Volatility Triage App
Overview
Details
After the import of the necessary data you can easily find outliers and low hanging fruits in case you have to analyze multiple hosts at once. The dashboards offer three different level of detail which ranges from a global view, to an host view, ending with a process view.
Description
This app can be used to analyze the volatility 2.6 JSON output of multiple hosts at the same time.
After you import the data into Splunk using the TA-volatility app you can use the three dashboards provided to perform triage and identify low hanging fruits.
Three dashboards are provided:
- Overview: a general view of all imported imaged with for example a network graph, all unique IPs, processes, and commandlines.
- Host Analyzer: choose an host to get a detailed view about possible rogue processes, network artifacts, code injection and others.
- Process Analyzer: a dashboard which provide a drill down based on a particular process ID. You can have in one dashboard the output of the volatility plugins for the choosen process.
The app also introduces some helpful resources like:
- a command called "malfindtoasm" which will display the "data" filed of the malfind command as Assembly Code directly in Splunk
- Two CSV which contains the drivers found the installation of Windows 2012R2x64 and Windows 10x64 which can be used to diff the results obtained from volatility
In order for the dasboards to work properly you have to import the output of the following plugins:
- imageinfo
- malfind
- ldrmodules
- netscan
- modscan
- cmdline
- pslist
- pstree
- psxview
- driverirp
For the "yarascan" module, you have first to parse the output of the plugin and manually generate (unfortunately there is no JSON output for Yara in volatility) a JSON that looks like:
"{"rows":[["win_registry","csrss.exe",14],["win_registry","csrss.exe",2],["win_registry","winlogon.exe",1]......],"columns":["rule","process_name","pid"]}"
Dependencies
Prior to use this app you have to install on your Splunk instance the following apps:
- TA-volatility (thank you for the great examples of the process tree search)
- Sankey Diagram
- Force Directed Visualisation App
Release Notes
Version 1.0.0
Version 1.0 allows you to:
- Have different level of details with the three provided dashboards
- Have a list of all unique IP, process, command lines and other information more found among the different images imported
- Search for unsual assembly code with the "malfindtoasm" command, which displays human readable assembly code in Splunk