DFIR triage & investigation
When it applies
A host or account is suspected compromised and you need to determine what happened, scope it,
and preserve evidence — quickly, without destroying volatile data.
Why it works
Attacker activity leaves artifacts across a known set of locations (execution, persistence,
logons, network). A disciplined order — preserve volatile first, then map to ATT&CK — gives a
timeline and scope instead of a guess.
Method
- Preserve volatile first (order of volatility): memory (if warranted), then running
processes, network connections, logged-on users — before shutdown/changes.
- Establish the timeline: parse Windows event logs (
chainsaw/hayabusa with Sigma) or
Linux logs/auth; look for initial access, execution, and lateral movement times.
- Check the usual artifacts:
- Execution: prefetch/shimcache/amcache (Win), bash history/
/var/log (Linux), scheduled tasks/cron.
- Persistence: services, run keys, WMI, startup, cron, systemd units, SSH keys.
- Accounts/logons: new users, 4624/4625, sudo, privilege changes.
- Network: current connections, DNS, beaconing patterns.
- Collect at scale with Velociraptor (hunts across hosts) to scope beyond one machine.
- Map findings to ATT&CK, extract IOCs, and hand detections to
defense-detection-sigma.
Gotchas
- Don't reboot/"clean" before capturing volatile evidence — you'll lose the memory/process picture.
- Correlate timestamps across sources (watch timezones/clock skew) to build a real timeline.
- Scope before remediating: one host is rarely the whole incident — hunt the IOCs fleet-wide.
Verify success
A timeline of attacker actions with initial access, persistence, and scope identified, plus IOCs
and mapped ATT&CK techniques ready for detection/containment.
References
SANS DFIR posters; Velociraptor docs; chainsaw/hayabusa; MITRE ATT&CK.
1---2name: defense-dfir-triage3description: First-response DFIR triage: scope an incident, collect volatile evidence, and find attacker activity on Linux/Windows. Load on "incident", "we got breached", "investigate this host", "IOCs", suspected compromise, or forensic triage. Signals: alert to investigate, suspicious host, "what happened".4---56# DFIR triage & investigation78## When it applies9A host or account is suspected compromised and you need to determine what happened, scope it,10and preserve evidence — quickly, without destroying volatile data.1112## Why it works13Attacker activity leaves artifacts across a known set of locations (execution, persistence,14logons, network). A disciplined order — preserve volatile first, then map to ATT&CK — gives a15timeline and scope instead of a guess.1617## Method181. **Preserve volatile first** (order of volatility): memory (if warranted), then running19 processes, network connections, logged-on users — before shutdown/changes.202. **Establish the timeline**: parse Windows event logs (`chainsaw`/`hayabusa` with Sigma) or21 Linux logs/auth; look for initial access, execution, and lateral movement times.223. **Check the usual artifacts**:23 - Execution: prefetch/shimcache/amcache (Win), bash history/`/var/log` (Linux), scheduled tasks/cron.24 - Persistence: services, run keys, WMI, startup, cron, systemd units, SSH keys.25 - Accounts/logons: new users, 4624/4625, sudo, privilege changes.26 - Network: current connections, DNS, beaconing patterns.274. **Collect at scale** with Velociraptor (hunts across hosts) to scope beyond one machine.285. **Map findings to ATT&CK**, extract IOCs, and hand detections to `defense-detection-sigma`.2930## Gotchas31- Don't reboot/"clean" before capturing volatile evidence — you'll lose the memory/process picture.32- Correlate timestamps across sources (watch timezones/clock skew) to build a real timeline.33- Scope before remediating: one host is rarely the whole incident — hunt the IOCs fleet-wide.3435## Verify success36A timeline of attacker actions with initial access, persistence, and scope identified, plus IOCs37and mapped ATT&CK techniques ready for detection/containment.3839## References40SANS DFIR posters; Velociraptor docs; chainsaw/hayabusa; MITRE ATT&CK.
NoorQureshi