Available Windows DFIR Toolset
Introduction
This section provides an overview of the installed DFIR toolset within the Windows Purple targets, detailing the available tools/solutions and their respective locations.
DFIR Toolset Installed
Below is a list of the DFIR toolset installed on the Windows Purple module targets for post-exploitation forensic analysis purposes, along with their respective installation paths.
System Monitoring (Event Logging)
| Name | Path | Description |
| Sysmon | C:\Windows\Sysmon64.exe | Provides detailed event logging and detection. |
Log Analysis
| Name | Path | Description |
| Eric Zimmerman Tools | C:\Tools\EZ-Tools | Forensic utilities for analyzing digital evidence, such as registry hives and event logs. |
Threat Detection & Monitoring
| Name | Path | Description |
| Yara | C:\Tools\yara\yara.exe | Signature-based file scanning tool. |
| Chainsaw | C:\Tools\Sigma\chainsaw\chainsaw_x86_64-pc-windows-msvc.exe | Command-line tool for parsing and hunting through Windows Event Logs. |
| Sigma | C:\Program Files\Python312\Scripts\sigma.exe | Generic signature format for SIEM rule creation. |
| Zircolite | C:\Tools\Sigma\zircolite\zircolite_win_x64_2.20.0.exe | Sigma-based EVTX log analysis. |
| Osquery | C:\Program Files\osquery\osqueryi.exe | Endpoint monitoring using SQL-like queries. |
| Velociraptor | C:\Program Files\Velociraptor (https://<Target_IP>:8889) | Endpoint monitoring, collection, and response. |
Notes:
Specify the following credentials to log into
Velociraptor:Username:
adminPassword:
P3n#31337@LOG
Allow Windows Purple module targets to run for at least 5 minutes after spawningto ensure that all services have fully initialized (including Velociraptor).
Traffic Capturing
| Name | Path | Description |
| Wireshark | C:\Program Files\Wireshark | Packet capture tool for network traffic analysis. |
Memory Dumping
| Name | Path | Description |
| DumpIt | C:\Tools\Memory-Dump\DumpIt.exe | Memory dumping utility for memory forensics. |
| WinPmem | C:\Tools\Memory-Dump\winpmem_mini_x64_rc2.exe | Memory dumping utility for memory forensics. |
Memory Forensics
| Name | Path | Description |
| Volatility v2 | C:\Tools\Volatility2 | Memory forensics tool for analyzing memory dumps. |
| Volatility v3 | C:\Tools\volatility3 | Memory forensics tool for analyzing memory dumps. |
Additional Telemetry
| Name | Path | Description |
| SilkETW | C:\Tools\SilkETW\SilkETW\SilkETW.exe | C# wrappers for ETW. |
| SealighterTI | C:\Tools\SealighterTI.exe | Running Microsoft-Windows-Threat-Intelligence without a driver. |
| AMSI-Monitoring-Script | C:\Tools\AMSIScript\AMSIScriptContentRetrieval.ps1 | Extracting script contents using the AMSI ETW provider. |
| JonMon | C:\Tools\JonMon | Collection of open-source telemetry sensors. |
| Fibratus (Added after this module's release; not available in its targets) | C:\Program Files\Fibratus | Adversary tradecraft detection using behavior-driven rule engine and YARA memory scanner. Event logs can be viewed in Application logs in Event Viewer |
Adversary Simulation
| Name | Path | Description |
| Atomic Red Team (Added after this module's release; not available in its targets) | C:\AtomicRedTeam | Small and highly portable detection tests based on MITRE's ATT&CK. |
Malware/Process/PE Analysis
| Tool | Path | Description |
| CFF-Explorer | C:\Tools\CFF-Explorer\CFF Explorer.exe | Tool designed for examining and editing Portable Executable (PE) files. |
| Ghidra | C:\Tools\Ghidra\ghidraRun.bat | Software reverse engineering (SRE) framework. |
| x64dbg | C:\Tools\x64dbg | Open-source x64/x32 debugger for windows. |
| SpeakEasy | C:\Tools\speakeasy | Modular, binary emulator designed to emulate Windows kernel and user mode malware. |
| SysInternalsSuite | C:\Tools\SysinternalsSuite | Sysinternals Troubleshooting Utilities. |
| Get-InjectedThread | C:\Tools\Get-InjectedThread.ps1 | Looks for threads that were created as a result of code injection. |
| Hollows_Hunter | C:\Tools\hollows_hunter64.exe | Scans all running processes. Recognizes and dumps a variety of potentially malicious implants. |
| Moneta | C:\Tools\Moneta64.exe | Live usermode memory analysis tool for Windows with the capability to detect malware IOCs. |
| PE-Sieve | C:\Tools\pe-sieve64.exe | Detects malware running on the system, as well as collects the potentially malicious material for further analysis. |
| API-Monitor | C:\Tools\API Monitor | Monitors and controls API calls made by applications and services. |
| PE-Bear | C:\Tools\PE-bear | Multiplatform reversing tool for PE files. |
| ProcessHacker | C:\Tools\ProcessHacker | Monitors system resources, debugs software and detects malware. |
| ProcMonX | C:\Tools\ProcMonX.exe | Extended Process Monitor-like tool based on Event Tracing for Windows. |
| Frida (Added after this module's release; not available in its targets) | C:\Program Files\Python312\Scripts\frida.exe | Dynamic instrumentation toolkit for reverse-engineers. Helps to trace, instrument, debug and hook API functions |
| LitterBox (Added after this module's release; not available in its targets) | C:\Tools\LitterBox\litterbox.py | Malware sandbox environment for payload behavior testing. |
About the author
- Mình thích tìm hiểu công nghệ đặc biệt về lĩnh vực an toàn thông tin. Mình có ghi chú các bài này chủ yếu luyện tiếng Anh và đọc thêm. Cảm ơn mọi người đã quan tâm và đón đọc. Nếu có góp ý gì xin hãy liên lạc với mình nhé!
Comments
Join the discussionNo comments yet. Be the first to comment.