This app can be used to analyze the volatility 2.6 JSON output of multiple hosts at the same time.
After you import the data into Splunk using the TA-volatility app you can use the three dashboards provided to perform triage and identify low hanging fruits.
Three dashboards are provided:
- Overview: a general view of all imported imaged with for example a network graph, all unique IPs, processes, and commandlines.
- Host Analyzer: choose an host to get a detailed view about possible rogue processes, network artifacts, code injection and others.
- Process Analyzer: a dashboard which provide a drill down based on a particular process ID. You can have in one dashboard the output of the volatility plugins for the choosen process.
The app also introduces some helpful resources like:
- a command called "malfindtoasm" which will display the "data" filed of the malfind command as Assembly Code directly in Splunk
- Two CSV which contains the drivers found the installation of Windows 2012R2x64 and Windows 10x64 which can be used to diff the results obtained from volatility
In order for the dasboards to work properly you have to import the output of the following plugins:
- imageinfo
- malfind
- ldrmodules
- netscan
- modscan
- cmdline
- pslist
- pstree
- psxview
- driverirp
For the "yarascan" module, you have first to parse the output of the plugin and manually generate (unfortunately there is no JSON output for Yara in volatility) a JSON that looks like:
"{"rows":[["win_registry","csrss.exe",14],["win_registry","csrss.exe",2],["win_registry","winlogon.exe",1]......],"columns":["rule","process_name","pid"]}"
Prior to use this app you have to install on your Splunk instance the following apps:
- TA-volatility (thank you for the great examples of the process tree search)
- Sankey Diagram
- Force Directed Visualisation App
Version 1.0 allows you to:
- Have different level of details with the three provided dashboards
- Have a list of all unique IP, process, command lines and other information more found among the different images imported
- Search for unsual assembly code with the "malfindtoasm" command, which displays human readable assembly code in Splunk
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.