I'm excited to introduce Dwayne Dunston
who will be talking about creating an
instant response toolkit and also
learning a foreign language Dwayne is a
senior adversarial engineer at Cloud
range a former associate professor of
cyber security at Champlain College he's
been information in information security
since
1997 working in both the education and
government sectors his specializations
are in red teaming blue teaming threat
intelligence risk management practical
use of cryptography security education
threat hunting and using technology for
social change Dwayne also spent six
years as an incident responder within
the government he's a mentor for the
Vermont cyber Patriots program he holds
a ba and Ms from Fifer University and
earned his Doctorate at Northeastern
University he's a frequent contributor
we see him a lot to the cyber security
industry having written dozens of
Articles created courses and programs
and spoken at industry events Dwayne
we're so excited to have you take it
away thanks a lot Leslie thank you folks
for
attending so um talking about creating a
First Responders toolkit and this is
really designed for the that initial you
know we we're not quite sure that's an
incident or not and we want to just you
know run a toolkit want to basically
create a snapshot of what's running on
the system um the latest um processes
that ran current Services running
network sockets Etc or if there's a
known security incident as well and you
know that something's going going on
because someone said there's pop-ups on
the system you looked and see there are
definitely pop-ups on the system or
other behavior that you may suspect or
if you're doing an investigation and you
need to collect data from multiple
systems to see if there's been for
example lateral movement where they move
around to different systems on on your
your network and so this really is about
that more about the first response you
know the the initial collect data let's
try to you collect as much data as we
can see if we can figure out what's
going on
and see if we have an actual incident on
our hands or once again if we have a
known security
incident so who actually uses this tool
who's who's trained to to use it really
can be anybody um it just requires
training it requires ensuring that
people who are going to use this tool
have run it before and sometimes you may
have to talk someone through it who's
never run it before and that's all right
as well it depends on your organization
it depends on your context depends on
the size of your or organization and if
you're in a a distributed organization
with thousands of people you know you
may not have the opportunity to Train
everybody on how to use it and so you
can talk them through it and and we're
going to take a look at that that tool
kit today to show you basically how it's
created and so when you're running that
initial response toolkit you know
running from a USB device is is good
when you have that opportunity and or
you can run it directly on the device
that's that's um impa acted a lot of
debate about whether or not to do that
because you know if you have malware on
a system that's looking for or has anti
forensic you know capabilities built in
it could hide itself or if you know you
may D you may lose evidence because
things overwriting in memory and you
know overwriting on disc
Etc it's it's a lot of debate back and
forth on what's the what's the best
option you know if you plug in a USB
device that could give away that you're
you know on the system and running
things but regardless of having a
toolkit is a a good a good first um uh
line of of response to a potential
security incident so it's going to
depend on your context how you choose to
actually deploy it how you actually
choose to run it run on a USB device is
always you know a good option it's not a
bad option by any means but sometimes
you may have to run it directly own the
device that's that's affected because
USB devices may be disabled or you may
have kind of an aggressive piece of
malware that's causing problems and you
can't get to the or it won't load via
the USB
device I also recommend having a
separate local admin account that you
use run the toolkit because some data
you may need to collect as an admin and
by having a separate local admin account
that allows you to provide some audit
Trails of when this toolkit is used and
you want to be sure that that that the
username for that admin account is
discreet nothing like
toolkit user or something like that keep
it keep the same nomenclature that you
use for your username accounts and also
uh if you have remote auditing remote
logging enabled you can create a filter
so that if someone runs that user
account you know if someone ran the
toolkit or someone's doing something on
the system they probably shouldn't be
doing so um try to run it as a separate
with a separate local admin account so
that you can keep track of of its use
because it collects a lot of data on the
system and realistically it probably
collects more data than um it probably
collects a lot more lot less data than a
attacker potentially has on on your your
organization and on your
systems so the actual toolkit itself it
can consist of a variety of things it
can be free or commercial tools and a
lot of tools that I like to use are are
free and really available or I my own
tools one thing I do on a you know daily
basis or pretty much daily basis is
write malous code and then have to write
have to you know go through the system
and figure out or find all the evidence
of the attack of of the Mal that that I
wrote to see what it did on the system
so we can then train our customers so
noft has a lot of free tools they've
been around for many years and um
they're all free and they all provide
detailed information
on the various aspects of your system um
loaded libraries
um scheduled task views Etc and it also
has both the guey um uh version and
almost all the tools that that the
author writes has a command line version
as well and in this this toolkit
everything has a command line capability
but the gooey tool is there just as well
in cas case you choose to you know you
want to use that first and I'll talk
about that just a few
minutes you can also use native binaries
now of course one of the issues with
that is if the attacker injects
malicious DLS they could potentially
hide their activity their behavior well
because you're running a suite of tools
you it's hope that you can find evidence
of that um you know based on the
analysis and based on you know um you
know the tools that you use so you have
to be sure that when whatever tool you
use you know how to interpret the
results you know how you know how to
interpret the output of it so you want
to be sure you read the documentation
and that you can um interpret that of
course with generative AI that can also
help you with interpreting many aspects
of the output of
tools so when you're using a native
binary one thing I recommend is to copy
that native binary from a clean system
like you know get offline install
Windows whatever versions you run in
your organization and from that CD
create that toolkit you copy that
net.exe to your toolkit directory so
that you know you're running your
version of it and the reason why I
suggest you rename it here is so that
you know you're running your version
because if the attacker changed the path
for all users then you may be running
that version of net.exe that's not
located under C window system 32 it can
be located somewhere else this is where
it should be um now when a file
protection does help mitigate some types
of attacks that could be bypass by all
means so when I rename it tore I know
that there's some you know pretty
certain I'm running only my version from
my toolkit same thing went with third
party tools like from noft when prefetch
very valuable information here of course
this can be cleared by attackers as well
but if you decide to use a tool like say
rename it to something that you use for
your standard um you know nomenclature
again this is to ensure that you're
running the tool that you U
downloaded now and and this this takes
some time it takes a lot of work because
you need to understand how these tools
work you need to understand their
behavior so that you can separate their
behavior from the thread actor's
Behavior or from the malware's behavior
because you don't want to be you know
you don't want to go down a rabbit hole
you want to limit those as as much as
possible during an incident and one tool
you can do to better understand what all
these tools do that you running your
system is process monitor process
monitor provides a lot of details about
what a process is doing and the best
part about it is with process monitor is
that you can create a so you can run
prefetch you prefetch for we prefetch
for example and then you can create a
filter so you only see what the when
prefetch program does because by default
when you run process monitor it shows
you all process is running on the system
all system calls register calls Network
calls uh files open files closed
libraries loaded Etc so process monitor
create a filter for just when prefetch
and then you can examine to see what is
it doing on the system what files does
it open does it create files does it
modify registry um keys does it look at
specific registry keys Etc so once again
you can separate your tools Behavior
form the thread actess
Behavior and the best part about it is
that you can create that filter with
process Monitor and then you can save
those results so that you always have
that when prefetch uh profile that you
can use to compare to you know an
analysis the more you use the tool the
more you test with it the the less
likely you're going to have to pull out
this profile that you created you know
because you're going to start to learn
how this tool Works Its Behavior so that
during an incident you can separate your
tool behavior from your redactor
malicious um Mal
Behavior it's really important you test
this
tool um often as you add a new a new
program run the tool be sure it works
virtually flawlessly as much as possible
so you want to test and then test again
and test a little bit more and just like
the counsil mentioned at the in the last
presentation you want to create
exercises so that you can put it to use
so you don't just run the toolkit and
then wait for something to happen you
can use a program like MAA Cera which is
the threat adversary emulation tool in
this open source so you can download
miter um fire up the web web console or
web page
and then you can run an attack on the
system and run your toolkit and then see
if you can detect what the behavior was
from this from that that run so you
learn how to um identify malicious code
on the system and the more you do it the
more you're going to start developing
some behaviors of Performing really
cursory reviews cursory meaning you can
look at it real quickly see okay there
anything really stand out right away if
not you have to do a much deeper dive
which you're probably going to do any
anyway but um MAA Caldera allows you to
choose a variety of preset attack
profiles and you fire it off on some
systems run the toolkit and then see if
you can detect the behavior because they
document the behavior on the ttps that
they emulate then you should be able to
go back to your toolkit to see if it's
able to pick up and detect those ttps
that have been
executed so let's take a a look at at
this toolkit here and this is going to
be made available just a script because
some tools um the uh your anti virus and
defender or whatever you use May Fire
off and I don't want anyone think of
infecting their systems but I do provide
links to the website so that one you
don't just download this tool and run it
you know still the educator at heart so
uh put some things in here for you to
you to do as
well so basically script starts off by
what's not prompts if you don't need
these prompts here you can comment these
out but essentially if you have a ticket
ticketing system that you use for
incidents or help desk request you can
type in the incident um the or the
ticket number that's references and then
the username of the person who was
logged in when the system started
misbehaving or if it's admin then you
log in as admin if it's you know gugo
then you type in gugo here and the
reason why you do that is because it
basically creates a directory structure
so that it has the ticket number and the
computer name that I ran on because if
you run this on 15 systems then you're
just going to have a computer name with
15 systems on it but you won't know a
ticket number or what incident is
attached to so you can uh keep track of
it easier by having the ticket number
the computer name and then the you know
Dash results and then inside the results
folder is where all the data um that was
collected is stored and you can always
change this to whatever
other you whatever other thing you
use if you have a combination of 32-bit
and 64-bit systems in your
organization you can uncomment this so
you can put in their architecture
because with some tools they have a
32-bit version and they have a 64-bit
version six internals nearsoft they both
have 32 and 64bit versions and what you
can do is then add this variable percent
AR to some of your tools like if there's
a 64 bit bit bit version of um corts
it's going to be C ports X or 64 so you
can put
percent a set here now what happens is
if you don't type in anything here it's
going to run whatever the default
version is but if you have a 64-bit
version and this goes back to how you
name your tools as well then it's going
to go TC ports if you put 64 here it's
going to run TC ports
64 okay if you even used that you may
not even use that now I went through and
modified the script from how I
originally wrote it originally it was
the full path the full command line for
everything it just got hard to read and
hard to keep up with so this is just a
standard batch file for Windows so what
I did is just created some functions to
make things just a bit easier to read
and navigate so this is a c Port it runs
the current Network ports uh correction
it lists the current network sockets on
the system open and this outputs and
comma format this goes back
to uh
oh let me stop my share my apologies
folks air
screen you see my notepad window
here okay sorry about that folks my
apologies um so here's a toolkit this is
the function that takes in the ticket
number for help that system the user for
the user that's running that was running
when the incident occurred or the this
is the username for the user that's
currently running the system as well
like when you run this toolkit who's the
current user logged in and this is where
you can input
that and then it creates this directory
structure here based on the ticket
number and the username so that it
stores the results in a with a common um
structure so once again I'm just
repeating really quick if you have 15
systems involved in this incident you
can keep track of all 15 of those
systems very
easily all
right and then I have the full path to
Powershell because thre axis can copy
Powershell to a different location and
then update the path and make you run
their version this to help ensure I'm
running the U Windows version and again
Windows File protection provides some
protection against um modifying this um
and then here I'm running all uh
currently running listing all processes
first click all network sockets using uh
capturing W is prefetch I'm capturing
these first because these are the most
volatile process listing n reports you
can can change very very quickly so I
want to capture those right away and
then I start going into order of
volatility as much as possible if you
want to collect a memory dck for all
toolkit runs then you can put that here
you can your memory dump first this is
one of those back and forth type of
discussions on which one you should do
first memory dump or or network ports
collect or run the rest of your toolkit
I like to collect the volatile stuff
fast as possible because this memory
dump may take a long time depending on
how much memory you have on your system
and then um collecting other information
DNS you can also run ip config SL
display DNS if you don't want to run
Powershell
commands um so but basically what I'm
doing here is follow this common format
following this format here and if you
have new tools the main thing is to
understand how that tool Works how do
you get data from it and that's what I'm
doing here um pretty much running two
tools um um native Windows Tools near
soft tools and Powershell so that's why
the format pretty much look the same
here and here redirecting into this file
here but I'm using a function to handle
this process for me and again I only did
this to make my toolkit easier to read
and work with you can type in the full
command all on one line and repeat the
same thing over and over and over again
it just got do come something to deal
with on my
end and then to to collect browser
history for example I put some comments
in here these Rim you can just uncomment
these and then um collect whatever data
because I want you know if you decide to
download this I want you to be able to
um edit this and on your own and and run
um and run it based on your your unique
context that's what's the most important
run it based on how you would use this
and need this or you can just use this
as a as a template of how to create that
first response toolkit I'm a big fan of
knowing what's going on when the toolit
is running that's why you see all these
Echo statements so when it runs it's
going to Echo what it's doing throughout
the entirety of this um this toolkit so
if something goes wrong I know where the
error occurred okay browsing history is
going to depend on what browsers you use
for our walk
configs some things take a long time to
run such as collecting file handles and
listing the dlls things of that nature I
tend to put those last on the list and
print to the screen this may take a
while to run because when you're running
um a program and it hangs for a long
time your first thought is uh oh
something happened and you kill the
process so this this is the let the the
person's running this know okay if it
takes two minutes just give it a little
bit more time if you know this takes
more than five minutes put a message
here this may take up to five minutes
this may take up to 10 minutes
Etc and then I'm
collecting the um time stamps for all
files in this case under the user
directory that's impacted by this
particular incident now I can go back in
and run this tool on every directory or
the entire file system which is going to
collect the Mac time the modified access
creation or or um a SE time for for all
all files on on the system that it that
has it can it can open and
access I'll talk about this more just a
few minutes and then collecting browser
data here I'm using um x copy but I have
a note here you know changes to robocopy
it's a more robust way to copy files on
the system use whatever tools you're
familiar with use whatever tools Works
based on your unique
context and then it's going to compress
all the results and then this is a tool
I just added in that will run the
toolkit so you talk to somebody on the
phone they run the toolkit and to help
you know minimize the amount of work
that they have to do they run it and
then this will automatically send the
results to a remote server for analysis
they don't do anything they just run it
and off they go and these just some
functions that handles running the tools
up here okay
um
Can can you see this folder here on the
screen cool all right so I'm going to
run my little malware here um this is
what I wrote for the mosa Institute I
always write my stuff and go so this is
a little um simulation of a ransomware
attack on this system and you can see
that they want five Bitcoin and it's
going to keep popping up every 5 seconds
until I either pay it or I figure out
where the malware is see it's just going
to keep popping up so here's my toolkit
folder I extracted it I downloaded it
and now I'm going to run
it there we go ticket number one looks
good
see that's what malware does to you an
noise
all right and see how it's printing to
the
screen what's going on with the system
with the toolkit as it's running so if
I'm on a phone talking to someone
running this and they're saying it's
taking a long time I can say okay what's
going on what do you see on the screen
so they can give me some feedback on
whether or not the toolkit is running if
there are errors they'll see those
errors and they can tell me what those
errors
are so this is very helpful for folks
who may not be you know um an IT person
but you're able to still commun you
know they still able to give you some
feedback on whether or not the toolkit
is working like it should be
running and so while that's
running on
my Linux box here is where I have the
server running and what's going to
happen is when the toolkit is done
running
there are some few errors there because
it was not able to access and open some
files but tool kit still runs collects
as much data as it can here it's
compressing all the
results all right and over here you see
there's my Sy IR I just uploaded the
results into this folder
here and now I can work on my
analysis
oops oops I am there we
go all
right and here by the result oop sorry
about okay here are the
results from my
toolkit and just for the sake of of
brevity and for this demo you know I
know that I had a VBS script in here but
one thing I like to do is I look at my
uh pretch to see what ran recently now
this is in CSV I could load this into um
Excel or any other tool I use to parse
um um CSV files if you're write in a
toolkit you may want to write tools that
can quickly you know parse things out
but see here is the a program that just
ran the exe that ran you can see the
time that it ran um various data size of
the file you can see the location of the
file right here where I ran it
from um and now that I have for example
this oops
I can do a quick search through all my
files to see where else does it show up
so basically you know again for example
I know that this is something suspicious
because of a high entropy in the name
very unusual name file name I can see it
shows up in the body file shows up in a
process listing which means it's
currently running on this system there's
a process ID 880 I can then use that to
search other um files for any process I
any process using or 880 uh excuse me
for any other processes that may be
accessing or using uh process 8080 there
we go it's a web Port so I'm getting
Tongue Tied here and then this is a tool
that um I'm I modified and I'll talk
about this here basically this creates a
a uh a Tim
stamp correction it collects the Mac
information from for all files in this
directory my home
directory so what we're looking at are
the permissions user ID group ID Mac
time access time creation time Etc and
then you can take a tool and you can run
it across it to uh to get
the data so let me kill this process
here
all right there we
go that'll stop popping
up so I'm going to open up a command
prompt here this will quick
demo let go body
file
process um so let's go body file H it um
creates a body file or processes a body
file and what that means is I can take
this file
that I uh from the
results basically what it does it
creates a um um a timeline of
events sorry about that
put about they to how to R your own
program here we go test. Tex there we go
all
right thank
you and so basically what I have here is
the Mac information for everything that
occurred on this system so for example
with the file.
VBS see has a file. VBS file
there file that VBS file
again and here we go you can see that
file right here was executed and now
you're starting to see my toolkit that
was used right here now just before all
this you can see this. Crypt do Crypt do
Crypt Crypt crypt so now we know done
with ransomware in this case it went
through it searched my
um home directory and encrypted the
various files that I have on my system
right
so that's the basic um way in which this
toolkit runs it captures a lot of data
um on the
system and uh provides lots and lots of
information of you know various aspects
of the system you can make this as
detailed um as you want based on your
unique context DNS queries that occurred
which can be very um invaluable to you
be sure you have tools that you can use
to part parse and process this um really
much easily than looking at it like I
was just doing just for
demonstration all
right and so the toolkit here um is
available via iub as of today the world
premiere of it that you can use as a
Baseline and again it has the links to
the various
programs so that you can download and
and create those tools because once
again it will your AV May alert on on it
so you want to um be aware of
that GitHub the
Dunston and then the go body file
what I did is I modified the timeliner
program so that it can um create the
body file this is my contribution and
the timeliner is what's the go program
that was used originally to uh create
the actual timeline format
okay all
right and
so transition to qu and foreign language
the method that I use for language
learning uh and it you know it works for
some people it doesn't work for others
but it's called comprehensible input and
the emphasis is on learning the language
in context to you know how it's how it's
is used you don't spend a lot of time
initially on learning grammar sentence
structure Etc because when you think
about a child as they're learning to
talk before they learn to read before
they learn sentence structure they're
already able to talk and form a sentence
without knowing the rules of grammar and
so comprehensible input follows that
that format for language acquisition not
just learning or memorizing words but
actually acquiring the language learning
to speak the way native speakers do um
and Stephen rashan has some YouTube
videos that explain this U Concept in
much more detail and there many videos
on how to acquire language using
comprehensible input
I'm currently learning Mandarin I
started back in January and after my I
finished my doctorate degree last year
and I recovered from that I needed
something challenging to do and I wanted
to learn a language and I wanted to
learn something hard that's going to
really really push me something very
different and doesn't have a lot of
similarities or cognates similar words
as as as
English and and manding is what I said
on because I learned as one of the
hardest languages to learn so um there a
few sentences I'm going to um share with
you and if there's any native speakers I
hope I'm doing it justice here three
months in okay so typically um you know
you don't you you don't want to sit and
learn a language just by someone
speaking to you and hope you figure it
out you got to have some context to it
for example War
Dwayne uh
her Cafe
her
p and if you're not a mandering speaker
or if you are hope you understood what I
said but you don't have a lot of context
to what I'm saying there so with
comprehensible input there's typically a
lot of gestures there's props there's
things that so you can visually see
what's going on and can understand the
context you may not understand the words
but you start to pick up what many of
the words mean means for example if
you're a child you say go get the ball
you don't know what a child typically
doesn't know what go get the ball means
they know what ball is and so they get
the ball and they start to learn go get
go get eventually means okay I need to
do go do something go go grab something
so if I change the context of how I just
taught
you
Dwayne Dwayne
Cafe Cafe h
Cafe
Cafe and
so Dwayne I am Dwayne you probably
figure out I'm point to myself
have a birthday cake
here 40
40 four plus four * 10
four Joe Joe Joe I'm 49 years old based
on his birthday birthday cake you can
probably start to put together I'm
telling you what my age is
49 years
old
well I
like is
drink Cafe Cafe even if you don't know
mandin they say Cafe you can probably
figure out they mean Coffee Cafe Cafe
Cafe it's is is one of the few cognates
in the language where it has a very
similar sound to English as it does in
in Mandarin
Cafe
hush
water so well one I like to drink coffee
and water I said H H and then h h
M has different
tones means drink it's a different tone
and then H H H and H and I like to drink
coffee and
water this typically means no I don't Bo
I don't drink
beer
p p beer
P so comprehensive input when it's
taught well taught properly you can
learn a lot from it if you have enough
information and context to go on in this
case I'm giving you some context to what
I'm saying um with my Mandarin teacher
which I'll explain in a minute um 99% of
our conversation is in Mandarin she does
a lot of gestures a lot of props she has
a available and ready so that I don't
understand every single word but I can
start to pick up on the patterns of the
words that she's saying and start to
figure out what she's saying and how I
can respond to her as well other ways to
work on acquiring language is flashcards
like anky it's a free open source tool
client side and web based so you can
have repetition spaced repetition so
once you learn a word really well you
can say don't show me this for another
six you know two weeks if you're
struggling with the word show me again
in 10 minutes and then show or once you
get it show me again tomorrow so that's
space repetition until you start to
acquire and it become second nature to
you talki is a platform that has native
speakers in various languages they often
have free trials so you can see if their
teaching style works for you a lot of
listening and repeating in
comprehensible input lot of repetition
lots of respect with teachers who do
comprehensible input because it's
repetition lots and lots and lots of
repetition Mandarin blueprint has some
um fun programs one it's pretty pricey
but if you want to learn characters you
want to learn a lot of words they also
have a pronunciation course which is um
not as expensive as their full mening
blueprint and they also have a listening
listening repeat type of program um Andy
and Sarah both have um programs that lot
of repetition you listen to what they
say and repeat what they
say my teacher is Amry here um I found
her through
YouTube they have a website u channel
blah blah Chinese blah blah Chinese
which is very interesting um and they
have a lot of super beginner series and
absolute beginner super beginner you're
just starting absolute beginner once
again just a step above the super
beginner um she has a really good series
called love story in a cafe and
she she she has one of the best examples
I've ever seen of of um of this where
she has three sentences she says it like
I did at the beginning of my
presentation and then she just goes over
those three sentences repeatedly over
and over and over and over over again so
that during the entire video you're
you're hearing it over and over and then
it's about 30 videos and at the end of
every video she repeats a story from the
previous videos so by the time you get
get to story 30 you've heard that same
story over and over and over and over
and over again so it's a lot of
repetition if you like a more
traditional way um vaa um she has a
website um or Instagram but also a
website that I have on my slides here
that teaches the more traditional method
that you may be used to of learning
Senate structure and grammar things of
that nature and victory Chinese is her
website along with her other teachers
where you can have one-on-one
conversations to learn Mandarin so
comence would input lots of repetition
to really help you acquire the language
in depth and then you can also go with
the traditional methods of learning as
well and if you have any questions feel
free to reach out to me um um via email
or um I'm good new proo not on Twitter
much but you can find me a LinkedIn or
you can send me an email
directly happy to take any questions
anybody invite
yes Jan you are marvelous thank you for
the incredible
talk um I'm going through the chat uh
there was a question earlier on for you
uh regarding the toolkit account do you
recommend a local account that's an
admin or a domain account scoped like a
local admin oh
H it it typically you can go with a
local admin account um some data you can
get from the domain without having to be
an admin at all and most of the programs
run as a the the user logged in which
hopefully is a normal user but typically
just local account is sufficient and
then you can go back in as necessary to
get additional information with a higher
level
privileges thank you so much we really
appreciate you being here that was
fascinating and doing the Chinese and
the on the Fly is just a daring daring
demo move so wonderful job thank you for
joining today and donating some of your
time to helping helping people learn
lesie Thanks for for um providing this
opportunity and for sharing I appreciate
it