THREAT OPS › Threat News › DFIR: From alert to root cause using Osquery without leaving Elastic Security
DFIR: From alert to root cause using Osquery without leaving Elastic Security
<p>Modern DFIR doesn't start with a disk image. That model worked when environments were smaller, endpoints were static, and time wasn't the primary constraint. Endpoints are now ephemeral, fleets scale to thousands of hosts, and attackers operate on timelines measured in minutes. By the time a full forensic image is collected, the system may no longer exist.</p> <p>Forensics today is no longer ab
MITRE ATT&CK techniques
- PowerShellT1059.001
Indicators of compromise
- d86e5d2701b548dfbe0419bcffb2ae82c6ccdeb6dc9612050273c543a6f5215asha256
- https://osquery.io/url
- https://www.sans.org/cybersecurity-focus-areas/digital-forensics-incident-responseurl
- https://osquery.io/schema/5.22.1/#fileurl
- https://www.virustotal.com/gui/file/d86e5d2701b548dfbe0419bcffb2ae82c6ccdeb6dc9612050273c543a6f5215aurl
- https://forensafe.com/blogs/shimcache.htmlurl
- https://forensafe.com/blogs/UserAssist.htmlurl
- https://www.forensafe.com/blogs/shellbags.htmlurl
- https://www.forensafe.com/blogs/prefetch.htmlurl
- https://osquery.io/schema/5.22.1/#shellbagsurl
- https://osquery.io/schema/5.22.1/#shimcacheurl
- https://osquery.io/schema/5.22.1/#userassisturl
- https://osquery.io/schema/5.22.1/#prefetchurl
- https://cloud.elastic.co/registrationurl
- limewire.comdomain
Original source: https://www.elastic.co/security-labs/dfir-osquery-elastic-security