Redline

Machine IP: MACHINE_IP

User: administrator

Password: letmein123!

Accept the Certificate when prompted, and you should be logged into the remote system now.

Note: The lab machine may take up to 3 minutes to load.

Now that you have the overview for Redline, let's move to the Data Collection stage. There are three ways or options to collect data using Redline:

1. Standard Collector  - this method configures the script to gather a minimum amount of data for the analysis. This is going to be our preferred method to collect data in this room. It is also usually the fastest method to collect the data you need. It takes only a few minutes to complete.
2. Comprehensive Collector  - this method configures the script to gather the most data from your host for further analysis. This method takes up to an hour or more. You will choose this method if you prefer the full analysis of the system.
3. IOC Search Collector  (Windows only) - this method collects data that matches with the  Indicators of Compromise (IOCs)  that you created with the help of  IOC Editor . You will choose this method if you want to run the data collection against known IOCs that you have gathered either through threat intelligence (data feed or narrative report), incident response, or malware analysis. You imported them into  IOC Editor . We'll look at the IOC Editor a bit further in the next task.

Before proceeding, launch Redline. The icon is conveniently on the taskbar. 

In this task, we will be using the Standard Collector method.

• From Redline, click on "Create a Standard Collector".
• You will have an option to choose the target platform. In our case, we will select Windows .

• Under the Review Script Configuration, click on “Edit your script”,  this is one of the crucial steps since you will be presented with the set of data to choose to collect from the host. There will be five tabs, which include  Memory, Disk, System, Network, and Other.

Let's dive into some details:

Memory:

You can configure the script to collect memory data such as process listings, drivers enumeration (Windows hosts only), and hook detection  (versions before Windows 10).

Note: For this exercise, uncheck Hook Detection and make sure Aquire Memory Image is also unchecked. 

Be sure to make changes to the settings in each tab as necessary to mirror the settings illustrated in the task content. 

Disk: 

This is where you can collect the data on Disks partitions and Volumes along with File Enumeration.

System:

The system will provide you with machine information:

• Machine and operating system (OS) information
• Analyze system restore points (Windows versions before 10 only)
• Enumerate the registry hives (Windows only)
• Obtain user accounts (Windows and OS X only)
• Obtain groups (OS X only)
• Obtain the prefetch cache (Windows only) 

Network:

Network Options supports Windows, OS X, and Linux platforms. You can configure the script to collect network information and browser history, which is essential when investigating the browser activities, including malicious file downloads and inbound/outbound connections.  

Other:

With this option, you can collect the data on different services and tasks running on the system, including the hashes.

• Now we are ready to proceed to the next important step. After choosing your data options - click OK. And then click on "Browse"  under  "Save Your Collector To" . Why is this an important step? Because you will need to create a folder where your analysis file will be saved and the script for collecting the data you need. In our case, we are saving it to the  Analysis  folder.

Note : You can choose any folder you wish but make sure that the folder is EMPTY. Complete this dialog by clicking the OK button.  

• After you choose to save the collector to the folder, you will see the Collector Instructions.

• If you go into the folder, you will notice the bat file under the name  "RunRedlineAudit" . This is the executable script to collect data from the host. The script needs to be run as Administrator  to be able to collect the data we need.

• Running the script will open a command prompt window; this indicates that the script is running successfully. It will close automatically when the data collection process finishes. 

Note : This process may take between 15-20 minutes to complete.

• After the script is finished, you will notice a new file created - AnalysisSession1  (in the Sessions folder) with the  .mans  extension. This file is what we need to be able to import into Redline for investigation. Just double-click on the file to import the audit data.

d

Tip: If you run the script multiple times, the naming convention of the analysis file will increment by 1. For example, if you run the script two times, you will see AnalysisSession1 and AnalysisSession2 . 

Congratulations! Now you have the data you need and are ready to dive into the investigation process in the upcoming tasks. 

Let's look at the Redline Interface.

You should have your first analysis file. Double-click on the  AnalysisSession1.mans  file and the data will be imported automatically into Redline. Please give it up to 10 minutes to get the data imported.

When the data is imported, you will be presented with this view:

On the left panel, you will see different types of  Analysis Data;  this is where you will perform information gathering and investigation process.

• System Information:  this is where you will see the information about the machine, BIOS (Windows only), operating system, and user information.
• Processes:  processes will contain different attributes such as Process Name, PID, Path, Arguments, Parent process, Username, etc. When you expand the Processes tab, there will be four sections: Handles, Memory Sections, Strings, and Ports.

A  handle  is a connection from a process to an object or resource in a Windows operating system. Operating systems use handles for referencing internal objects like files, registry keys, resources, etc.

Memory Sections  will let you investigate unsigned memory sections used by some processes. Many processes usually use legitimate dynamic link libraries (DLLs), which will be signed. This is particularly interesting because if you see any unsigned DLLs then it will be worth taking a closer look. 

Strings  - you will see the information on the captured strings.

Ports  - this is one of the critical sections to pay attention to. Most malware often initiates the outbound or inbound connections to communicate to their command and control server (C2) to do some malicious activities like exfiltrating the data or grabbing a payload to the machine. This situation is where you can review the suspicious connections from ports and IP addresses. Pay attention to the system processes as well. The threat actors like to avoid detection by hiding under the system processes. For example, explorer.exe or notepad.exe shouldn't be on the list of processes with outbound connections. 

Some of the other important sections you need to pay attention to are:

• File System ( not included in this analysis session )
• Registry
• Windows Services
• Tasks (Threat actors like to create scheduled tasks for persistence)
• Event Logs (this another great place to look for the suspicious Windows PowerShell events as well as the Logon/Logoff, user creation events, and others)
• ARP and Route Entries ( not included in this analysis session )
• Browser URL History ( not included in this analysis session )
• File Download History

The Timeline will help you to better understand when the compromise happened and what steps the malicious actor took to escalate the attack. The Timeline will also record every action on the file if it got create, changed, modified, accessed. 

If you know when the host compromise or suspicious activity occurred, you can use  TimeWrinkles™  to filter out the timeline to only the events that took place around that time. 

TimeCrunches™  helps to reduce the excessive amount of data that is not relevant in the table view. A TimeCrunch will hide the same types of events that occurred within the same minute you specified.

You can find out more about each type of data analysis using the Redline User Guide:  https://fireeye.market/assets/apps/211364/documents/877936_en.pdf .

Now you have learned some basics of different data types to help you during the investigation process. Let's go hunting and see if you can answer some of the questions in the next task.

Now you should be familiar with some of the data collection terms and techniques as shown in the previous task. Armed with this knowledge, can you find what the intruder planted for you on the computer? 

Note: For this task you have to manually run Redline collector on the workstation and use the collected data to answer the questions.

We briefly discussed the usage of the IOC Search Collector in the Data Collection task.

Let's take a closer look at the capabilities of this collector type. But first, let's recap what an IOC is. 

IOC stands for Indicators of Compromise ; they are artifacts of the potential compromise and host intrusion on the system or network that you need to look for when conducting threat hunting or performing incident response. IOCs can be MD5, SHA1, SHA256 hashes, IP address, C2 domain, file size, filename, file path, a registry key, etc.

One of the great tools you can use is  IOC Editor,  created by FireEye, to create IOC files. You can refer to this link to learn how to use the IOC Editor:  https://fireeye.market/assets/apps/S7cWpi9W//9cb9857f/ug-ioc-editor.pdf . 

Note : According to the IOC Editor download page Windows 7 is the latest operating system officially supported. It is the same version installed in the attached VM. There is another tool called OpenIOC Editor by FireEye, which supports Windows 10 that is worth taking a look at. 

Tip : Before proceeding you can close Redline to free up some system resources while using IOC Editor. 

You can create a text file containing IOCs, modify them, and share it with other people in the InfoSec industry.

In this example, we will look at an IOC of a keylogger created with IOC Editor. 

Note : Below, you may follow along with the screenshots and don't have to create the IOC file in this task. You will create an IOC file using IOC Editor and perform an IOC Search in the next task. 

Open IOC Editor which was conveniently placed for you in the taskbar next to Redline. 

Note: It may take ~60 seconds for the application to launch. 

Before proceeding,  create the directory which will store the IOC file (IOC Directory). 

Next, create the IOC file.

Keylogger indicators in IOC Editor :

A brief explanation of the above image:

• The Name of the IOC file is Keylogger, Keylogger.ioc. (this field you can edit)
• The Author is RussianPanda. (this field you can edit)
• GUID ,  Created , and  Modified  are fields you can  NOT  edit, and IOC Editor populates the information.
• Under  Description , you can add a summary explaining the purpose of the IOC file.

The actual IOCs will be added under, you guessed it, Add . 

Here are the values from the image above:

• File Strings - psylog.exe
• File Strings - RIDEV_INPUTSINK
• File MD5 - 791ca706b285b9ae3192a33128e4ecbb
• File Size - 35400

Refer to the gif below to get an idea of adding specific IOCs to the IOC file.

Once you select an item you can enter the value for the item directly. 

You can also add it within the Properties . 

All the fields are read-only except for Content and Comment . To add a value to the item enter it under Content . 

Once you enter the value click Save to save it.

Note : You can right-click on an item for additional options. See below.

We'll leave that for you to explore on your own. 

Now that we've created and saved the IOC file, let's move on and go back to the IOC Search Collector in the Redline tool.

Note : If you closed Redline now is the time to relaunch the application. You can close IOC Editor, again, to free up system resources. 

IOC Search Collector will ignore the data that doesn't match an IOC you have gathered. Although, you can always choose to collect additional data. As the Redline User Guide states, the quality of the IOC analysis will depend on the data you have available in the analysis session.

To create an IOC Search Collector, click "Browse..." and choose the location of the .ioc file. Redline will automatically detect the .ioc file and place it in the Indicators section, as shown below.

IOC Search Collector :

Unsupported Search Terms: These terms will not show any successful hits in Redline, which means Redline doesn't recognize specific search terms. 

Supported Search Terms: The terms that Redline will recognize and search for.

Scenario: You are assigned to do a threat hunting task at Osinski Inc. They believe there has been an intrusion, and the malicious actor was using the tool to perform the lateral movement attack, possibly a "pass-the-hash" attack.

Task: Can you find the file planted on the victim's computer using IOC Editor and Redline IOC Search Collector? 

So far, you only know the following artifacts for the file: 

File Strings: 

• 20210513173819Z0w0=
• <?<L<T<g=

File Size (Bytes): 

• 834936

Note: Use the existing Redline Session found in: C:\Users\Administrator\Documents\Analysis\Sessions\AnalysisSession1.

Scenario : A Senior Accountant, Charles, is complaining that he cannot access the spreadsheets and other files he has been working on. He also mentioned that his wallpaper got changed with the saying that his files got encrypted. This is not good news!

Are you ready to perform the memory analysis of the compromised host? You have all the data you need to do some investigation on the victim's machine. Let's go hunting!

Task :

1. Navigate to the folder on your Desktop titled Endpoint Investigation.
2. Double-click on the AnalysisSession1.mans  file. The data will be imported automatically into Redline.
3. Analyze the file to answer  the questions below.

Note: Give it up to 10 minutes for all the data import.  

As you have seen, Redline is a powerful tool that can guide you through analyzing the compromised host. You also need to consider that the accuracy of the analysis will depend on what kind of data you want to collect. 

Remember, Redline collects various data for analysis, including running processes, services, files, registry structures, event logs, etc. 

While solving the room tasks, you might have noticed that Timeline can be useful when searching for specific keywords. The Timeline can give you an idea of when the attack started and what following actions the attacker took. 

Here is the reference list for you if you missed it in the previous tasks:

• Redline User Guide: https://fireeye.market/assets/apps/211364/documents/877936_en.pdf
• IOC Editor User Guide: https://fireeye.market/assets/apps/S7cWpi9W//9cb9857f/ug-ioc-editor.pdf

Congratulations! Now you have learned a new tool. If you would like to challenge yourself, we recommend the REvil Corp room next. 

Happy Hunting!