Carvey Perl Scripting for Windows Security

Live Response, Forensic Analysis, and Monitoring
1. Auflage 2011
ISBN: 978-0-08-055563-8
Verlag: Elsevier Science & Techn.
Format: EPUB
Kopierschutz: 6 - ePub Watermark

E-Book, Englisch, 232 Seiten

I decided to write this book for a couple of reasons. One was that I've now written a couple of books that have to do with incident response and forensic analysis on Windows systems, and I used a lot of Perl in both books. Okay...I'll come clean...I used nothing but Perl in both books! What I've seen as a result of this is that many readers want to use the tools, but don't know how...they simply aren't familiar with Perl, with interpreted (or scripting) languages in general, and may not be entirely comfortable with running tools at the command line. This book is intended for anyone who has an interest in useful Perl scripting, in particular on the Windows platform, for the purpose of incident response, and forensic analysis, and application monitoring. While a thorough grounding in scripting languages (or in Perl specifically) is not required, it helpful in fully and more completely understanding the material and code presented in this book. This book contains information that is useful to consultants who perform incident response and computer forensics, specifically as those activities pertain to MS Windows systems (Windows 2000, XP, 2003, and some Vista). My hope is that not only will consultants (such as myself) find this material valuable, but so will system administrators, law enforcement officers, and students in undergraduate and graduate programs focusing on computer forensics.*Perl Scripting for Live Response
Using Perl, there's a great deal of information you can retrieve from systems, locally or remotely, as part of troubleshooting or investigating an issue. Perl scripts can be run from a central management point, reaching out to remote systems in order to collect information, or they can be 'compiled' into standalone executables using PAR, PerlApp, or Perl2Exe so that they can be run on systems that do not have ActiveState's Perl distribution (or any other Perl distribution) installed.
*Perl Scripting for Computer Forensic Analysis
Perl is an extremely useful and powerful tool for performing computer forensic analysis. While there are applications available that let an examiner access acquired images and perform some modicum of visualization, there are relatively few tools that meet the specific needs of a specific examiner working on a specific case. This is where the use of Perl really shines through and becomes apparent.
*Perl Scripting for Application Monitoring
Working with enterprise-level Windows applications requires a great deal of analysis and constant monitoring. Automating the monitoring portion of this effort can save a great deal of time, reduce system downtimes, and improve the reliability of your overall application. By utilizing Perl scripts and integrating them with the application technology, you can easily build a simple monitoring framework that can alert you to current or future application issues.

Harlan Carvey is a senior information security researcher with the Dell SecureWorks Counter Threat Unit - Special Ops (CTU-SO) team, where his efforts are focused on targeted threat hunting, response, and research. He continues to maintain a passion and focus in analyzing Windows systems, and in particular, the Windows Registry.Harlan is an accomplished author, public speaker, and open source tool author. He dabbles in other activities, including home brewing and horseback riding. As a result, he has become quite adept at backing up and parking a horse trailer. Harlan earned a bachelor's degree in electrical engineering from the Virginia Military Institute, and a master's degree in the same discipline from the Naval Postgraduate School. He served in the United States Marine Corps, achieving the rank of captain before departing the service. He resides in Northern Virginia with his family.

Autoren/Hrsg.

Carvey, Harlan

Inhaltsverzeichnis

1;Front Cover;1
2;Perl Scripting for Windows Security: Live Response, Forensic Analysis, and Monitoring;2
3;Copyright Page;4
4;Dedication Page;6
5;Author;8
6;Technical Editor;9
7;Contributing Author;10
8;Contents;12
9;Preface;14
10;Author Acknowledgements;24
11;Part I: Perl Scripting and Live Response;25
11.1;Built-in Functions;26
11.1.1;Win32.pl;26
11.1.2;Pclip.pl;27
11.2;Running Processes;28
11.2.1;Netstat1.pl;29
11.2.2;Netstat2.pl;30
11.2.3;Netstat3.pl;31
11.3;Accessing the API;32
11.3.1;Getsys.pl;34
11.4;WMI;38
11.4.1;Fw.pl;39
11.4.2;Nic.pl;44
11.4.3;Ndis.pl;48
11.4.4;Di.pl;52
11.4.5;Ldi.pl;56
11.5;Accessing the Registry;60
11.5.1;Bho.pl;60
11.5.2;Uassist.pl;62
11.6;ProScripts;68
11.6.1;Acquire1.pl;68
11.7;Final Touches;71
12;Part II: Perl Scripting and Computer Forensic Analysis;73
12.1;Log Files;74
12.2;Parsing Binary Files;75
12.2.1;Lslnk.pl;76
12.3;Registry;82
12.3.1;SAMParse.pl;84
12.3.2;SECParse.pl;92
12.3.3;Recentdocs.pl;95
12.3.4;UAssist.pl;99
12.4;Event Logs;104
12.4.1;Evt2xls.pl;104
12.5;Parsing RAM Dumps;111
12.5.1;Lsproc.pl;112
12.5.2;Lspi.pl;118
12.6;ProScripts;129
12.6.1;Uassist.pl;130
12.6.2;SysRestore.pl;134
12.6.3;Prefetch.pl;141
12.7;Parsing Other Data;146
12.7.1;Cc-sort.pl;152
12.8;Final Touches;152
13;Part III: Monitoring Windows Applications with Perl;155
13.1;In This Toolbox;156
13.2;Core Application Processes;156
13.2.1;Monitoring System Key Performance Indicators;157
13.2.1.1;Monitoring System CPU Utilization;157
13.2.1.2;Monitoring System Memory Utilization;163
13.2.1.3;Monitoring System Network Utilization;165
13.3;Monitoring a Core Application Process;169
13.3.1;Monitoring Process Availability a Specific Process;169
13.3.2;Monitoring CPU Utilization for a Specific Process;173
13.3.3;Monitoring Memory Utilization for a Specific Process;176
13.4;Setting and Using Thresholds;178
13.4.1;Loading an XML Configuration File;179
13.4.2;Evaluating Thresholds;182
13.4.3;Taking Action;187
13.4.4;Putting it all Together;192
13.5;Core Application Dependencies;197
13.5.1;Monitoring Remote System Availability;198
13.5.2;Monitoring Available Disk Space;199
13.5.3;Monitoring Remote Disk Availability;201
13.5.4;Monitoring Remote Databases;203
13.5.5;Monitoring Other Dependencies;204
13.6;Web Services;205
13.6.1;Monitoring Web Service Availability;205
13.6.2;Monitoring Web Service Functionality;207
13.7;Building a Monitoring System;209
13.8;Summary;216
14;Index;217