Scripting Continued

So at work I thought I had to fly very quickly somewhere to help fix something. I was thinking 'sheesh I don't have a script I can quickly run on a system to grab volatile data. Shame on me!' Also not knowing if I was going to an XP land or potentially Win7 world , I decided to use SysInternals tools and DumpIt! in my script, as I can easily get their hashes, load them on a USB drive- and lug them with me.

My script wasn't horrible, but it wasn't super awesome either. It got the key aspects for live response, but thats it.

Then my buddy HiddenIllusion reminded me of Triage-IR, a tool written by Michael Ahrendt, and talked about in his blog Student of Security (aren't we all Michael). This tool pretty much blew mine out of the water. All you have to do is download the package, and be sure to add the SysInternalsSuite folder under 'Tools' and kablamo.

So what does this tool grab? Some highlights:

• Memory (although when I ran it on Win7 it did not work... still troubleshooting)
• Registry Hives
• Network Connections (including net sessions and files)
• Prefetch Files
• Services
• Processes
• Jump Lists

He then takes every file created in the script and creates MD5 and SHA1 hashes of each. He also has an incident log showing each command that has been executed including date and time. Oh, and THEN he compresses everything via 7-zip.

Why reinvent the wheel when someone else has done it? :)

Now of course a potential downfall is you cannot modify this to add/remove tools and commands-- however its a great script which works in many scenarios.
UPDATE: Michael let me know the source IS included, and it's in the AutoIT Script Language. Modify away!!

Does anyone have a script for volatile data collection they hold near and dear to their hearts? Let us know about it! The more versatile our arsenal-- the better we can combat threats.