Incident Response Security Scripting for Windows and Linux systems

jJgjc

Windows IR Scripting

Below is the IR Script that I produced for Windows systems. The test machine was Windows 2016 Core running inside of VMware Fusion 8. I’ve included some tools for the most commonly requested information. As an incident handler, I believe it is better to use the least complicated tools possibly to get the job done, therefore, avoiding unnecessary complications that run the risk of jeopardizing an incident response investigation. Batch scripting is also within my comfort zone. Another benefit of batch scripting is that they require the least amount of time to prepare and have proven to be very reliable across multiple operating system distributions.

Windows Incident Response Template

https://github.com/SmokeDog88/InfoSec_Ops/blob/master/IR_Script.bat

Below is a screenshot of the output folder that I created for the batch script. I opted to send all scripted test data to a single folder location in an effort to reduce administrative overhead and reduce incident response times.

Below are a few screenshots of some of the output files showing the successful operation of the batch file’s Windows script.

Below are screenshots of the hashed output files and folder.

Hashed toolset:

Hashed output files:

Linux IR Scripting

Below is a basic IR script for Linux systems, which includes some of the most commonly used command line tools. I wrote this using Bash scripting because it is probably the least complicated way to perform incident detection on host computers. It’s generally a good idea to avoid introducing unneeded complexities where not required.

Linux IR 1

Linux Incident Response Template

https://github.com/SmokeDog88/InfoSec_Ops/blob/master/IR_Detect.sh

The output of the script is shown below, revealing the execution and successful completion of the script. The output file location is an added benefit.

Below is the output directory folder. I directed all of the scripts outputs into easily readable text files in a single location for added convenience.

Below are a few screenshots of a few output folders, which indicates that the script executed properly after a few test runs and prior to use in production.