Network and process forensics toolset

Network and process forensics toolset
One of our readers recently asked us if we were aware of any integrated tools that would let an analyst compare network events against process events on a specific computer. As he pointed out, there are many tools that can tell you what is going on network-wise (netstat, tcpdump, portmon, etc.) and plenty that can tell you what the computer is doing (procmon, process explorer, etc.) but none that bring them all together. Here is how he described his wish list: I want a tool (or set of tools) for monitoring a Windows PC in such a way that: * it monitors packets in pcap, like tcpdump and * it monitors each process network activity like netstat -anpb while * being able to keep log and records of process activity changes, not just showing the past few seconds' changes. A sample usecase scenario: I wake up in the morning and check my Wireshark or NetWitness Investigator logs and notice a strange session and I want to be able to quickly glue that session to a process that has been responsible for that... While a mix of netstat and command-line Foo for piping outputs to a log file among Wireshark can do the job, I hope there must be a decent and handy tool out there, for this purpose. So, readers - got any ideas? We had a lively debate between some of the handlers earlier today but could not come up with exactly what he is looking for. If you know of such a tool please use the comment feature below to tell us all about it. Of course, we are aware of Microsoft's Sysinternals suite by Mark Russinovich but that is not what our reader is looking for. Thanks for any ideas. Marcus H. Sachs Director, SANS Internet Storm Center	Marcus 301 Posts ISC Handler Apr 11th 2010
Thread locked Subscribe	Apr 11th 2010 1 decade ago
While not satisfying all 3 of the requirements, Microsoft's Network Monitor 3.3 (http://blogs.technet.com/netmon/archive/2009/04/22/network-monitor-3-3-has-arrived.aspx) monitors packets, but organizes them in a tree view by process. I find it helps me easily identify traffic associated with certain processes...even those hosted by svchost.	Mick 1 Posts
Quote	Apr 11th 2010 1 decade ago
TCPSpy may be what you'd want in the *nix world. I don't know if it runs in cygwin, and a quick google search neither confirmed nor denied. Perhaps it's worth a shot though? http://the.wiretapped.net/security/network-monitoring/tcpspy/	brad 3 Posts
Quote	Apr 12th 2010 1 decade ago
I have a free utility on my website that may help. It presently provides output generally matching 2 of the 3 items in the wish list. http://scadmintools.net/advantage.aspx is geared toward targeting remote hosts in an Active Directory environment. Coincidentally, I am planning on updating a couple of features, one of which reads summary stdout from tshark in the next version. This will help to look at general pack caps and associate with Windows diags in a common UI for AD security admins. Time permitting, I should be able to release ADVantage v4 in a month or so.	brad 1 Posts
Quote	Apr 12th 2010 1 decade ago
MS's Network Monitor is a good start. It can be silently installed and scripted to obtain info on a machine after an event occurs. Make a UNC connection to the machine. Silently install MS NetMon with psexec: psexec \\COMPUTERNAME -c NM33_x86.exe /q Check the time on the computer to aid in scheduling the capture task: net time \\COMPUTERNAME Copy a "capture.bat file to the NetMon dir on the machine: xcopy capture.bat "\\COMPUTERNAME\C$\program files\Microsoft Network Monitor 3\" Contents of "capture.bat" c: cd "c:\program files\Microsoft Network Monitor 3" nmcap /network * /capture tcp /File C:\temp\tcp.cap /terminatewhen /timeafter 60 seconds Remotely schedule the task: schtasks /create /s COMPUTERNAME /tn "NetCapTest" /tr "c:\program files\Microsoft Network Monitor 3\capture.bat" /sc once /st 10:25:00 /sd 04/12/2010 Copy the tcp.cap file over and review the contents. Regards.	brad 2 Posts
Quote	Apr 12th 2010 1 decade ago
Microsoft has a service that I just started playing with that will solve part of this issue. "Process Reporter" and its counterpart "Process Reporter Parser". Very cool service and LOTS of data on the processes running. Transparent to the user from what I have found. It has aided us in identifying malware that only 2 of 39 vendors on VirusTotal were able to detect.	brad 1 Posts
Quote	Apr 12th 2010 1 decade ago

One of our readers recently asked us if we were aware of any integrated tools that would let an analyst compare network events against process events on a specific computer. As he pointed out, there are many tools that can tell you what is going on network-wise (netstat, tcpdump, portmon, etc.) and plenty that can tell you what the computer is doing (procmon, process explorer, etc.) but none that bring them all together. Here is how he described his wish list:

I want a tool (or set of tools) for monitoring a Windows PC in such a way that:

* it monitors packets in pcap, like tcpdump and
* it monitors each process network activity like netstat -anpb while
* being able to keep log and records of process activity changes, not just showing the past few seconds' changes.

A sample usecase scenario: I wake up in the morning and check my Wireshark or NetWitness Investigator logs and notice a strange session and I want to be able to quickly glue that session to a process that has been responsible for that...

While a mix of netstat and command-line Foo for piping outputs to a log file among Wireshark can do the job, I hope there must be a decent and handy tool out there, for this purpose.

So, readers - got any ideas? We had a lively debate between some of the handlers earlier today but could not come up with exactly what he is looking for. If you know of such a tool please use the comment feature below to tell us all about it. Of course, we are aware of Microsoft's Sysinternals suite by Mark Russinovich but that is not what our reader is looking for.

Thanks for any ideas.

Marcus H. Sachs
Director, SANS Internet Storm Center

Marcus

301 Posts
ISC Handler

Apr 11th 2010

While not satisfying all 3 of the requirements, Microsoft's Network Monitor 3.3 (http://blogs.technet.com/netmon/archive/2009/04/22/network-monitor-3-3-has-arrived.aspx) monitors packets, but organizes them in a tree view by process. I find it helps me easily identify traffic associated with certain processes...even those hosted by svchost.

Mick

1 Posts

TCPSpy may be what you'd want in the *nix world. I don't know if it runs in cygwin, and a quick google search neither confirmed nor denied. Perhaps it's worth a shot though?
http://the.wiretapped.net/security/network-monitoring/tcpspy/

brad

3 Posts

I have a free utility on my website that may help. It presently provides output generally matching 2 of the 3 items in the wish list. http://scadmintools.net/advantage.aspx is geared toward targeting remote hosts in an Active Directory environment. Coincidentally, I am planning on updating a couple of features, one of which reads summary stdout from tshark in the next version. This will help to look at general pack caps and associate with Windows diags in a common UI for AD security admins. Time permitting, I should be able to release ADVantage v4 in a month or so.

brad
1 Posts

MS's Network Monitor is a good start. It can be silently installed and scripted to obtain info on a machine after an event occurs.

Make a UNC connection to the machine.
Silently install MS NetMon with psexec:
psexec \\COMPUTERNAME -c NM33_x86.exe /q

Check the time on the computer to aid in scheduling the capture task:
net time \\COMPUTERNAME

Copy a "capture.bat file to the NetMon dir on the machine:
xcopy capture.bat "\\COMPUTERNAME\C$\program files\Microsoft Network Monitor 3\"

Contents of "capture.bat"
c:
cd "c:\program files\Microsoft Network Monitor 3"
nmcap /network * /capture tcp /File C:\temp\tcp.cap /terminatewhen /timeafter 60 seconds

Remotely schedule the task:
schtasks /create /s COMPUTERNAME /tn "NetCapTest" /tr "c:\program files\Microsoft Network Monitor 3\capture.bat" /sc once /st 10:25:00 /sd 04/12/2010

Copy the tcp.cap file over and review the contents.

Regards.

brad
2 Posts

Microsoft has a service that I just started playing with that will solve part of this issue.
"Process Reporter" and its counterpart "Process Reporter Parser". Very cool service and LOTS of data on the processes running. Transparent to the user from what I have found. It has aided us in identifying malware that only 2 of 39 vendors on VirusTotal were able to detect.

brad
1 Posts