Provided by SANS

About the course

FOR526: An In-Depth Memory Forensics Training Course

Malware Can Hide, But It Must Run

Digital Forensics and Incident Response (DFIR) professionals need Windows memory forensics training to be at the top of their game. Investigators who do not look at volatile memory are leaving evidence at the crime scene. RAM content holds evidence of user actions, as well as evil processes and furtive behaviors implemented by malicious code. It is this evidence that often proves to be the smoking gun that unravels the story of what happened on a system.

FOR526: Memory Forensics In-Depth provides the critical skills necessary for digital forensics examiners and incident responders to successfully perform live system memory triage and analyze captured memory images. The course uses the most effective freeware and open-source tools in the industry today and provides an in-depth understanding of how these tools work. FOR526 is a critical course for any serious DFIR investigator who wants to tackle advanced forensics, trusted insider, and incident response cases.

In today's forensics cases, it is just as critical to understand memory structures as it is to understand disk and registry structures. Having in-depth knowledge of Windows memory internals allows the examiner to access target data specific to the needs of the case at hand. For those investigating platforms other than Windows, this course also introduces OSX and Linux memory forensics acquisition and analysis using hands-on lab exercises.

There is an arms race between analysts and attackers. Modern malware and post-exploitation modules increasingly employ self-defense techniques that include more sophisticated rootkit and anti-memory analysis mechanisms that destroy or subvert volatile data. Examiners must have a deeper understanding of memory internals in order to discern the intentions of attackers or rogue trusted insiders. FOR526 draws on best practices and recommendations from experts in the field to guide DFIR professionals through acquisition, validation, and memory analysis with real-world and malware-laden memory images.

Course Syllabus

FOR526.1: Foundations in Memory Analysis and Acquisition

Overview

Simply put, memory analysis has become a required skill for all incident responders and digital forensics examiners. Regardless of the type of investigation, system memory and its contents often expose the "first hit" - the evidential thread that we pull to unravel the whole story of what happened on the target system. Where is the malware? How did the machine get infected? Where did the attacker laterally move? Or what did the disgruntled employee do on the system? What lies in physical memory can provide answers to all of these questions and more.

This section emphasizes the relevance and widening application of memory forensics. It is an easy sell in today's world of increasing encryption, burgeoning media storage capacity, and sophisticated backdoor rootkits. The section provides a six-step investigative methodology for both user and malware investigations that will guide an examiner through the exploration of a memory capture.

Memory forensics is the study of operating systems, which in turn work extensively with the processor and its architecture. Therefore, before we can begin a meaningful analysis of the operating system, we must understand how the underlying components work and fit together. This section explains a number of technologies that are used in modern computers and how they have evolved to where they are today.

In the beginning, there is acquisition. So on day one of FOR526, we will acquire a full capture of physical memory from a compromised virtual machine using two different methods. In comparing live memory triage and full memory capture off-line analysis, we discuss the applications of both methods and when to use each technique in an investigation. Acquisition tools are easy to use, but few understand the underlying mechanisms behind the process.

Exercises

• Setting up the Windows 10 VM and Ubuntu SIFT
• Identifying a Hidden Process with Volatility
• Live Memory Analysis with Rekall
• Physical Memory Acquisition Using Winpmem

CPE/CMU Credits: 8

Topics

Why Memory Forensics?

• Advantages of Windows
• Case Study: Hibernation File For the Win
• Types of Evidentiary Findings from Memory

Investigative Methodologies

• Use Cases for Memory Forensics
• Six-Step Process for User Investigations
• Six-Step Process for Malware Investigations

The Ubuntu SIFT and Windows 10 Workstations

• SANS Investigative Forensic Toolkit (SIFT) Workstation Review
• Customizations for FOR526 - Memory Forensics Weapons Arsenal
• Tour: Where Are the Tools? How Do I Use Them?
• Overview of Windows 10 VM Workstation

The Volatility Framework

• Exploring the Underpinnings of the Volatility Framework
• Reliance on the KDBG for System Profiling
• Process Enumeration with Pslist and Psscan
• Identifying a Hidden Process

System Architectures

• 32-bit vs. 64-bit Operating Systems
• x86, x86_64, and IA-64 Architectures
• Virtual and Physical Address Spaces
• Physical Address Extensions
• Virtual to Physical Address Translation

Triage vs. Full Memory Acquisition

• Benefits of Live MemoryTriage
• Obstacles and Use Cases for Triage
• Rekall Memory Forensic Framework
• Live Analysis with Rekall's winpmem

Physical Memory Acquisition

• Obstacles to Acquisition/Anti-Acquisition Behaviors
• Device Memory
• Suspended Virtual Machine
• Firewire Acquisition
• Standalone Memory Acquisition Tools
• Winpmem Practical Application with Pagefile Inclusion

FOR526.2: Unstructured Analysis and Process Exploration

Overview

Structured memory analysis using tools that identify and interpret operating system structures is certainly powerful. However, many remnants of previously allocated memory remain available for analysis that cannot be parsed through structure identification. What tools are best for processing fragmented data? Unstructured analysis tools! They neither know nor care about operating system structures. Instead, they examine data, extracting useful findings using pattern matching. In this section you will learn how to use bulk extractor to parse memory images and extract investigative leads such as e-mail addresses, network packets, and more.

Many forensics investigators perform physical memory analysis - that is why you are taking this course. But how often do you make use of page file analysis to assist in memory investigations? Carving the page file using traditional file system carving tools is usually a recipe for failure and false positives. In this section you will see why typical file carving tools fail and learn how to parse the page file using YARA for signature matching. You will also learn how to create custom YARA signatures to detect downloaded executable files and extract them from the page file.

Most users are familiar with processes on a Windows system, but not necessarily with how they work under the hood. In this section, we will talk about the operating system components that make up a process, how they fit together, and how they can be exploited by malicious software. We will start with the basics of each process, how it was started, where the executable lives, and what command line options were used. Next we will look at the Dynamic Link Libraries (DLLs) used by a program and how they are found and loaded by the operating system.

Many examiners have used some Volatility plugins, and by now so have you. But what happens when there are no plugins written to perform the investigative task required? Do you throw your hands up and walk away? Not if you are a lethal forensicator! In this module, you will learn to use volshell to examine operating system structures in memory, directly applying this knowledge to solve a real-world problem. You need to extract an executable module from memory for analysis, but the header of the module is paged to disk, concealing critical file alignment data. What do you do? You will learn here how to examine the memory that makes up the module and extract the portions in memory to disk. Intractable problem solved!

Exercises

• Unstructured Memory Analysis with Bulk Extractor
• Page File Analysis with Page Brute and YARA
• Using Volshell to Dump Executable Modules from Physical Memory
• Understanding Process Relationships and Detecting Stealthy Malware through Memory Analysis
• Discovering Malware Loaded via DLLs through Memory Analysis

CPE/CMU Credits: 8

Topics

Unstructured Memory Analysis

• Introducing Bulk Extractor
• Extracting Network Data from Memory with Bulk Extractor
• File System Artifact Analysis with Scanner Output
• Advanced Encryption Standard (AES) Key Identification
• Finding Case Leads with Bulk Extractor

Page File Analysis

• How the Page File Works
• Using Pattern Matching to Extract Meaningful Page File Contents
• Writing YARA Signatures to Extract Meaningful Hits from the Page File

Exploring Process Structures

• Analyzing the Kernel Debugging Data Structure (KDBG)
• Analyzing Physical Memory Images - How Do the Tools Start?
• Interactive Memory Analysis Using Volshell
• Processes and Process Structures
• The Process Environment Block (PEB)

List Walking and Scanning

• Why Some Tasks Require List Walking While Others Rely on Scanning
• Locating Evidence in Memory Left Over from Previous Boots
• Locating Processes Hidden by Rootkits
• Differential Analysis to Detect Rootkits and Stealthy Malware

Exploring Process Relationships

• What Operating System Structures Keep Track of Processes?
• Using the Psxview Plugin for Differential Analysis
• Detecting Concealed Processes
• Process Anomalies that Indicate Malware
• Using the Pstree Plugin to Enumerate Command Line Options

Exploring Dynamic Link Libraries

• What Is a DLL?
• Inferring Functionality from DLLs
• Examining DLL Properties
• Enumerating DLL Metadata
• Enumerating DLL Imported and Exported Functions
• Understanding DLL Search Order Hijacking
• Listing DLLs Loaded into Processes
• Extracting DLLs from Memory

Pool Memory

• What Is Pool Memory and Why Does It Matter
• Pool Tags and How They Are Used by Windows
• How to Locate Pool Tags
• Pool Tag Protections

Kernel Objects

• Types of Kernel Objects
• Object Header Structures
• Enumerating Kernel Handle Tables
• Enumerating Recently Opened Files in Memory
• Finding Malware by Tracking Mutexes
• Extracting Memory Mapped Files from Memory Dumps

FOR526.3: Investigating the User via Memory Artifacts

Overview

Incident responders are often asked to triage a system because of a network intrusion detection system alert. The Security Operation Center (SOC) makes the call and requires more information due to outbound network traffic from an endpoint. The incidence response team is asked to respond. This section covers how to enumerate active and terminated TCP connections, selecting the right plugin for the job based on the operating system version.

As we move into the internal structures of a process, virtual address descriptors hold the key to what is contained in the user space memory section. Spotting injected code depends on your ability to analyze what is supposed to be in these sections versus what actually is. This section will make you familiar with dance moves like VADWalk and VADdump, and spotting some DLL injection along the way.

The central theme of section three is user artifact analysis, which makes it a great section to cover the registry. In file system forensics, the registry is a wealth of information on system, software, and user activity. With copies of the registry hives loaded into physical memory, we can undertake the same detailed analysis, including of the volatile hive and keys not found on the file system. Volatility plugins designed specifically for targeting user behavior and evidence of execution are included in our practical application of registry parsing via memory.

This section will also show you how to use the Windows debugger (Windbg ) to perform memory analysis. Using the debugger, you will be able to dump plaintext passwords from memory for logged-on users. Windows stores plaintext passwords in memory for logged-on users. Now you will not need a GPU farm to crack passwords from dumped hashes. Why would a forensic examiner want the suspect's passwords? Because just like everyone else, suspects reuse them! Remember that Truecrypt volume you found on the suspect's machine? Or the encrypted zip file? What do you think the odds are that they used the same password (or an easy permutation) for both?

Exercises

• Locating Network Connections
• Walking the VAD Tree
• Extracting Artifacts from Memory via VAD Analysis
• Diving Deep with VAD Analysis to Extract Stuxnet's Secrets
• Extracting Plain Text Passwords from Memory
• Extracting Clipboard Contents from Memory
• User Artifacts for Acceptable Use Policy (AUP) Investigations

CPE/CMU Credits: 8

Topics

Network Connections

• Network Differences: XP and Windows 7
• Current Network Connections
• Finding Historical and Hidden Network Connections
• Enumerating Listening Ports
• What's Normal in Network Artifacts

Virtual Address Descriptors

• The VAD Tree Structure
• VAD Nodes
• Walking the VAD Tree
• Finding Malware through VAD Analysis
• Extracting VAD Data from Memory

Detecting Injected Code

• Locating Injected DLLs using VADs
• Finding DLL Injection
• Finding Code in VADs
• Detecting Injected Code with Obfuscated Headers

Analyzing the Registry via Memory Analysis

• The Windows Registry in Memory
• Enumerating Registry Hive Structures
• Volatile and Stable Keys
• Registry Analysis Plugins
• Malware Persistence Mechanisms
• Enumerating Services
• Analyzing the Shimcache for Evidence of Execution
• Extracting Password Hashes from Memory Dumps

User Artifacts in Memory

• Evidence of Directory Traversal with Shellbags
• Extracting Clipboard Contents
• Evidence of Execution with Userassist
• Examining Command Prompt Use
• Parsing the Master Boot Record from Memory
• Parsing the MFT from Memory
• Creating Activity Timelines from Memory

FOR526.4: Internal Memory Structures

Overview

Section four focuses on introducing internal memory structures such as drivers, Windows memory table structures, and extraction techniques for portable executables. As we come to the final steps in our investigative methodology - steps that include spotting rootkit behaviors and extracting suspicious binaries - it is important to emphasize again the rootkit paradox, which is that the more malicious code attempts to hide itself, the more abnormal and seemingly suspicious it appears. We will use this concept to evaluate some of the most common structures in Windows memory for hooking, IDTs, and SSDTs.

Once we have deemed something suspicious, it warrants further detailed analysis. Extraction techniques for portable executable (PE) files have already been introduced for drivers (moddump) and dlls (dlldump). In this section, we introduce two methods for extracting an executable. Both of them make use of the PE header in order to reconstruct the extract PE file as close as it can be to that of the original on-disk file. Obstacles such as PE corruption are discussed here along with some advanced work-around techniques, including dumping memory sections via volshell.

The final focus in section four is on sources of memory captures other than a real-time acquisition. Sometimes investigators' luck runs out and they do not complete a memory acquisition before the target system is taken offline or shut down. In these cases, where else can system memory captures be found? Hibernation files and Windows Crash Dump files can be valuable sources of information, regardless of whether you find yourself without a current memory capture. This section covers the structure of the hibernation and Crash Dump file and how to convert both into raw memory images that can easily be parsed using Volatility and other tools in our memory forensics weapons arsenal. In addition, we will analyze a Crash Dump file, and in so doing discover just how Windows responds and what information is captured when a system crashes.

Exercises

• Advanced Memory Analysis of a Rootkit
• Detecting Code Injection with Advanced Volatility Plugins
• Binary and Packed Binary Extraction with Fuzzy Hash Matching
• Analyzing a Crash Dump File with Windbg

CPE/CMU Credits: 8

Topics

Interrupt Descriptor Tables

• Interrupts and Exceptions
• Structured Exception Handling
• Hooking and Inline Hooking of the IDT

System Service Descriptor Tables

• SSDT Kernel API Entries
• Hooking the SSDTs
• SSDT Validation
• Finding Hooked APIs

Drivers

• Driver Stacking
• Walking the List of Loaded Drivers
• Scanning for Modules/Drivers in Memory

Direct Kernel Object Manipulation

• Unlinking from the Active Process List
• Fuzzing and Data Sanity Checks
• Using Sessions to Find Hidden Processes
• Tracking Windows Stations for Subversion

Module Extraction

• The Module Loading Process
• Extracting a Portable Executable
• Special Case Exceptions for Packed Binaries
• MemD5s of Extracted Modules vs. MD5s
• Corrupt PE Headers

Hibernation Files

• Saved System State
• Power Saving Feature
• Serialized Memory Image
• File Format
• Potential Vulnerability to Malware
• Decompression and Use

Crash Dump Files

• Debugging Information
• File Format
• Reconstruction and Use

FOR526.5: Memory Analysis on Platforms Other than Windows

Overview

Windows systems may be the most prevalent platform encountered by forensic examiners today, but most enterprises are not homogeneous. Forensic examiners and incident responders are best served by having the skills to analyze the memory of multiple platforms, including Linux and Mac - that is, platforms other than Windows.

This section starts with a deep dive on Linux memory acquisition and analysis, using the Rekall memory analysis framework. Linux memory analysis has posed serious challenges to investigators in the past, requiring labor-intensive construction of an analysis profile that matches the Linux target system for use with memory analysis tools. Rekall offers the ability to analyze Linux memory images with greater ease, since the profile of the system is recorded in the memory image itself upon acquisition. Students will be introduced to Linux kernel data structures and how to enumerate processes, process mapped memory, and open files and network connections.

Later in the section we cover the collection and analysis of Mac OSX memory. In a 2014 survey, 45 percent of companies reported that they now offer their employees the choice to use a Mac. Mac systems are clearly becoming more common across all environments, including business, academia, and personal use. Subsequently, investigators can expect to find, if they have not already, a Mac system as the subject of a future investigation. In this section, we discuss Mac memory acquisition, making use of a variety of third-party tools such as Rekall's pmem, Mac Memoryze, and Mac Memory Reader. We will use open-source memory analysis frameworks to analyze Mac memory images to recover processes, memory maps, open files, loaded modules, and network connections.

Exercises

• Acquiring Linux System Memory with Rekall's pmem
• Analysis of Linux System Memory and Malware Identification
• Using OSXPmem to Acquire Mac Memory
• Rogue Insider Mac Investigation

CPE/CMU Credits: 8

Topics

Linux Memory Acquisition and Analysis

• Acquiring Memory Using Third-Party Tools
• Linux Virtual Memory Management System
• Linux Kernel Data Structures
• Process Enumeration - Walking the Task_struct List

Mac Memory Acquisition and Analysis

• Memory Acquisition Using Third-Party Tools
• Overview of Mac Memory Structures
• Process Enumeration - Walking the All-proc List
• Dumping Process Memory Maps
• Network Connections, Routing Cache, ARP Cache Extraction
• Rootkit Detection

FOR526.6: Memory Analysis Challenges

Overview

This final section provides students with a direct memory forensics challenge that makes use of the SANS NetWars Tournament platform. Your memory analysis skills are put to the test with a variety of hands-on scenarios involving hibernation files, Crash Dump files, and raw memory images, reinforcing techniques covered in the first five sections of the course. These challenges strengthen the student's ability to respond to typical and atypical memory forensics challenges in all types of cases, from investigating the user to isolating the malware. By applying the techniques learned throughout in the course, students consolidate their knowledge and can shore up skill areas where they feel they need additional practice.

CPE/CMU Credits: 5

Topics

• Malware and Rootkit Behavior Detection
• Persistence Mechanism Identification
• Code Injection Analysis
• User Activity Reconstruction
• Linux Memory Image Parsing
• Mac OSX Memory Image Parsing
• Windows Hibernation File Conversion and Analysis
• Windows Crash Dump Analysis (Using Windows Debugger)

The students who score the highest on the multi-platform memory forensics challenge will be awarded the coveted SANS Digital Forensics Lethal Forensicator Coin. Game on!

Who Should Attend

• Incident Response Team Members who regularly respond to complex security incidents/intrusions and would like to know how memory forensics will expand their reach.
• Experienced Digital Forensic Analysts who want to consolidate and expand their understanding of memory forensics.
• Red Team Members, Penetration Testers, and Exploit Developers who want to learn how their opponents can identify their actions. Discover how common mistakes can compromise operations on remote systems, and how to avoid them. This course covers remote system forensics and data collection techniques that can be easily integrated into post-exploit operating procedures and exploit testing batteries.
• Law enforcement officers, federal agents, or detectives who want to become a deep subject-matter expert on memory forensics.
• SANS FOR508 and SEC504 Graduates looking to take their memory forensics skills to the next level.
• Forensics Investigators working in organizations where memory is regularly obtained by first responders, and who want to raise the bar by analyzing the images.

Prerequisites

Students will benefit from having some experience with Windows forensics, either by attending FOR408 or through forensic casework or incident investigations.

What You Will Receive

SIFT Workstation 3

• This course extensively uses the SIFT Workstation 3 to teach incident responders and forensic analysts how to respond to and investigate sophisticated attacks. SIFT contains hundreds of free and open-source tools, easily matching any modern forensic and incident response commercial tool suite.
• Ubuntu LTS Base
• 64-bit based system
• Better memory utilization
• Auto-DFIR package update and customizations
• Latest forensic tools and techniques
• VMware Appliance ready to tackle forensics
• Cross-compatibility between Linux and Windows
• Expanded Filesystem Support (NTFS, HFS, EXFAT, and more)

Windows 8.1 Workstation with license

• 64-bit based system
• A licensed virtual machine loaded with the latest forensic tools
• VMware Appliance ready to tackle forensics

32 GB Course USB 3.0

• USB loaded with memory captures, SIFT workstation 3, tools, and documentation

SANS Memory Forensics Exercise Workbook

• Exercise book is over 200 pages long with detailed step-by-step instructions and examples to help you become a master incident responder

SANS DFIR Cheat sheets to Help Use the Tools

MP3 audio files of the complete course lecture