed during the analysis. -------------------------------------------------------------------------------------------------------- Considerations and Best Practices Antivirus Interference If you are running MemProcFS Analyzer in a environment, your antivirus software may block certain forensic tools. To avoid interruptions, it is recommended to create exclusions for the tools used by MemProcFS Analyzer or, if necessary, temporarily disable the antivirus software during the analysis. Manual Review of Unparsed Data While MemProcFS automates many aspects of memory forensics, it is crucial to manually check files that were not parsed during the automated process. These files can be analyzed using other memory forensic tools like Volatility 3 , or through manual inspection using WSL commands. -------------------------------------------------------------------------------------------------------- Conclusion MemProcFS  offers a powerful and efficient way to analyze memory dumps by mounting them as a virtual file system. This method allows for both manual and automated analysis using familiar tools like grep, awk, strings, and the MemProcFS Analyzer Suite . Whether you are performing quick IOC triage or a detailed forensic analysis, MemProcFS can handle a wide range of memory artifacts, from processes and drivers to network activity and registry keys. Key Takeaways : MemProcFS is versatile, offering both manual and automated analysis methods. Use Elastic’s built-in Yara rules to enhance your malware detection capabilities. Leverage WSL or Windows Explorer to manually browse and analyze memory artifacts. The Analyzer Suite automates much of the forensic process, saving time and effort. Always review unparsed files to ensure nothing critical is missed. Akash Patel