Incident Response Lifecycle:

In the event that one of your endpoint protection software identifies malicious software on a laptop, this blog will provide steps that can ensure the spread of the malware is contained immediately.  The normal scenario is an employee contacting the security team via Slack to set up a bridged call outside of the organization’s network. This playbook presents methods which the Security Team or an employee can follow to investigate the incident by downloading necessary software, exporting logs from the system, and determining impact. This blog post will provide a supplemental process in the event of anomalous endpoint activity on a device where EDR has not triggered an alert, which is quite common. 

Options for Incident Response Strategy

1. If impact is high, then the employee will need to disconnect the laptop from the internet, keep the laptop turned on to preserve artifacts for digital forensics, and bring the laptop on-site (if possible). 
2. If impact is medium to low, then security will work with IT to ensure that all accounts which the employee has access to are temporarily locked to prevent unauthorized access. 
   1. Setup remote connection to laptop via ScreenWise

Windows Analysis VM Setup

1. 1. Download Visual Studio Code
      1. https://code.visualstudio.com/Download
   2. Download Developer Command Prompt for VS 2019
      1. https://visualstudio.microsoft.com/visual-cpp-build-tools/
   3. Download Rust (from git bash vscode terminal)
      1. curl –proto ‘=https’ –tlsv1.2 -sSf https://sh.rustup.rs | sh
   4. Close and Restart VS Code to ensure that the rust environment variables are applied
   5. Download Chainsaw
      1. git clone –recurse-submodules https://github.com/countercept/chainsaw.git

• Open folder within Visual Studio Code

1. 1. cargo build –release

Export Windows Logs from Victim 

1. Remote into laptop through ScreenWise, Zoom Remote, or LogmeIn
2. Login to Administrator account
3. Go to Start Menu > Type in Event Viewer
4. Go to Windows Logs > Security > Actions > Save all events > Save it to Documents Folder (Repeat steps for Application, Setup, & System Logs)                                                                                                                                                                     
5. Create Folder “evntvwer” > copy files there > left click & compress folder
6. Get the checksum of the zipped folder
7. Security member to create shared Google Drive folder and upload files from victim laptop
8. Download zipped folder from google and check the hash to ensure that the file hasn’t been corrupted in transit
   1. Certutil -hashfile <filename> md5

Why are we using Chainsaw?

Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows event logs. It offers a generic and fast method of searching through event logs for keywords, and by identifying threats using built-in detection logic and via support for Sigma detection rules.

Hunt Through Logs

Ideally it’s best to review artifacts on a controlled sandboxed environment such as a dual homed VM setup. If that’s not possible, setup a windows 10 ec2 or windows VM. 

1. Open Visual Studio code
2. File > Open Folder to previously downloaded Chainsaw folder
3. Type “ctrl+shift+x” to bring up extensions as seen below. Search marketplace and install both the C/C++ & Python extensions
4. Go to chainsaw folder > cd target > cd > release > this is where the compiled binary will be
5. Run ./chainsaw.exe to view all arguments with tool
6. $ ./chainsaw.exe hunt C:\\path\\to\\logs\\security.evtx 

References

D, J., & Kornitzer, A. (2021). countercept/chainsaw: Rapidly Search and Hunt through Windows Event Logs. GitHub. Retrieved June 18, 2022, from https://github.com/countercept/chainsaw

Figueroa, M. (2021, January 4). Building a Custom Malware Analysis Lab Environment – SentinelLabs. SentinelOne. Retrieved June 18, 2022, from https://www.sentinelone.com/labs/building-a-custom-malware-analysis-lab-environment/

13Cubed. (2021, October 25). Event Log Chainsaw Massacre – Powerful Threat Detection. YouTube. Retrieved June 18, 2022, from https://www.youtube.com/watch?v=YN_kffuC6a8