Discovery (TA0007) Techniques
Introduction
Forensically investigating discovery techniques on workstations and server systems involves identifying how an attacker or malicious entity gathered information about your systems and network. Discovery is a tactic in the MITRE ATT&CK framework that encompasses various techniques used by adversaries to gain knowledge about the system, network, and environment they have compromised.
Understanding Common Discovery Techniques
System and Network Discovery: Identifying system configurations, network resources, and devices.
Account Discovery: Gathering information about user accounts.
File and Directory Discovery: Searching for files and directories of interest.
Software Discovery: Identifying installed applications and software.
Command and Control Discovery: Detecting communication with C&C servers.
Data Collection and Preservation
Forensic Imaging: Use tools like EnCase, AXIOM Cyber, FTK Imager or dd to create images of affected systems.
Memory Capture: Employ tools like Magnet RAM Capture or WinPmem to capture volatile memory.
Log Collection: Collect security logs, system logs, application logs, and command execution logs.
Log Analysis
Security and System Logs: Look for signs of reconnaissance activities, such as frequent access to system information utilities or scripts.
Authentication Logs: Check for unusual login attempts or user enumeration activities.
Network Logs: Review logs for signs of network scanning or mapping activities.
File and Directory Analysis
File Access Logs: Investigate logs for access to specific files or directories containing sensitive information.
File System Forensics: Analyse file systems for tools or scripts that could be used in the discovery process.
Command History Analysis
Command Line Logs: Windows systems log command line activity, including PowerShell, in Event Logs. Look for commands related to system reconnaissance (like netstat, ipconfig, whoami, and net commands).
Bash History (Unix/Linux): Review .bash_history or equivalent files for executed commands that could be used for discovery.
Network Traffic Analysis
Network Monitoring Tools: Use tools like Wireshark or Tcpdump to analyse captured network traffic for reconnaissance patterns.
DNS Query Logs: Review DNS logs for domain lookups that may indicate reconnaissance or mapping of internal resources.
Artifact Analysis
Prefetch Files (Windows): Analyse Prefetch files to determine if any tools commonly used for discovery were executed.
Registry Analysis (Windows): Check registry keys for traces of commands or tools execution.
Use of Specialised Forensic Tools
Forensic Suites: Tools like EnCase, Autopsy, or X-Ways for comprehensive system analysis.
Sysinternals Suite (Windows): Use tools like Process Monitor and Process Explorer for real-time system monitoring.
Documentation and Reporting
Detailed Documentation: Record all findings, methodologies, and evidence paths.
Forensic Report: Compile a comprehensive report detailing the investigation, findings, and potential impact.
Post-Investigation Actions
Mitigation and Remediation: Implement necessary security measures to counter the identified discovery techniques.
Recovery: Restore systems and data from backups where necessary.
Enhancing Defenses: Update security policies and tools based on the findings.
Key Considerations
Chain of Custody: Maintain a clear chain of custody for all evidence.
Legal Compliance: Ensure the investigation is compliant with legal and organisational policies.
Data Confidentiality: Handle all data securely, maintaining its confidentiality and integrity.
Each case of discovery by an attacker can be unique, requiring a tailored approach based on the specifics of the incident and the environment.
Using KQL to Investigate Discovery Activities in an Environment Using Defender/Sentinel
Discovery techniques involve adversaries trying to gather information about the system and network they have compromised. This information is often used to facilitate further attacks or lateral movement.
1. T1012 - Query Registry
Objective: Detect attempts to query the Windows Registry to gather information about the system, users, and software.
Detect Registry Queries for Installed Software
Purpose: Identify attempts to query registry keys related to installed software.
Monitor for Queries of Autostart Locations
Purpose: Detect attempts to query autostart locations in the registry.
Identify Queries for Network Configuration
Purpose: Monitor for queries related to network configuration settings.
Detect Access to User Account Information in the Registry
Purpose: Identify attempts to query user account information from the registry.
Monitor for Registry Queries Related to Security Settings
Purpose: Detect queries related to security settings in the registry.
Identify Queries for Installed Patches
Purpose: Monitor for registry queries related to installed patches and updates.
2. T1082 - System Information Discovery
Objective: Detect attempts to gather detailed information about the system, including OS version, hardware, and configuration.
Detect Use of
systeminfoCommand
Purpose: Identify use of the systeminfo command to gather system information.
Monitor for Execution of
hostnameCommand
Purpose: Detect attempts to determine the system's hostname.
Identify Use of
wmicto Gather System Information
Purpose: Monitor for use of wmic to query system information.
Detect PowerShell Commands for System Information Gathering
Purpose: Identify PowerShell commands used to gather system information.
Monitor for Use of
dxdiag
Purpose: Detect use of the dxdiag tool to gather detailed system information.
Identify Use of
msinfo32
Purpose: Monitor for the use of msinfo32 to gather system information.
3. T1016 - System Network Configuration Discovery
Objective: Detect attempts to gather information about network configuration, including interfaces, routing, and DNS settings.
Detect Use of
ipconfigCommand
Purpose: Identify use of the ipconfig command to gather network configuration information.
Monitor for Execution of
routeCommand
Purpose: Detect attempts to view or modify the system's routing table.
Identify Use of
netshfor Network Discovery
Purpose: Monitor for the use of netsh to discover network configuration.
Detect PowerShell Commands for Network Configuration Discovery
Purpose: Identify PowerShell commands used to discover network configuration.
Monitor for Use of
nbtstat
6. Identify Use of netstat
Purpose: Monitor for the use of netstat to view active network connections and listening ports.
4. T1049 - System Network Connections Discovery
Objective: Detect attempts to discover active network connections, including listening ports and established sessions.
Detect Use of
netstatto View Network Connections
Purpose: Identify use of netstat to view active network connections.
Monitor for PowerShell Commands to Discover Network Connections
Purpose: Detect PowerShell commands used to discover TCP/UDP connections.
Identify Use of
ssCommand (for Linux or WSL environments)
Purpose: Monitor for the use of the ss command to view network connections.
Detect Use of
lsofCommand (for Linux or WSL environments)
Purpose: Identify use of the lsof command to list open files and network connections.
Monitor for Execution of
net useCommand
Purpose: Detect attempts to view or connect to shared network resources using the net use command.
Identify Use of
arpCommand
Purpose: Monitor for the use of the arp command to view or manipulate the ARP table.
5. T1083 - File and Directory Discovery
Objective: Detect attempts to discover files and directories on the system, especially those containing sensitive information.
Detect Use of
dirorlsCommands
Purpose: Identify attempts to list files and directories.
Monitor for Recursive Directory Listings
Purpose: Detect recursive directory listings that may indicate an attempt to discover sensitive files.
Identify Use of
treeCommand
Purpose: Monitor for the use of the tree command to display directory structures.
Detect PowerShell Commands for File Discovery
Purpose: Identify PowerShell commands used for discovering files and directories.
Monitor for Searches for Specific File Types
Purpose: Detect searches for specific file types that may contain sensitive information.
Identify Use of
findCommand (for Linux or WSL environments)
Purpose: Monitor for the use of the find command to search for files and directories.
6. T1033 - System Owner/User Discovery
Objective: Detect attempts to gather information about the system owner or users, including usernames and account details.
Detect Use of
whoamiCommand
Purpose: Identify use of the whoami command to determine the current logged-in user.
Monitor for Execution of
query userCommand
Purpose: Detect attempts to query currently logged-on users.
Identify Use of
net userCommand
Purpose: Monitor for attempts to query user accounts using the net user command.
Detect PowerShell Commands for User Discovery
Purpose: Identify PowerShell commands used to discover local or domain users.
Monitor for Execution of
whoCommand (for Linux or WSL environments)
Purpose: Detect use of the who command to list logged-in users on Linux or WSL.
Identify Use of
idCommand (for Linux or WSL environments)
Purpose: Monitor for the use of the id command to display user ID and group information.
7. T1018 - Remote System Discovery
Objective: Detect attempts to discover remote systems within the network, often as a precursor to lateral movement.
Detect Use of
net viewCommand
Purpose: Identify attempts to discover remote systems using the net view command.
Monitor for Execution of
pingto Discover Remote Systems
Purpose: Detect use of the ping command to identify remote systems.
Identify Use of
arpto Discover Remote Systems
Purpose: Monitor for use of the arp command to discover remote systems via ARP tables.
Detect PowerShell Commands for Remote System Discovery
Purpose: Identify PowerShell commands used to discover remote systems on the network.
Monitor for Use of
nbtstatto Discover Remote Systems
Purpose: Detect use of nbtstat to discover remote systems and their NetBIOS names.
Identify Use of
Get-ADComputerfor Remote System Discovery
Purpose: Monitor for the use of Get-ADComputer to list computers in Active Directory.
8. T1057 - Process Discovery
Objective: Detect attempts to enumerate running processes on the system to identify security software, active applications, or potential targets for privilege escalation.
Detect Use of
tasklistCommand
Purpose: Identify use of the tasklist command to enumerate running processes.
Monitor for Execution of
psCommand (for Linux or WSL environments)
Purpose: Detect use of the ps command to list processes on Linux or WSL.
Identify Use of PowerShell for Process Discovery
Purpose: Monitor for PowerShell commands used to list running processes.
Detect Use of
wmicfor Process Discovery
Purpose: Identify use of wmic to query running processes.
Monitor for Use of
taskmgr.exe
Purpose: Detect attempts to open Task Manager to view running processes.
Identify Use of
topCommand (for Linux or WSL environments)
Purpose: Monitor for the use of the top command to display running processes on Linux or WSL.
Last updated