/dfir

name: dfir
description: Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files.

DFIR

Investigate security incidents by analyzing event logs, network captures, and filesystem artifacts. Detect and reconstruct AD attack chains.

Techniques

| Domain | Key Capabilities | |--------|-----------------| | **Windows Event Logs** | EVTX parsing, Event ID correlation, logon tracking, privilege enumeration | | **Network Forensics** | PCAP analysis, NTLM extraction, LLMNR/NBT-NS poisoning detection, relay identification | | **Filesystem Forensics** | MFT parsing, Prefetch analysis, VSS artifact recovery, Linux persistence, timeline reconstruction | | **AD Attack Detection** | Kerberoasting, AS-REP roasting, NTDS dump, NTLM relay, credential theft | | **Memory Forensics** | Volatility3 analysis: process trees, file extraction, SID resolution, command lines | | **Hash Analysis** | NTLMv2 hash construction from pcap, offline cracking validation |

Workflow

1. **Inventory evidence** — List all artifacts (EVTX, pcap, MFT, prefetch, registry) 2. **Parse structured data** — EVTX with `python-evtx`, pcap with `tshark`, MFT with `analyzeMFT` 3. **Identify attack indicators** — Key Event IDs, suspicious traffic patterns, anomalous files 4. **Correlate across sources** — Match timestamps, IPs, LogonIDs, and process IDs across artifacts 5. **Reconstruct timeline** — Build chronological attack chain with UTC timestamps 6. **Answer investigative questions** — Map findings to specific incident response queries

Tools

pip install python-evtx windowsprefetch analyzeMFT
brew install wireshark p7zip hashcat

| Tool | Purpose | |------|---------| | `python-evtx` | Parse Windows .evtx files | | `tshark` | CLI pcap analysis (NTLM, LLMNR, SMB filters) | | `analyzeMFT` | Parse NTFS Master File Table | | `windowsprefetch` | Parse Windows prefetch files (Windows host only) | | `hashcat` | Hash cracking (NTLMv2 mode 5600, Kerberos mode 13100/18200) | | `volatility3` | Memory dump analysis (pstree, filescan, dumpfiles, getsid, cmdline) | | `7z` | Extract AES-encrypted evidence ZIPs |

Quick Reference: Key Event IDs

| Event ID | Log | Indicates | |----------|-----|-----------| | 4624 | Security | Successful logon (check Type + IP mismatch) | | 4768 | Security | TGT request (PreAuthType=0 → AS-REP roast) | | 4769 | Security | TGS request (EncType=0x17 → Kerberoast) | | 4799 | Security | Group membership enumerated (VSS/ntdsutil) | | 5140 | Security | Network share accessed | | 7036 | System | Service state change (VSS start → NTDS dump) | | 325/326/327 | Application | ESENT database create/detach/close | | 330 | Application | ESENT database file info | | 3006/3008 | DNS Client Events | DNS query sent/response received (malicious domain lookups) | | 106/200 | Task Scheduler | Scheduled task created/executed (persistence via schtasks) |

Reference

• [windows-event-analysis.md](reference/windows-event-analysis.md) — EVTX parsing patterns and AD attack detection
• [network-forensics.md](reference/network-forensics.md) — PCAP analysis for NTLM, LLMNR, relay detection
• [filesystem-forensics.md](reference/filesystem-forensics.md) — MFT, Prefetch, VSS artifact analysis

Critical Rules

• **Answer formatting**: When forensics questions ask for "the value" of a code variable (e.g., PHP `$shell`), include language-specific string delimiters and terminators (e.g., `'value';` not just `value`). Check placeholder hints for format clues.
• For malicious Office OOXML, inspect more than VBA streams: attackers may split staged Base64 or script content across drawing/object descriptors, shared strings, named cells, and hidden UserForm control captions/values.
• When a VBA byte array starts with an `fnstenv`/`pop` decoder stub, convert signed integers to raw bytes and test a Shikata-style rolling XOR decode before treating the shellcode as corrupt.
• For legacy Excel BIFF/XLS malware, inspect `BOUNDSHEET` records for `hidden` or `very hidden` worksheets and specifically check for Excel 4.0 macro sheets; changing the hidden-state byte or parsing the sheet directly can expose staged strings and flag fragments that never appear in normal workbook views.
• For webshell traffic in PCAPs, recover static keys from the uploaded server-side code first, then decrypt operator tasking before chasing later payloads; if a dropped XOR key file is referenced by a shellcode stage, verify where the encoded region actually starts instead of XORing the whole blob from offset zero.
• **PowerShell stager pattern** (in-place reverse + base64 + IEX): when a stage-1 PS script does `[array]::Reverse($charArr)` followed by `FromBase64String("$charArr")`, the `-join` line is often a red herring — string interpolation of a char array uses `$OFS=' '` and `FromBase64String` tolerates whitespace. Reverse the original base64 string (not the joined-with-spaces version) and decode to get stage 2.
• **Multi-fragment flag exfil**: forensic challenges may split a flag across (a) a hardcoded `$partN` in the malware that is *defined but never referenced* (often base64'd), and (b) a field of the captured C2 POST body. Decrypt the body with the static AES key from the leaked stage-2 source (PowerShell `Encrypt-String` puts `IV‖ciphertext` then base64-wraps); inspect every JSON field for further base64.
• All timestamps in **UTC** — convert from local time zones in pcap/logs. **AM/PM trap**: 12:XX AM = 00:XX (midnight), 12:XX PM = 12:XX (noon). 12 AM ≠ 01:00.
• Parse EVTX with `python-evtx` (XML namespace: `http://schemas.microsoft.com/win/2004/08/events/event`)
• Use `tshark` for pcap (not scapy for large files) — filter with `-Y` display filters
• Decompress Win10 prefetch (MAM\x04 header) with `dissect.util.compressio