forked from DFIR-ORC/dfir-orc.github.io
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathtuto.html
657 lines (625 loc) · 57.1 KB
/
tuto.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Tutorial — DFIR ORC documentation</title>
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="_static/solar.css" type="text/css" />
<link rel="stylesheet" type="text/css" href="_static/css/custom.css" />
<script id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
<script src="_static/jquery.js"></script>
<script src="_static/underscore.js"></script>
<script src="_static/doctools.js"></script>
<script src="_static/language_data.js"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="Requirements" href="platforms.html" />
<link rel="prev" title="Introduction" href="index.html" /><link href='http://fonts.googleapis.com/css?family=Source+Code+Pro|Open+Sans:300italic,400italic,700italic,400,300,700' rel='stylesheet' type='text/css'>
<link href="_static/solarized-dark.css" rel="stylesheet">
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" >
<a href="platforms.html" title="Requirements"
accesskey="N">next</a>
<li class="right" >
<a href="index.html" title="Introduction"
accesskey="P">previous</a>
|</li>
<li class="nav-item nav-item-0"><a href="index.html">DFIR ORC documentation</a> »</li>
</ul>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<p class="logo"><a href="index.html">
<img class="logo" src="_static/logo.jpg" alt="Logo"/>
</a></p>
<h3><a href="index.html">Table of Contents</a></h3>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="index.html">Introduction</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">Tutorial</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#build">1. Build</a></li>
<li class="toctree-l2"><a class="reference internal" href="#configure">2. Configure</a></li>
<li class="toctree-l2"><a class="reference internal" href="#test-the-configuration">3. Test the Configuration</a></li>
<li class="toctree-l2"><a class="reference internal" href="#use-local-configuration-files">4. Use Local Configuration Files</a></li>
<li class="toctree-l2"><a class="reference internal" href="#edit-embedded-configurations">5. Edit Embedded Configurations</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-final-challenge">6. The Final Challenge</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="platforms.html">Requirements</a></li>
<li class="toctree-l1"><a class="reference internal" href="intro_to_data_collection.html">Design and Architecture</a></li>
<li class="toctree-l1"><a class="reference internal" href="configuration.html">Configuration</a></li>
<li class="toctree-l1"><a class="reference internal" href="embedded_tool_suite.html">Embedded Tool Suite</a></li>
<li class="toctree-l1"><a class="reference internal" href="licenses.html">Licenses</a></li>
</ul>
<div id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" />
<input type="submit" value="Go" />
</form>
</div>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<div class="section" id="tutorial">
<h1>Tutorial<a class="headerlink" href="#tutorial" title="Permalink to this headline">¶</a></h1>
<p>This tutorial details the steps to obtain a <strong>configured</strong> DFIR ORC binary ready for deployment.</p>
<p>It explains which code to compile, how to embed a configuration, how to modify a configuration, the difference between compiling and configuring…
Basically, it goes through most of the classical steps which incident responders have to follow in their daily usage of the framework.</p>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>Everything must be done in a Microsoft Windows environment. Only step 1 requires compiling with Visual Studio (the free edition is sufficient, see step 1 for details).</p>
<p>Unconfigured and configured binaries require administrative privileges.
<strong>Commands below are designed to be run in an elevated Powershell shell.</strong> It can be adapted to work in an elevated command shell prompt.</p>
</div>
<div class="contents local topic" id="list-of-the-steps">
<p class="topic-title">List of the steps</p>
<ul class="simple">
<li><p><a class="reference internal" href="#build" id="id1">1. Build</a></p>
<ul>
<li><p><a class="reference internal" href="#mini-challenge-1" id="id2">Mini-challenge 1</a></p></li>
</ul>
</li>
<li><p><a class="reference internal" href="#configure" id="id3">2. Configure</a></p>
<ul>
<li><p><a class="reference internal" href="#mini-challenge-2" id="id4">Mini-challenge 2</a></p></li>
</ul>
</li>
<li><p><a class="reference internal" href="#test-the-configuration" id="id5">3. Test the Configuration</a></p>
<ul>
<li><p><a class="reference internal" href="#mini-challenge-3" id="id6">Mini-challenge 3</a></p></li>
</ul>
</li>
<li><p><a class="reference internal" href="#use-local-configuration-files" id="id7">4. Use Local Configuration Files</a></p>
<ul>
<li><p><a class="reference internal" href="#mini-challenge-4" id="id8">Mini-challenge 4</a></p></li>
</ul>
</li>
<li><p><a class="reference internal" href="#edit-embedded-configurations" id="id9">5. Edit Embedded Configurations</a></p>
<ul>
<li><p><a class="reference internal" href="#mini-challenge-5" id="id10">Mini-challenge 5</a></p></li>
</ul>
</li>
<li><p><a class="reference internal" href="#the-final-challenge" id="id11">6. The Final Challenge</a></p>
<ul>
<li><p><a class="reference internal" href="#a-few-q-a-to-warm-up" id="id12">A Few Q&A to Warm Up</a></p></li>
<li><p><a class="reference internal" href="#the-final-boss" id="id13">The Final Boss</a></p></li>
</ul>
</li>
</ul>
</div>
<div class="section" id="build">
<h2><a class="toc-backref" href="#id1">1. Build</a><a class="headerlink" href="#build" title="Permalink to this headline">¶</a></h2>
<p>This step is the only one requiring actual compilation with Microsoft’s toolchain. Instructions to compile these files from the source code are detailed <a class="reference external" href="https://github.com/DFIR-ORC/dfir-orc/blob/master/README.md">here</a>.</p>
<p>Please follow this procedure before going further.</p>
<p>As is explained in the section <a class="reference internal" href="architecture.html#architecture-config-process"><span class="std std-ref">Configuration Process</span></a>, compiling the source code for DFIR ORC yields what is called <strong>unconfigured binaries</strong>, typically named <code class="docutils literal notranslate"><span class="pre">DFIR-Orc_x86.exe</span></code> (32-bit) and <code class="docutils literal notranslate"><span class="pre">DFIR-Orc_x64.exe</span></code> (64-bit).
An <em>unconfigured</em> binary contains everything needed to orchestrate the collection of artefacts (e.g. what we call WolfLauncher, illustrated <a class="reference internal" href="architecture.html#architecture-exec"><span class="std std-ref">here</span></a>).
It also contains the <a class="reference internal" href="embedded_tool_suite.html"><span class="doc">embedded tool suite</span></a> included by default.
Thus, it can behave kind of like the <em>busybox</em> tool, and be used <em>as is</em> to run embedded tools. In fact, it is exactly what WolfLauncher does when a configured binary is run.</p>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>As configured binaries, unconfigured binaries <strong>require administrative privileges</strong> for execution.</p>
</div>
<div class="section" id="mini-challenge-1">
<h3><a class="toc-backref" href="#id2">Mini-challenge 1</a><a class="headerlink" href="#mini-challenge-1" title="Permalink to this headline">¶</a></h3>
<p>This first step illustrates how to use unconfigured binaries to run the tools embedded by default.
Find a command line to use <a class="reference internal" href="NTFSUtil.html"><span class="doc">NTFSUtil</span></a> to display information about the USN journal of disk <code class="docutils literal notranslate"><span class="pre">C:</span></code>.</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Hint ▶</strong></p>
</div>
<p><code class="docutils literal notranslate"><span class="pre">NTFSUtil</span></code> needs arguments <code class="docutils literal notranslate"><span class="pre">/USN</span> <span class="pre">\\.\c:</span></code></p>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>Both command lines work.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span>.\DFIR-Orc_x86.exe NTFSUtil /USN \\.\c:
.\DFIR-Orc_x64.exe NTFSUtil /USN \\.\c:
</pre></div>
</div>
</div>
</div>
</div>
<div class="section" id="configure">
<span id="tuto-step-2"></span><h2><a class="toc-backref" href="#id3">2. Configure</a><a class="headerlink" href="#configure" title="Permalink to this headline">¶</a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>No compilation is required after step 1.</p>
</div>
<p>Why is a configuration needed? Basically, an <em>unconfigured</em> binary is just a set of tools, plus a collection engine. Hence, the list of
artefacts to be collected, and how to collect them, has not been provided yet. This list is precisely what a configuration is!
Please refer to the short section <a class="reference internal" href="architecture.html#architecture-config-process"><span class="std std-ref">Configuration Process</span></a> to read about the basics.</p>
<p>This step details how to obtain a <em>configured</em> binary from an <em>unconfigured</em> binary and the <a class="reference external" href="https://github.com/dfir-orc/dfir-orc-config">repository of existing configurations</a>.</p>
<p>First, clone the default configuration:</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span>git clone https://github.com/dfir-orc/dfir-orc-config.git
cd dfir-orc-config
</pre></div>
</div>
<p>Then, copy the <em>unconfigured</em> DFIR ORC binaries <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_x86.exe</span></code> and <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_x64.exe</span></code> in the <code class="docutils literal notranslate"><span class="pre">tools</span></code> folder:</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="nb">Copy-Item</span> <span class="p"><</span><span class="n">Path</span><span class="p">>\</span><span class="n">dfir-orc</span><span class="p">\</span><span class="n">build-x86</span><span class="p">\</span><span class="n">MinSizeRel</span><span class="p">\</span><span class="n">DFIR-Orc_x86</span><span class="p">.</span><span class="n">exe</span> <span class="p">.\</span><span class="n">tools</span>
<span class="nb">Copy-Item</span> <span class="p"><</span><span class="n">Path</span><span class="p">>\</span><span class="n">dfir-orc</span><span class="p">\</span><span class="n">build-x64</span><span class="p">\</span><span class="n">MinSizeRel</span><span class="p">\</span><span class="n">DFIR-Orc_x64</span><span class="p">.</span><span class="n">exe</span> <span class="p">.\</span><span class="n">tools</span>
</pre></div>
</div>
<p>To illustrate how to include external tools into the DFIR ORC framework, we have chosen to provide an example configuration which uses <code class="docutils literal notranslate"><span class="pre">autorunsc.exe</span></code>. Hence, you need to <a class="reference external" href="https://live.sysinternals.com/autorunsc.exe">download it from the Microsoft SysInternals website</a>.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span>Invoke-WebRequest https://live.sysinternals.com/autorunsc.exe -OutFile .\tools\autorunsc.exe
</pre></div>
</div>
<p>Finally, run the command below in an <strong>elevated</strong> command prompt:</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">Configure</span><span class="p">.</span><span class="n">cmd</span>
</pre></div>
</div>
<p>This command yields a <em>configured</em> DFIR ORC binary (named <code class="docutils literal notranslate"><span class="pre">DFIR-Orc.exe</span></code> by default) in the <code class="docutils literal notranslate"><span class="pre">output</span></code> directory.</p>
<div class="section" id="mini-challenge-2">
<h3><a class="toc-backref" href="#id4">Mini-challenge 2</a><a class="headerlink" href="#mini-challenge-2" title="Permalink to this headline">¶</a></h3>
<p>In the configuration repository, which file describes the commands which WolfLauncher (the collection engine) is going to run when the <em>configured</em> binary is executed ?</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Hint ▶</strong></p>
</div>
<p>Track <code class="docutils literal notranslate"><span class="pre">autorunsc.exe</span></code>, since you know it is supposed to be run.</p>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>The main configuration file, or <a class="reference internal" href="wolf_config.html"><span class="doc">WolfLauncher configuration</span></a>, is <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_config.xml</span></code>. Basics to read and edit it are detailed in <a class="reference internal" href="#tuto-step-5"><span class="std std-ref">5. Edit Embedded Configurations</span></a>.</p>
</div>
</div>
</div>
<div class="section" id="test-the-configuration">
<h2><a class="toc-backref" href="#id5">3. Test the Configuration</a><a class="headerlink" href="#test-the-configuration" title="Permalink to this headline">¶</a></h2>
<p>Once we have a <em>configured</em> DFIR ORC binary, we can start testing it!</p>
<p>Of course, we can use it to execute one of the <a class="reference internal" href="embedded_tool_suite.html"><span class="doc">embedded tools</span></a> (just like the <em>unconfigured</em> ones):</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span>.\output\DFIR-Orc.exe NTFSInfo /out=C_drive.csv C:\
</pre></div>
</div>
<p>This command will create a file named <code class="docutils literal notranslate"><span class="pre">C_drive.csv</span></code> in the current directory with the enumeration of the Master File Table of the volume <code class="docutils literal notranslate"><span class="pre">C:</span></code>.</p>
<p>In a similar manner, GetThis can be invoked from the command line:</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span>.\output\DFIR-Orc.exe GetThis /nolimits /sample=ntdll.dll /out=ntdll.7z C:\
</pre></div>
</div>
<p>This command will create a file called <code class="docutils literal notranslate"><span class="pre">ntdll.7z</span></code> in the current directory, containing all files named <code class="docutils literal notranslate"><span class="pre">ntdll.dll</span></code> in the <code class="docutils literal notranslate"><span class="pre">C:</span></code> volume.</p>
<p>However, configurations were introduced so that users can write these command lines once and for all.</p>
<p>Once a tool is run, its results are stored in an archive.
The content of archives are set by the configuration file.
Given a <em>configured</em> binary, the option <cite>keys</cite> lists all the archives which can be built
according to the embedded configuration.</p>
<p>Let’s try this on the binary obtained in step 2.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">keys</span>
</pre></div>
</div>
<p>This command outputs the result below:</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span>DFIR-Orc Version 10.0.0.000
Start time : 09/26/2019 14:57:55.198 (UTC)
Computer : JEANGABOOK
Full Computer : jeangabook
User : JEANGABOOK\Jean (elevated)
System type : WorkStation
System tags : OSBuild#18362,RTM,Release#1903,Windows10,WorkStation,x64
Operating System : Microsoft Windows 10 Enterprise Edition (build 18362), 64-bit
Output directory : F:\Projects\dfir-orc-config (encoding=UTF8)
Temp directory : C:\Users\Jean\AppData\Local\Temp\WorkingTemp (encoding=UTF8)
Log file : DFIR-ORC_WorkStation_jeangabook_20190926_145755.log
Repeat Behavior : No global override set (config behavior used)
Priority : Low
[X] Archive: Main (file is DFIR-ORC_WorkStation_jeangabook_Main.7z)
[X] Command SystemInfo
[X] Command Processes
[X] Command GetEvents
[X] Command Autoruns
[X] Command NTFSInfo
[ ] Command NTFSInfoHashPE
[X] Command FatInfo
[ ] Command FatInfoHashPE
[X] Command USNInfo
[X] Command GetArtefacts
[X] Archive: Hives (file is DFIR-ORC_WorkStation_jeangabook_Hives.7z)
[X] Command GetSystemHives
[X] Command GetUserHives
[X] Command GetSamHive
[ ] Archive: Yara (file is DFIR-ORC_WorkStation_jeangabook_Yara.7z)
[X] Command GetYara
Finish time : 09/26/2019 14:57:55.198 (UTC)
Elapsed time : 0 msecs
</pre></div>
</div>
<p>After the usual banner with the tool running, version information and parameters, we get a list of configured archives (Main, Hives and Yara) and the list of commands which they comprise.</p>
<p>[X] indicates an archive (respectively a command) that will be collected (respectively run).</p>
<p>[ ] indicates an option or command that can be added to the collection via the <cite>/key+=Yara</cite> for instance.</p>
<p>The result above shows that by default, the configuration
embedded in <code class="docutils literal notranslate"><span class="pre">DFIR-Orc.exe</span></code></p>
<blockquote>
<div><ul class="simple">
<li><p>collects an archive named Main by running all its commands except NTFSInfoHashPE and FatInfoHashPE,</p></li>
<li><p>collects an archive named Hives containing the outputs of all three commands listed for this archive,</p></li>
<li><p>does not collect the Yara archive.</p></li>
</ul>
</div></blockquote>
<p>It is possible to select and deselect keys using the syntax detailed in <a class="reference internal" href="cli_options.html#cli-options-keys"><span class="std std-ref">the command line documentation</span></a>. As illustrated in <a class="reference internal" href="architecture.html#architecture-deployment-spe-conf"><span class="std std-ref">Deployment-specific Configuration</span></a>, options on the command line change the behavior of a configured binary without impacting its embedded configuration file; the changes only take effect for one execution.</p>
<p>For example, the following line is meant to select the Yara archive, but deselect the SAM Hive collection included in the Hives archive. Adding <cite>/keys</cite> at the end of the line allows a dry run: it just outputs what is set to be collected by the entire command line.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">key</span><span class="p">+=</span><span class="n">Yara</span> <span class="p">/</span><span class="n">key</span><span class="p">-=</span><span class="n">GetSamHive</span> <span class="p">/</span><span class="n">keys</span>
</pre></div>
</div>
<div class="section" id="mini-challenge-3">
<h3><a class="toc-backref" href="#id6">Mini-challenge 3</a><a class="headerlink" href="#mini-challenge-3" title="Permalink to this headline">¶</a></h3>
<p>Write a command line allowing to only get the output of SystemInfo in the Main archive, in a folder
named <code class="docutils literal notranslate"><span class="pre">\Temp\testing</span></code>.
Run the command to test that it works (SystemInfo is very quick).</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Hint ▶</strong></p>
</div>
<p>Options involved are <code class="docutils literal notranslate"><span class="pre">/out</span></code> and <code class="docutils literal notranslate"><span class="pre">/key</span></code>. See <a class="reference internal" href="cli_options.html"><span class="doc">the command line documentation</span></a>.</p>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">key</span><span class="p">=</span><span class="n">SystemInfo</span> <span class="p">/</span><span class="n">out</span><span class="p">=\</span><span class="n">Temp</span><span class="p">\</span><span class="n">testing</span>
</pre></div>
</div>
</div>
<p>Run the command line again. What does it do? Why? How can this behavior be corrected?</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Hint ▶</strong></p>
</div>
<p>Option <code class="docutils literal notranslate"><span class="pre">/overwrite</span></code> should help. See <a class="reference internal" href="cli_options.html"><span class="doc">the command line documentation</span></a>.</p>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">key</span><span class="p">=</span><span class="n">SystemInfo</span> <span class="p">/</span><span class="n">out</span><span class="p">=\</span><span class="n">Temp</span><span class="p">\</span><span class="n">testing</span> <span class="p">/</span><span class="n">overwrite</span>
</pre></div>
</div>
<p><code class="docutils literal notranslate"><span class="pre">DFIR-Orc.exe</span></code> detects that some archives already exist (based on the file names) and does not overwrite them by default.</p>
</div>
</div>
</div>
<div class="section" id="use-local-configuration-files">
<h2><a class="toc-backref" href="#id7">4. Use Local Configuration Files</a><a class="headerlink" href="#use-local-configuration-files" title="Permalink to this headline">¶</a></h2>
<p>A local configuration file is meant to provide some configuration options while not using a command line.
This can be useful in some deployment scenarios.</p>
<p>It is an XML file which has the following skeleton, described in the section <a class="reference internal" href="orc_local_config.html"><span class="doc">DFIR ORC Local Configuration File</span></a>.</p>
<div class="line-block">
<div class="line"><<a class="reference internal" href="orc_local_config.html#orc-local-config-dfir-orc-element"><span class="std std-ref">dfir-orc</span></a> <em>attributes=”…”</em>></div>
<div class="line-block">
<div class="line"><<a class="reference internal" href="orc_local_config.html#orc-local-config-temporary-element"><span class="std std-ref">temporary</span></a>> <em>value</em> </temporary></div>
<div class="line"><<a class="reference internal" href="orc_local_config.html#orc-local-config-output-element"><span class="std std-ref">output</span></a>> <em>value</em> </output></div>
<div class="line"><<a class="reference internal" href="orc_local_config.html#orc-local-config-upload-element"><span class="std std-ref">upload</span></a> <em>attributes=”…”</em> /></div>
<div class="line"><<a class="reference internal" href="orc_local_config.html#orc-local-config-recipient-element"><span class="std std-ref">recipient</span></a> <em>attributes=”…”</em>> <em>value</em> </recipient></div>
<div class="line"><<a class="reference internal" href="orc_local_config.html#orc-local-config-key-element"><span class="std std-ref">key</span></a>> <em>value</em> </key></div>
<div class="line"><<a class="reference internal" href="orc_local_config.html#orc-local-config-enable-key-and-disable-key-elements"><span class="std std-ref">enable_key</span></a>> <em>value</em> </enable_key></div>
<div class="line"><<a class="reference internal" href="orc_local_config.html#orc-local-config-enable-key-and-disable-key-elements"><span class="std std-ref">disable_key</span></a>> <em>value</em> </disable_key></div>
</div>
<div class="line"></dfir-orc></div>
</div>
<p>As an example, we show how to write a file to run the equivalent of the command line below.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">key</span><span class="p">=</span><span class="n">SystemInfo</span> <span class="p">/</span><span class="n">out</span><span class="p">=\</span><span class="n">Temp</span><span class="p">\</span><span class="n">testing</span>
</pre></div>
</div>
<p>The corresponding file, named <code class="docutils literal notranslate"><span class="pre">DFIR-Orc.xml</span></code> and which we choose to store in <code class="docutils literal notranslate"><span class="pre">\Temp\testing\</span></code>, looks as follows.</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="nt"><dfir-orc</span> <span class="na">priority=</span><span class="s">"low"</span> <span class="na">powerstate=</span><span class="s">"SystemRequired,AwayMode"</span><span class="nt">></span>
<span class="nt"><output></span>\Temp\testing<span class="nt"></output></span>
<span class="nt"><key></span>SystemInfo<span class="nt"></key></span>
<span class="nt"></dfir-orc></span>
</pre></div>
</div>
<p>Running DFIR ORC with this configuration can be done with this command line:</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">local</span><span class="p">=\</span><span class="n">Temp</span><span class="p">\</span><span class="n">testing</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">xml</span>
</pre></div>
</div>
<p>Encrypting the archives with a public key requires adding a <code class="docutils literal notranslate"><span class="pre">recipient</span></code> element in the XML file.</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="nt"><dfir-orc</span> <span class="na">priority=</span><span class="s">"low"</span> <span class="na">powerstate=</span><span class="s">"Systemrequired,AwayMode"</span><span class="nt">></span>
<span class="nt"><output></span>\Temp\testing<span class="nt"></output></span>
<span class="nt"><key></span>SystemInfo<span class="nt"></key></span>
<span class="nt"><recipient</span> <span class="na">name=</span><span class="s">'certfr'</span> <span class="na">archive=</span><span class="s">'*'</span> <span class="nt">></span>
-----BEGIN CERTIFICATE-----
MIIC7TCCAdmgAwIBAgIQR5AF92Ti8qtEwuT3PMVrJzAJBgUrDgMCHQUAMBIxEDAO
BgNVBAMTB0NFUlQtRlIwHhcNMDQxMjMxMjIwMDAwWhcNMTQxMjMxMjIwMDAwWjAS
MRAwDgYDVQQDEwdDRVJULUZSMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAiufyRATXw5Kc/DUcEr/5nNygcbluyS5gkUd1pGaUqKHMSMEVOBzYqcvq3cMw
4shAL3TSgYdoOJaLG4ErvyRU87fWYRcwiHzGdFg89E3pBEWnyV3j3fR0fVB5t3MD
jbooTGI/qQGl1l3MZ+bOiHkYcIG50R5343VT5vjRLmPv16iopGczLXKkNFxN480f
BnCF8HcJesFiMIDUI+d9OWpLJNDSCerouMr75HVD47+gBKKgH2PrxWozk2L6R9gQ
l8/6xzM4VKiNt4BTGfChG8AnO8sJzPETjJaDXrIGaYVLxU4OxFh/a9x61dlM/5A/
TASXpLhXrsi+ib3YLLl+pNh+aQIDAQABo0cwRTBDBgNVHQEEPDA6gBD47GaJKs91
qsThQIQ7f8Y5oRQwEjEQMA4GA1UEAxMHQ0VSVC1GUoIQR5AF92Ti8qtEwuT3PMVr
JzAJBgUrDgMCHQUAA4IBAQBgvEE7qyLVV+Y5B0sR5VuPmfeqakOxBxLmb8VoTNKn
/7ai1XwtJeWD1vumKx5Q29GiUfVhvBgn0zhjM5syVDFCqEcp+eu6l2XbN8uvllCY
daTOT/9UylLxu1L/epiWiYtqRZOO/9i1fyqrkguIww7EjXXT3ybL5U/BakEC2Yg5
6vUoxbo2EbA1UoMWurRxYNYxyFfHpvBYXFf4uDaAFIVMtEgH5VkKyM3Kj2hi/PJH
/a30ndTWVSY/82hoRGCa+SkevR5VbDsxTqHtEHys4K+ETVTNXp29HwG+1YG7BTTc
4VdFRqUm7e3o6VUArFar8I01oHiHzqKJiu1Omm2Fkmc1
-----END CERTIFICATE-----
<span class="nt"></recipient></span>
<span class="nt"></dfir-orc></span>
</pre></div>
</div>
<p>Suppose now that the configuration file <code class="docutils literal notranslate"><span class="pre">DFIR-Orc.xml</span></code> is copied in the same repository as the configured binary <code class="docutils literal notranslate"><span class="pre">DFIR-Orc.exe</span></code>. We can then use the command line below: the executable takes into account the XML file bearing its base name present in its running directory.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span>
</pre></div>
</div>
<p>Element <code class="docutils literal notranslate"><span class="pre">upload</span></code> is the counterpart of the <code class="docutils literal notranslate"><span class="pre">output</span></code> element to configure a <strong>remote</strong> repository as a destination for the archives.</p>
<div class="section" id="mini-challenge-4">
<h3><a class="toc-backref" href="#id8">Mini-challenge 4</a><a class="headerlink" href="#mini-challenge-4" title="Permalink to this headline">¶</a></h3>
<p>Combine the steps above to find a way to confirm <em>without creating any archive</em> that the local configuration file is being taken into account by the following command line.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span>
</pre></div>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Hint ▶</strong></p>
</div>
<p>As documented in <a class="reference internal" href="architecture.html#architecture-deployment-spe-conf"><span class="std std-ref">this section</span></a>, command-line options can be combined with a local configuration file, and supersede it.</p>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>Adding the option <code class="docutils literal notranslate"><span class="pre">/keys</span></code> to the command line being tested allows to check what is going to be executed.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">output</span><span class="p">\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">keys</span>
</pre></div>
</div>
<p>This displays that only SystemInfo is set to execute, and that the output directory is <code class="docutils literal notranslate"><span class="pre">\Temp\testing</span></code>.</p>
</div>
<p>Edit the configuration file to add the command GetSamHive, and another recipient, which can only decrypt the Hives archive.</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Hint ▶</strong></p>
</div>
<p>It is possible to add another <code class="docutils literal notranslate"><span class="pre">recipient</span></code> element next to the first one.</p>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>Here is one possible solution.</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="nt"><dfir-orc</span> <span class="na">priority=</span><span class="s">"low"</span> <span class="na">powerstate=</span><span class="s">"Systemrequired,AwayMode"</span><span class="nt">></span>
<span class="nt"><output></span>\Temp\testing<span class="nt"></output></span>
<span class="nt"><key></span>SystemInfo,GetSamHive<span class="nt"></key></span>
<span class="nt"><recipient</span> <span class="na">name=</span><span class="s">"certfr"</span> <span class="na">archive=</span><span class="s">"*"</span> <span class="nt">></span>
-----BEGIN CERTIFICATE-----
etc.
-----END CERTIFICATE-----
<span class="nt"></recipient></span>
<span class="nt"><recipient</span> <span class="na">name=</span><span class="s">"Marc"</span> <span class="na">archive=</span><span class="s">"Hives"</span> <span class="nt">></span>
-----BEGIN CERTIFICATE-----
etc.
-----END CERTIFICATE-------
<span class="nt"></recipient></span>
<span class="nt"></dfir-orc></span>
</pre></div>
</div>
</div>
</div>
</div>
<div class="section" id="edit-embedded-configurations">
<span id="tuto-step-5"></span><h2><a class="toc-backref" href="#id9">5. Edit Embedded Configurations</a><a class="headerlink" href="#edit-embedded-configurations" title="Permalink to this headline">¶</a></h2>
<p>To refer to embedded tools as resources in a configuration file, a specific syntax is used.
Please read <a class="reference internal" href="resources.html"><span class="doc">Referencing Resources in Configurations</span></a> before proceeding.</p>
<p>As an example, let us try to find the command lines matching some instructions in the sample configuration file <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_config.xml</span></code> from <a class="reference external" href="https://github.com/dfir-orc/dfir-orc-config">the repository of existing configurations</a>.</p>
<p>First, let us focus on <code class="docutils literal notranslate"><span class="pre">autorunsc.exe</span></code>. The file reads:</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="nt"><command</span> <span class="na">keyword=</span><span class="s">"Autoruns"</span><span class="nt">></span>
<span class="nt"><execute</span> <span class="na">name=</span><span class="s">"autorunsc.exe"</span> <span class="na">run=</span><span class="s">"7z:#Tools|autorunsc.exe"</span><span class="nt">/></span>
<span class="nt"><argument></span>-a * -c -h -m -s -t -accepteula<span class="nt"></argument></span>
<span class="nt"><output</span> <span class="na">name=</span><span class="s">"autoruns.csv"</span> <span class="na">source=</span><span class="s">"StdOut"</span><span class="nt">/></span>
<span class="nt"><output</span> <span class="na">name=</span><span class="s">"autoruns.log"</span> <span class="na">source=</span><span class="s">"StdErr"</span><span class="nt">/></span>
<span class="nt"></command></span>
</pre></div>
</div>
<p>This paragraph establishes that when command Autoruns is run, a temporary file named <code class="docutils literal notranslate"><span class="pre">autorunsc.exe</span></code> is extracted on disk from an archive resource embedded in <code class="docutils literal notranslate"><span class="pre">DFIR-Orc.exe</span></code> (see the second bullet point <a class="reference internal" href="resources.html"><span class="doc">here</span></a> and <a class="reference internal" href="wolf_config.html#wolf-config-execute-element"><span class="std std-ref">here</span></a> for details). Then, this temporary binary is run with arguments <code class="docutils literal notranslate"><span class="pre">-a</span> <span class="pre">*</span> <span class="pre">-c</span> <span class="pre">-h</span> <span class="pre">-m</span> <span class="pre">-s</span> <span class="pre">-t</span> <span class="pre">-accepteula</span></code>. This produces two outputs; lines output on StdOut are stored in a file named <code class="docutils literal notranslate"><span class="pre">autoruns.csv</span></code>, while lines output on StdErr are stored in autoruns.log.</p>
<p>Secondly, let us detail the example of NTFSInfo. The configuration reads:</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="nt"><command</span> <span class="na">keyword=</span><span class="s">"NTFSInfo"</span> <span class="na">queue=</span><span class="s">"flush"</span><span class="nt">></span>
<span class="nt"><execute</span> <span class="na">name=</span><span class="s">"DFIR-ORC.exe"</span> <span class="na">run=</span><span class="s">"self:#NTFSInfo"</span><span class="nt">/></span>
<span class="nt"><argument></span>/config=res:#NTFSInfo_config.xml<span class="nt"></argument></span>
<span class="nt"><output</span> <span class="na">name=</span><span class="s">"NTFSInfo_SecDesc.7z"</span> <span class="na">source=</span><span class="s">"File"</span> <span class="na">argument=</span><span class="s">"/SecDescr={FileName}"</span><span class="nt">/></span>
<span class="nt"><output</span> <span class="na">name=</span><span class="s">"NTFSInfo_i30Info.7z"</span> <span class="na">source=</span><span class="s">"File"</span> <span class="na">argument=</span><span class="s">"/i30info={FileName}"</span><span class="nt">/></span>
<span class="nt"><output</span> <span class="na">name=</span><span class="s">"NTFSInfo.7z"</span> <span class="na">source=</span><span class="s">"File"</span> <span class="na">argument=</span><span class="s">"/out={FileName}"</span><span class="nt">/></span>
<span class="nt"><output</span> <span class="na">name=</span><span class="s">"NTFSInfo.log"</span> <span class="na">source=</span><span class="s">"StdOutErr"</span><span class="nt">/></span>
<span class="nt"></command></span>
</pre></div>
</div>
<p>This paragraph describes what should happen when the NTFSInfo command is run. As NTFSInfo is a raw, non-archived resource of the configured binary, the syntax used is <code class="docutils literal notranslate"><span class="pre">self:#NTFSInfo</span></code>. The configuration used by NTFSInfo (<cite>̀`res:#NTFSInfo_config.xml`</cite>) is a resource of the configured binary, named <code class="docutils literal notranslate"><span class="pre">NTFSInfo_config.xml</span></code>. This file has been embedded in the configured binary by ToolEmbed in <a class="reference internal" href="#tuto-step-2"><span class="std std-ref">2. Configure</span></a>. The following line in <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_embed.xml</span></code> allows to match the resource to the original file.</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="nt"><file</span> <span class="na">name=</span><span class="s">"NTFSInfo_config.xml"</span> <span class="na">path=</span><span class="s">".\%ORC_CONFIG_FOLDER%\NTFSInfo_config.xml"</span><span class="nt">/></span>
</pre></div>
</div>
<p>Recreating the command line can dine with a little help from <a class="reference internal" href="NTFSInfo.html#ntfsinfo-output"><span class="std std-ref">this section of the documentation of NTFSInfo</span></a>. Assuming that the configuration file is on the disk and in the same directory as the configured binary, this yields the following line.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="n">NTFSInfo</span> <span class="p">/</span><span class="n">config</span><span class="p">=</span><span class="n">NTFSInfo_config</span><span class="p">.</span><span class="n">xml</span> <span class="p">/</span><span class="n">SecDescr</span><span class="p">=</span><span class="n">NTFSInfo_SecDesc</span><span class="p">.</span><span class="n">7z</span> <span class="p">/</span><span class="n">i30info</span><span class="p">=</span><span class="n">NTFSInfo_i30Info</span><span class="p">.</span><span class="n">7z</span> <span class="p">/</span><span class="n">out</span><span class="p">=</span><span class="n">NTFSInfo</span><span class="p">.</span><span class="n">7z</span> <span class="p">/</span><span class="n">logfile</span><span class="p">=</span><span class="n">NTFSInfo</span><span class="p">.</span><span class="n">log</span>
</pre></div>
</div>
<p>Now that reading a WolfLauncher configuration file is less of a mystery, let’s try to modify it by adding the hives related to the AmCache. There are <a class="reference external" href="https://www.ssi.gouv.fr/en/publication/amcache-analysis/">several other useful files to collect</a>, but this is beyond the scope of this tutorial. The Amcache hive is systemwide, and it has to be collected along with transaction and temporary files. Thus, after searching for the configuration files involved in the SYSTEM hive collection, it seems reasonable to append our new requirements to <code class="docutils literal notranslate"><span class="pre">GetSystemHives_config.xml</span></code>.
Below is an excerpt of the new configuration file to be used by <code class="docutils literal notranslate"><span class="pre">DFIR-Orc.exe</span></code>.</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="cp"><?xml version="1.0"?></span>
<span class="nt"><getthis</span> <span class="na">reportall=</span><span class="s">""</span> <span class="na">flushregistry=</span><span class="s">"yes"</span><span class="nt">></span>
<span class="nt"><location></span>%SystemRoot%<span class="nt"></location></span>
<span class="nt"><samples</span> <span class="na">MaxPerSampleBytes=</span><span class="s">"500MB"</span> <span class="na">MaxTotalBytes=</span><span class="s">"2048MB"</span><span class="nt">></span>
<span class="nt"><sample></span>
<span class="nt"><ntfs_find</span> <span class="na">name=</span><span class="s">"SECURITY"</span> <span class="na">header=</span><span class="s">"regf"</span><span class="nt">/></span>
<span class="nt"></sample></span>
...
<span class="nt"><sample></span>
<span class="nt"><ntfs_find</span> <span class="na">name=</span><span class="s">"AmCache.hve"</span> <span class="na">header=</span><span class="s">"regf"</span> <span class="nt">/></span>
<span class="nt"><ntfs_find</span> <span class="na">name=</span><span class="s">"AmCache.hve.log1"</span> <span class="nt">/></span>
<span class="nt"><ntfs_find</span> <span class="na">name=</span><span class="s">"AmCache.hve.log2"</span> <span class="nt">/></span>
<span class="nt"></sample></span>
<span class="nt"></samples></span>
<span class="nt"></getthis></span>
</pre></div>
</div>
<p>The modified configuration has to be embedded in the configured binary somehow. There are two ways to do this.
The first possibility is to modify the file <code class="docutils literal notranslate"><span class="pre">GetSystemHives_config.xml</span></code> and use ToolEmbed as in <a class="reference internal" href="#tuto-step-2"><span class="std std-ref">2. Configure</span></a> above.</p>
<p>It is also possible to do this directly on a configured binary as follows.</p>
<p>Start by creating a directory where embedded external tools and configurations can be dumped, e.g. <code class="docutils literal notranslate"><span class="pre">dump_dir</span></code>.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="p">.\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="n">toolembed</span> <span class="p">/</span><span class="n">dump</span><span class="p">=.\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">out</span><span class="p">=</span><span class="n">dump_dir</span>
</pre></div>
</div>
<p>In <code class="docutils literal notranslate"><span class="pre">dump_dir</span></code>, find the file <code class="docutils literal notranslate"><span class="pre">GetSystemHives_config.xml</span></code> and modify it. Then, run the command below to obtain a new configured binary.</p>
<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="nb">cd </span><span class="n">dump_dir</span>
<span class="p">..\</span><span class="n">DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="n">toolembed</span> <span class="p">/</span><span class="n">out</span><span class="p">=..\</span><span class="n">New_DFIR-Orc</span><span class="p">.</span><span class="n">exe</span> <span class="p">/</span><span class="n">config</span><span class="p">=</span><span class="n">Embed</span><span class="p">.</span><span class="n">xml</span>
</pre></div>
</div>
<div class="section" id="mini-challenge-5">
<h3><a class="toc-backref" href="#id10">Mini-challenge 5</a><a class="headerlink" href="#mini-challenge-5" title="Permalink to this headline">¶</a></h3>
<p>Find how to change the yara rules used in DFIR ORC, and explain <strong>why</strong> it works.</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Hint ▶</strong></p>
</div>
<p>In the configuration repository, there is a file named <code class="docutils literal notranslate"><span class="pre">ruleset.yara</span></code> which
seems a good place to start. But how is it used ?</p>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>Reading <code class="docutils literal notranslate"><span class="pre">GetYaraSamples_config.xml</span></code> reveals that it is a GetThis configuration file, which uses yara and
a resource named <code class="docutils literal notranslate"><span class="pre">res:#ruleset.yara</span></code> to collect samples matching any rules in this set.
Changing the file <code class="docutils literal notranslate"><span class="pre">ruleset.yara</span></code> and embedding it in a new configured binary is indeed the right thing to do.</p>
</div>
</div>
</div>
<div class="section" id="the-final-challenge">
<span id="tuto-step-6"></span><h2><a class="toc-backref" href="#id11">6. The Final Challenge</a><a class="headerlink" href="#the-final-challenge" title="Permalink to this headline">¶</a></h2>
<div class="section" id="a-few-q-a-to-warm-up">
<h3><a class="toc-backref" href="#id12">A Few Q&A to Warm Up</a><a class="headerlink" href="#a-few-q-a-to-warm-up" title="Permalink to this headline">¶</a></h3>
<p>Find out which of the following statements are false, and why.</p>
<p><code class="docutils literal notranslate"><span class="pre">DFIR-Orc_x86.exe</span></code> is a configured binary, hence I can use it to run NTFSInfo.</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>False, but nearly true. <code class="docutils literal notranslate"><span class="pre">DFIR-Orc_x86.exe</span></code> is the name usually given to an <strong>unconfigured</strong> binary.
Both unconfigured and configured binary can be used to run tools embedded by default such as NTFSInfo, in a busybox way.</p>
</div>
<p>There is no need to recompile <code class="docutils literal notranslate"><span class="pre">DFIR-Orc_x86.exe</span></code> and <code class="docutils literal notranslate"><span class="pre">DFIR-Orc_x64.exe</span></code> to add an external tool,
using ToolEmbed is sufficient to obtain a new configured binary.</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>True.</p>
</div>
<p>During an incident response, I have a disconnected Windows desktop and a configured binary <code class="docutils literal notranslate"><span class="pre">DFIR-Orc.exe</span></code>. I want to augment the time span during which archives must complete and to collect files located in a specific place on the disk. There is nothing I can do on site.</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>False. ToolEmbed allows to extract resources from a configured binary, modify them and reconstruct a new configured binary. This is explained in <a class="reference internal" href="#tuto-step-5"><span class="std std-ref">5. Edit Embedded Configurations</span></a>. This is necessary to add the collection of files using GetSamples or GetThis. However, changing the timeout can be done using option <code class="docutils literal notranslate"><span class="pre">/archive_timeout</span></code> on the command line. It will supersede the default value in the embedded configuration.</p>
</div>
</div>
<div class="section" id="the-final-boss">
<h3><a class="toc-backref" href="#id13">The Final Boss</a><a class="headerlink" href="#the-final-boss" title="Permalink to this headline">¶</a></h3>
<p>Great forensicators know that sometimes quick wins can be found in <code class="docutils literal notranslate"><span class="pre">Temp</span></code>.
Create a new configured binary, which uses <a class="reference internal" href="GetThis.html"><span class="doc">GetThis</span></a> to collect specifically PE files in this directory.
To guarantee that this does not create enormous archives to transfer over a network, find how to impose
limits on the size of each file, and the total size of the cumulated samples.</p>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Hint (list of the steps) ▶</strong></p>
</div>
<p>Create a specific configuration file for GetThis, find what to put inside (some useful elements to check
out in the documentation are <code class="docutils literal notranslate"><span class="pre">location</span></code> [global option], <code class="docutils literal notranslate"><span class="pre">samples</span></code> and <code class="docutils literal notranslate"><span class="pre">sample</span></code>).</p>
<p>Then, find a way to modify <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_config.xml</span></code> so that the new GetThis file is used. This should highlight that
the new file has to be embedded as a resource, so the last thing to do is to edit <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_embed.xml</span></code> so that a resource
is created.</p>
<p>Eventually, reconfigure to obtain a new binary with ToolEmbed (cf <a class="reference internal" href="#tuto-step-2"><span class="std std-ref">2. Configure</span></a>).</p>
</div>
<div class="toggle docutils container">
<div class="header docutils container">
<p><strong>Answer ▶</strong></p>
</div>
<p>The solution presented here is not the only way to go, but doing these modifications work.
Firstly, create the following file named <code class="docutils literal notranslate"><span class="pre">GetExeInTemp_config.xml</span></code>, in the <code class="docutils literal notranslate"><span class="pre">config</span></code> directory of the repository of configurations cloned previously.</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span> <span class="nt"><getthis</span> <span class="na">reportall=</span><span class="s">""</span><span class="nt">></span>
<span class="nt"><location></span>*<span class="nt"></location></span>
<span class="nt"><samples</span> <span class="na">MaxPerSampleBytes=</span><span class="s">"<SomeLimitOfYourChoice>"</span> <span class="na">MaxTotalBytes=</span><span class="s">"<SomeOtherLimitToChoose>"</span><span class="nt">></span>
<span class="nt"><sample></span>
<span class="nt"><ntfs_find</span> <span class="na">path_match=</span><span class="s">"\Temp\*"</span> <span class="na">header=</span><span class="s">"MZ"</span> <span class="nt">/></span>
<span class="nt"></sample></span>
<span class="nt"></samples></span>
<span class="nt"></getthis></span>
</pre></div>
</div>
<p>Then insert the following command element in <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_config.xml</span></code>, e.g. in the Main archive.</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="nt"><command</span> <span class="na">keyword=</span><span class="s">"GetExeInTemp"</span><span class="nt">></span>
<span class="nt"><execute</span> <span class="na">name=</span><span class="s">"DFIR-Orc.exe"</span> <span class="na">run=</span><span class="s">"self:#GetThis"</span> <span class="nt">/></span>
<span class="nt"><argument></span>/config=res:#GetExeInTemp_config.xml<span class="nt"></argument></span>
<span class="nt"><output</span> <span class="na">name=</span><span class="s">"ExeInTemp.7z"</span> <span class="na">source=</span><span class="s">"File"</span> <span class="na">argument=</span><span class="s">"/out={FileName}"</span> <span class="nt">/></span>
<span class="nt"><output</span> <span class="na">name=</span><span class="s">"ExeInTemp.log"</span> <span class="na">source=</span><span class="s">"StdOutErr"</span> <span class="nt">/></span>
<span class="nt"></command></span>
</pre></div>
</div>
<p>This addition requires that a (non-archived) resource named <code class="docutils literal notranslate"><span class="pre">GetExeInTemp_config.xml</span></code> is available when the configured binary runs; so we have to embed it. To do so, let us edit the file <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_embed.xml</span></code>.
We assume the file <code class="docutils literal notranslate"><span class="pre">GetExeInTemp.xml</span></code> exists along all the others in the <code class="docutils literal notranslate"><span class="pre">config/</span></code> directory. As a result, we insert the line below to the <code class="docutils literal notranslate"><span class="pre">DFIR-ORC_embed.xml</span></code> file.</p>
<div class="highlight-xml notranslate"><div class="highlight"><pre><span></span><span class="nt"><file</span> <span class="na">name=</span><span class="s">"GetExeInTemp_config.xml"</span> <span class="na">path=</span><span class="s">".\%ORC_CONFIG_FOLDER%\GetExeInTemp_config.xml"</span><span class="nt">/></span>
</pre></div>
</div>
<p>Eventually, reconfiguration can be done as documented in step <a class="reference internal" href="#tuto-step-2"><span class="std std-ref">2. Configure</span></a>.</p>
</div>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" >
<a href="platforms.html" title="Requirements"
>next</a>
<li class="right" >
<a href="index.html" title="Introduction"
>previous</a>
|</li>
<li class="nav-item nav-item-0"><a href="index.html">DFIR ORC documentation</a> »</li>
</ul>
</div>
<script type="text/javascript">
$(document).ready(function() {
$(".toggle > *").hide();
$(".toggle .header").show();
$(".toggle .header").click(function() {
$(this).parent().children().not(".header").toggle(400);
$(this).parent().children(".header").toggleClass("open");
})
});
</script>
</body>
</html>