Chapter 8: Network Forensics and Incident Response**

1. Tools and Methods of Network Forensics

  • Two Investigative Approaches:

    1. Real-Time Capture and Analysis: Monitors and analyzes network traffic as it occurs. Requires high processing power (RAM) and large storage capacity (often utilizing RAID 0 for high performance)1. Tools like Kali Linux, Wireshark, and tcpdump are commonly used12.

    2. Retroactive Analysis: Analyzes previously captured and logged network data1.

  • Packet Sniffers & Promiscuous Mode: Packet sniffers capture data packets moving across a wired or wireless network2. To capture all traffic broadcast across a network segment (rather than just packets addressed to its own MAC address), a packet sniffer puts the Network Interface Card (NIC) into promiscuous mode2.

  • Protocol Analyzers: Tools used in conjunction with sniffers to decode, analyze, and interpret traffic protocols passing over a network2.

2. Networking Devices and Forensic Log Sources

Network devices maintain log files that preserve historical evidence, timestamps, and connection records3:

  • Proxy Servers: Intermediary servers that relay requests between client computers and server computers4. Web proxies (handling ports 80, 8080, 443) record client IP addresses and web requests, such as through Squid caching proxy logs45.

  • Web Servers: Deliver HTML documents and associated resources in response to client requests5. Web server logs record the date, time, source IP address, HTTP request method, URI requested, and status codes5more_horiz. Key Linux directories for web server investigations include /var/log (service logs), /var/www/html (web content), /etc/passwd (user logins), and /etc/shadow (password hashes)68.

  • DHCP Servers: Dynamic Host Configuration Protocol (DHCP) dynamically assigns IP addresses, subnet masks, and default gateways to network hosts9. DHCP logs track server startups, shutdowns, lease assignments, requests, and device MAC addresses (stored in Linux at /var/lib/dhcp/dhcpd.leases)10more_horiz.

  • Hubs vs. Switches:

    • Hub: A Layer 1 device that indiscriminately broadcasts all incoming data packets to every connected port12.

    • Switch: A Layer 2 device that forwards data packets specifically to the destination device using a Content Addressable Memory (CAM) table mapping MAC addresses to ports13.

  • SMTP Servers & Email Headers: Simple Mail Transfer Protocol (SMTP) handles outgoing email transmission14. Email headers record the recipient and sender IP addresses, intermediate mail server hops, timestamp trails, and messaging specifications like MIME (Multipurpose Internet Mail Extensions)14more_horiz. DKIM (DomainKeys Identified Mail) authenticates whether the email sender domain is legitimate19.

  • DNS Servers: The Domain Name System (DNS) resolves human-readable domain names into IP addresses19. Key record types include A (IPv4 mapping), AAAA (IPv6 mapping), CNAME (subdomain alias), MX (mail server priority), and PTR (reverse lookup)20.

  • The Hosts File: An operating system file mapping hostnames directly to IP addresses on the local machine before contacting a DNS server21. Located at %SystemRoot%\System32\drivers\etc\hosts in Windows and /private/etc/hosts in macOS2122.

  • Routers: Hardware devices that forward data packets between different networks using routing tables2324. Routers maintain ARP (Address Resolution Protocol) tables that map IP addresses (Layer 3) to physical MAC addresses (Layer 2)2526.

  • Firewalls: Security mechanisms inspecting data packets to block or allow traffic based on configured Access Control Lists (ACLs)2728.

    • Firewall Types: Stateless firewalls, Stateful inspection firewalls (tracking active session streams), Unified Threat Management (UTM), and Next-Generation Firewalls (NGFW, performing deep packet/payload inspection)2829.

  • Intrusion Detection/Prevention Systems (IDS/IPS):

    • IDS: Hardware or software that passively monitors network traffic for signatures or anomalous behavior and generates alerts30. Includes NIDS (network-wide), NNIDS (network node), and HIDS (host-based file snapshot comparison)3132.

    • IPS: Positioned directly in line with traffic to actively block threats, drop malicious packets, or reset compromised connections27.

3. Commonly Used Network Ports

Network processes and applications communicate through 65,535 distinct ports33:

  • Ports 20 & 21: File Transfer Protocol (FTP)34

  • Port 22: Secure Shell (SSH)34

  • Port 23: Telnet remote login34

  • Port 25: Simple Mail Transfer Protocol (SMTP)34

  • Port 53: Domain Name System (DNS)34

  • Port 80: HyperText Transfer Protocol (HTTP)34

  • Port 110: Post Office Protocol 3 (POP3)34

  • Port 143: Internet Message Access Protocol (IMAP)34

  • Port 443: HTTP Secure (HTTPS / TLS)34

  • Port 6667: Internet Relay Chat (IRC - frequently exploited by botnets for Command and Control)3435

4. Understanding the OSI Model

The Open Systems Interconnection (OSI) Model standardizes network communications into 7 distinct layers36:

  1. Layer 1 - Physical Layer: Manages the physical hardware and electrical/optical signaling (coaxial cables, fiber optics, Ethernet, NICs)37.

  2. Layer 2 - Data Link Layer: Handles node-to-node data transfer using physical MAC addresses and ARP3738.

  3. Layer 3 - Network Layer: Handles routing of data packets across logical networks using IP addresses (Routers operate at this layer)24.

  4. Layer 4 - Transport Layer: Manages end-to-end communication reliability using TCP or UDP39.

    • TCP vs. UDP: TCP provides reliable, error-checked, ordered packet delivery; UDP is connectionless and optimized for speed (used in VoIP/streaming)39.

    • TCP Three-Way Handshake: Establishes connections via SYN →\rightarrow SYN-ACK →\rightarrow ACK4041.

    • SYN Flood Attack: A Denial of Service attack where an attacker rapidly transmits SYN requests without returning the final ACK, exhausting server connection queues42.

  5. Layer 5 - Session Layer: Initiates, maintains, and terminates communication sessions between applications43.

  6. Layer 6 - Presentation Layer: Handles data formatting, syntax conversion, compression, and encryption/decryption43.

  7. Layer 7 - Application Layer: Directly interacts with software applications (HTTP, SMTP, FTP, Telnet)44.

5. Voice over Internet Protocol (VoIP)

  • VoIP Definition: Converts analog voice audio signals into digital data packets for transmission over IP networks45.

  • PBX (Private Branch Exchange): An internal enterprise telephone switching system that routes internal calls and shares external phone lines46.

  • SIP (Session Initiation Protocol): An Application Layer signaling protocol used to establish, maintain, and tear down peer-to-peer multimedia sessions (voice, video, instant messaging)47.

  • STUN (Simple Traversal of UDP Through NATs): Allows VoIP devices situated behind NAT routers/firewalls to set up calls with hosts outside the local network48.

6. Incident Response (IR) and Threat Intelligence

  • Security Operations Center (SOC) vs. IR Team: The SOC continuously monitors for anomalous network events, filtering out false positives before escalating genuine breaches to the IR team4849.

  • Triage: The critical initial stage of incident response focused on risk mitigation, capturing volatile/perishable memory, and preventing further data exfiltration or loss50.

  • Threat Intelligence Standards & Sharing:

    • Standards: STIX (Structured Threat Information eXpression), TAXII (Trusted Automated eXchange of Indicator Information), and CybOX (Cyber Observable eXpression) standardize threat formatting and sharing51.

    • Information Sharing Organizations: ISACs (Information Sharing and Analysis Centers), InfraGard, and ECTF (Electronic Crimes Task Force) enable collaborative threat intelligence exchange5152.

7. Advanced Persistent Threats (APTs) & The Cyber Kill Chain

  • Advanced Persistent Threat (APT): A sophisticated, continuous, state-sponsored cyberattack designed to covertly penetrate a network and exfiltrate intellectual property over extended periods (e.g., APT10 / Operation Cloud Hopper)5153.

  • The Cyber Kill Chain (7 Phases):

    1. Reconnaissance: Gathering target intelligence via job postings, press releases, technical forums, and social media54more_horiz.

    2. Weaponization: Coupling an exploit with a malicious payload (e.g., PDF or Trojan)58.

    3. Delivery: Transmitting the payload via spear-phishing emails, web links, or USB drives59.

    4. Exploitation: Executing the malicious code on the target system59.

    5. Installation / Persistence: Installing persistent malware inside system startup directories or registries5960.

    6. Command and Control (C2): Establishing an external, two-way covert management channel (often obfuscated using legitimate platforms like Twitter or Google Groups)61.

    7. Action on Objectives / Exfiltration: Stealing proprietary data or fulfilling attack goals62.

  • TTPs (Tactics, Techniques, and Procedures): Patterns of behavior and methods used by threat actors62. Tools like YARA (malware classification) and VirusTotal (hash checking) assist in identifying TTPs60.

  • DLL Side-Loading: An anti-forensic technique where malware exploits Windows side-by-side assembly features (WinSxS) to execute malicious payloads in RAM, bypassing traditional antivirus file scanners63.

8. Indicators of Compromise (IOCs) & Key Forensic Artifacts

Incident responders examine specific host and network artifacts to identify intrusion indicators6465:

  • Event Logs & Event IDs:

    • Event ID 4624: Successful logon. Logon Type 2 = Interactive local logon; Logon Type 10 = Remote Desktop (RDP) logon (a primary indicator of lateral movement by hackers)66.

    • RDP Event IDs: 21/22 (authentications), 23/24 (logoffs), 1149 (successful RDP authentication)66.

    • Service Installation Event IDs: 7045, 7036, and 469766.

  • File System & Execution Artifacts:

    • Master File Table (MFT)</strong>:MetadatadatabaseforNTFSvolumes.Respondersinspect<code>MFT)</strong>: Metadata database for NTFS volumes. Responders inspect <code>MFT entries to detect timestomping (anti-forensic timestamp alteration), specifically checking the unaltered "FN Info Creation Date"67.

    • $UsnJrnl: Tracks volume change journal history68.

    • AmCache (Amcache.hve) & ShimCache: Record binary execution paths, installation dates, and executables viewed through explorer.exe6970.

    • ShellBags: Registry keys proving historical folder access and navigation by an attacker7071.

    • Volume Shadow Copy (VSC): Historical block-level snapshots used to compare past clean system states against compromised states (analyzed via libvshadow or ProDiscover)7172.

    • Registry Run Keys & MRU Lists: RunMRU and UserAssist keys reveal executed commands and recently opened files7273.

  • Forensic Analysis Suites & Utilities:

    • EDR (Endpoint Detection and Response): Comprehensive enterprise endpoint monitoring systems (e.g., Carbon Black)74.

    • Kibana & Elasticsearch: Log visualization and analytical search platforms used to spot unusual geographic IP connections or off-hours logon bursts74.

    • Log2Timeline / Plaso: Automated timeline creation tools that parse system logs, registries, and event files into a unified chronological timeline75.

    • SANS SIFT Workstation: A free, Linux-based virtual appliance preloaded with digital forensics and incident response utilities (Autopsy, Volatility, Rekall, RegRipper, The Sleuth Kit)76more_horiz.

    • RegRipper: A command-line script utility designed to parse Windows Registry hives (SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT)79.

Key Terms Summary

  • Address Resolution Protocol (ARP): Protocol linking Layer 3 IP addresses to Layer 2 physical MAC addresses80.

  • Advanced Persistent Threat (APT): A sophisticated, state-sponsored network attack aimed at exfiltrating intellectual property80.

  • Anti-Forensics: Techniques used by attackers to manipulate files, wipe logs, or alter timestamps (timestomping) to conceal activity8081.

  • Browser Help Object (BHO): A plugin program that adds functionality to Internet Explorer upon launch80.

  • Default Gateway: The network node (router) that forwards traffic from a local network to outside networks82.

  • Domain Name System (DNS): The hierarchical naming system that resolves domain names into IP addresses82.

  • Dynamic Host Configuration Protocol (DHCP): A service that dynamically assigns IP addresses and network configurations to connecting clients82.

  • Dynamic Link Library (DLL): Shared Windows system files containing executable procedures and drivers82.

  • Firewall: A security system that filters incoming and outgoing network traffic based on Access Control Lists (ACLs)82.

  • Hosts File: A local operating system file mapping hostnames directly to IP addresses83.

  • Intrusion Detection System (IDS): Hardware or software that passively monitors network traffic for malicious activity and policy violations84.

  • Network Address Translation (NAT): A protocol allowing multiple internal private IP addresses to share a single public IP address84.

  • Open Systems Interconnection (OSI) Model: A 7-layer theoretical framework defining how data is transmitted across networks85.

  • Packet Sniffer: A tool that intercepts and logs data packets traversing a network85.

  • Promiscuous Mode: A NIC configuration setting allowing the card to capture all broadcast network traffic regardless of destination address86.

  • Proxy Server: An intermediary computer that relays client requests to destination servers87.

  • Router: A Layer 3 device that routes data packets between different logical networks87.

  • Subnet Mask: A 32-bit value that separates an IP address into its network ID and host ID components81.

  • Transmission Control Protocol (TCP): A reliable, connection-oriented Transport Layer protocol utilizing a three-way handshake88.

  • User Datagram Protocol (UDP): A lightweight, connectionless Transport Layer protocol optimized for transmission speed over error checking88.

  • Voice over Internet Protocol (VoIP): A set of technologies used to transmit voice communications as digital data packets over IP networks88.