Network and process forensics toolset
One of our readers recently asked us if we were aware of any integrated tools that would let an analyst compare network events against process events on a specific computer. As he pointed out, there are many tools that can tell you what is going on network-wise (netstat, tcpdump, portmon, etc.) and plenty that can tell you what the computer is doing (procmon, process explorer, etc.) but none that bring them all together. Here is how he described his wish list:
I want a tool (or set of tools) for monitoring a Windows PC in such a way that:
* it monitors packets in pcap, like tcpdump and
* it monitors each process network activity like netstat -anpb while
* being able to keep log and records of process activity changes, not just showing the past few seconds' changes.
A sample usecase scenario: I wake up in the morning and check my Wireshark or NetWitness Investigator logs and notice a strange session and I want to be able to quickly glue that session to a process that has been responsible for that...
While a mix of netstat and command-line Foo for piping outputs to a log file among Wireshark can do the job, I hope there must be a decent and handy tool out there, for this purpose.
So, readers - got any ideas? We had a lively debate between some of the handlers earlier today but could not come up with exactly what he is looking for. If you know of such a tool please use the comment feature below to tell us all about it. Of course, we are aware of Microsoft's Sysinternals suite by Mark Russinovich but that is not what our reader is looking for.
Thanks for any ideas.
Marcus H. Sachs
Director, SANS Internet Storm Center
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago