When Macs Get Hacked - SANS Computer Forensics

More documents

Recommendations

Info

Incident Response: Network Data – ARP Table arp –an! ifconfig! bit:~ user$ arp -an! ? (169.254.204.125) at b8:c7:5d:cc:5:80 on en1 [ethernet]! ? (172.16.152.255) at ff:ff:ff:ff:ff:ff on vmnet8 ifscope [ethernet]! ? (172.16.243.255) at ff:ff:ff:ff:ff:ff on vmnet1 ifscope [ethernet]! ? (192.168.1.1) at c0:3f:e:8c:59:59 on en1 ifscope [ethernet]! ? (192.168.1.133) at 3c:7:54:3:65:20 on en1 ifscope [ethernet]! ? (192.168.1.241) at 68:9:27:32:15:9c on en1 ifscope [ethernet]! ? (192.168.1.254) at e0:69:95:50:4c:6 on en1 ifscope [ethernet]! ? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en1 ifscope [ethernet]! …! bit:~ user$ ifconfig! en0: flags=8863 mtu 1500! !options=2b! !ether c4:2c:03:09:ca:fd ! !media: autoselect (none)! !status: inactive! en1: flags=8863 mtu 1500! !ether 90:27:e4:f8:e6:5f ! !inet6 fe80::9227:e4ff:fef8:e65f%en1 prefixlen 64 scopeid 0x5 ! !inet 192.168.1.101 netmask 0xffffff00 broadcast 192.168.1.255! !media: autoselect! !status: active! oompa@csh.rit.edu | @iamevltwin
Incident Response: Open Files lsof! bit:~ user$ lsof! COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME! loginwind 65 user cwd DIR 14,4 1156 2 /! loginwind 65 user txt REG 14,4 1421280 501728 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/ loginwindow! loginwind 65 user txt REG 14,4 118384 424796 /System/Library/LoginPlugins/FSDisconnect.loginPlugin/Contents/ MacOS/FSDisconnect! loginwind 65 user txt REG 14,4 19328 281526 /private/var/folders/xq/yjffvqj90s313s17vy12w7nr0000gn/C/ com.apple.scriptmanager.le.cache! loginwind 65 user txt REG 14,4 17284 27515 /System/Library/PrivateFrameworks/CoreWLANKit.framework/Versions/A/ Resources/AirPort3.pdf! …! Mail 141 user 41u REG 14,4 1806336 604815 /Users/user/Library/Caches/com.apple.mail/Cache.db! Mail 141 user 42w REG 14,4 20748 282135 /Users/user/Library/Logs/Sync/syncservices.log! Mail 141 user 43u REG 14,4 40960 629603 /Users/user/Library/Application Support/AddressBook/MailRecentsv4.abcdmr! …! Google 144 user txt REG 14,4 270336 769873 /Users/user/Library/Caches/Google/Chrome/Default/Media Cache/data_1! Google 144 user txt REG 14,4 8192 769874 /Users/user/Library/Caches/Google/Chrome/Default/Media Cache/data_2! Google 144 user txt REG 14,4 8192 769875 /Users/user/Library/Caches/Google/Chrome/Default/Media Cache/data_3! oompa@csh.rit.edu | @iamevltwin
Page 1 and 2: When Macs Get Hacked Sarah Edwards
Page 3 and 4: Current Threats: Suspicious Use Key
Page 5 and 6: Current Threats: Imuler Hidden .app
Page 7 and 8: Current Threats: MacControl MS Word
Page 9 and 10: Windows Investigations Incident Res
Page 11 and 12: Incident Response: MacQuisition by
Page 13 and 14: Incident Response: MacResponse by A
Page 15 and 16: Incident Response: System Informati
Page 17: Incident Response: Network Data - R
Page 21 and 22: Incident Response: Running Processe
Page 23 and 24: Incident Response: System Profiler
Page 25 and 26: Memory Analysis: Volafox http://cod
Page 27 and 28: Memory Analysis: Volafox oompa@csh.
Page 29 and 30: Mac Autoruns What XPC Services Laun
Page 31 and 32: Autoruns: XPC Services Example oomp
Page 33 and 34: Autoruns: Launch Agents Agent - Bac
Page 35 and 36: Autoruns: Launch Agents Examples oo
Page 37 and 38: Autoruns: Launch Daemons Daemon - B
Page 39 and 40: Autoruns: LoginItems Launched when
Page 41 and 42: Autoruns: Deprecated Methods /etc/c
Page 43 and 44: Internet History What Browsers Safa
Page 45 and 46: Internet History: Safari - Download
Page 47 and 48: Internet History: Safari - Last Ses
Page 49 and 50: Internet History: Chrome - Internet
Page 51 and 52: Internet History: Chrome - Cache ~/
Page 53 and 54: Internet History: FireFox - Cache ~
Page 55 and 56: Email: Apple Mail ~/Library/Mail/V2
Page 57 and 58: Email: Apple Mail - Attachments “
Page 59 and 60: Temp & Cache Directories: Java Temp
Page 61 and 62: Java Temp & Cache: IDX File Content
Page 63 and 64: Log Analysis What Apple System Logs
Page 65 and 66: Log Analysis: Console.app oompa@csh
Page 67 and 68: Log Analysis: syslog Command oompa@
Page 69 and 70:
Log Analysis: Audit Logs Location:
Page 71 and 72:
Log Analysis: User Logins / Logouts
Page 73 and 74:
Log Analysis: Privilege Escalation
Page 75 and 76:
Log Analysis: Firewall Logs Locatio
Page 77 and 78:
Log Analysis: Log Recovery Logs get
Page 79 and 80:
Volume Analysis: system.log & daily
Page 81 and 82:
Volume Analysis: kernel.log Jun 3 1
Page 83 and 84:
Antivirus What Extended Attributes
Page 85 and 86:
Antivirus: File Quarantine Applicat
Page 87 and 88:
Antivirus: File Quarantine Quaranti
Page 89 and 90:
Antivirus: Extended Attributes ! co
Page 91 and 92:
Antivirus: XProtect oompa@csh.rit.e
Page 93 and 94:
Antivirus: Third-Party Software Kas
Page 95 and 96:
Anti-forensics: FileVault Encryptio
Page 97 and 98:
Anti-forensics: Optimization Softwa
Page 99 and 100:
Other Files: Kernel Extensions Dyna
Page 101 and 102:
Other Files: User Accounts /private
Page 103 and 104:
Other Files: Shared Directory /User
Page 105 and 106:
Basic Reverse Engineering: Static:
Page 107 and 108:
Basic Reverse Engineering: Static:
Page 109 and 110:
Basic Reverse Engineering: Dynamic:
Page 111 and 112:
Basic Reverse Engineering: Dynamic:
Page 113 and 114:
Basic Reverse Engineering: Other To
show all

When Macs Get Hacked - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?