How To Use FireEye RedLine For Incident Response | TryHackMe RedLine

Introduction

In This video walk-through, we explained RedLine from Fireeye to perform incident response, memory analysis and computer forensic. This was part 1 video of the redline room from tryhackme.

Blue Team Cyber Security Study Notes

The Complete Practical Metasploit Framework Course

Many tools can aid a security analyst or incident responder in performing memory analysis on a potentially compromised endpoint. One of the most popular tools is Volatility, which will allow an analyst to dig deep into the weeds when examining memory artifacts from an endpoint. But this process can take time. Often, when an analyst is triaging, time is of the essence, and the analyst needs to perform a quick assessment to determine the nature of a security event.

That is where the FireEye tool Redline comes in. Redline will essentially give an analyst a 30,000-foot view (10 kilometers high view) of a Windows, Linux, or macOS endpoint. Using Redline, you can analyze a potentially compromised endpoint through the memory dump, including various file structures. With a nice-looking GUI (Graphical User Interface) – you can easily find the signs of malicious activities.

Here is what you can do using Redline:

• Collect registry data (Windows hosts only)
• Collect running processes
• Collect memory images (before Windows 10)
• Collect Browser History
• Look for suspicious strings
• And much more!

Note: Task 6 has a glitch and tryhackme is working on a fix for it. I will release the answers once the fix is validated.

Setting Up Redline

• The first step involves logging into the virtual machine provided by TryHackMe using Remmina (a remote desktop client). After connecting, the user sees two key programs: Redline and the IOC (Indicators of Compromise) Editor.
• The focus of this video is on Redline, and the next video covers the IOC Editor.

Redline Interface Overview

Upon launching Redline, the software provides three data collection options:

• Standard Collector: The quickest method, gathering basic system information.
• Comprehensive Collector: More detailed and takes longer, useful for analyzing malware incidents in-depth.
• IOC Search Collector: Useful when specific indicators of compromise (e.g., file hashes, domains, IP addresses) are known, and the tool searches for them on the system.

Configuring Data Collection

The video walks through how to configure data collection for forensic analysis. Users can choose to collect data about processes, file systems, network activity, system information, and more.Various customizable options include gathering process details, browser history, DNS tables, event logs, user accounts, and network connections.

The process concludes with saving the configuration, selecting a folder to store the analysis results, and running the data collection.

Analysis of Collected Data

Once data collection finishes, the video demonstrates how to navigate the analysis results. The analysis session is saved in a .MAF (Mandiant Analysis File) format, and the user can begin reviewing the collected information.The video covers the following areas of analysis:

• System Information: Displays details like the OS version, BIOS version, and logged-in users.
• Processes: Lists running processes, their arguments, and connections to system resources.
• Ports and Network Activity: Shows open ports, local and remote connections, and the processes associated with them.
• Timeline: Provides a chronological view of events, such as process creation or file access, which helps analysts track when the compromise occurred.

Using the Timeline and Filters

The timeline feature is particularly useful for understanding when the incident occurred. Users can apply time filters to narrow down events that happened during specific time frames, such as the time surrounding the compromise.

Custom Time Wrinkles allow analysts to focus on events that occurred just before or after the suspected compromise.

Task 7: Investigating a Ransomware Infection

1. Setup:
   • Open the provided analysis session file in Redline.
   • Analyze system information, file system, services, and internet activity.
2. Investigation Steps:
   • Product Name:
     • Navigate to System Information to find the product name (e.g., Windows 7 Home Basic).
   • Identifying Notes on Desktop:
     • Check the file system under the Desktop directory.
     • Locate text files with names indicative of ransomware notes (e.g., read_this.txt).
   • Windows Defender Service DLL:
     • Search for the service WinDefend under Services.
     • Find the ServiceDLL column to identify the associated DLL (e.g., mpsvc.dll).
   • Downloaded ZIP File:
     • Check File Download History for downloaded ZIP files.
     • Locate the file name and confirm its source.
   • Dropped Malicious Executable:
     • Navigate to the Desktop directory in the file system.
     • Identify executable files indicative of ransomware (e.g., Server53.exe).
   • MD5 Hash of Malicious File:
     • Locate the MD5 column in the file properties for the ransomware executable.
   • Name of Ransomware:
     • Deduce the ransomware name from file names (e.g., Server Ransomware).

Task 6: Building and Testing IOC Files

1. Creating an IOC File:
   • Open the IOC Editor in Redline.
   • Define indicators such as:
     • File strings.
     • File size.
   • Add conditions:
     • Use logical operators like AND or OR to combine indicators.
2. Steps to Build the IOC:
   • File Strings:
     • Add file string indicators using provided malicious strings.
   • File Size:
     • Add size conditions to match specific file sizes.
   • Logical Conditions:
     • Combine file strings with OR (either string matches).
     • Combine strings and size with AND (both conditions must match).
3. Testing the IOC File:
   • Load the IOC file into Redline.
   • Configure the data collection script to include file attributes (e.g., strings, MD5 hashes).
   • Run the analysis on the system.
   • View the IOC hits in the results.
4. Known Issue:
   • Redline only detects the IOC file itself as a hit, preventing further analysis for this task.

Key Takeaways

• Forensic Analysis:
  • Redline is effective for analyzing system artifacts such as services, file systems, and internet activity.
• Building IOCs:
  • Combining multiple indicators like file strings and sizes can help detect malicious files.
• Limitations:
  • The current bug in Redline (for this specific TryHackMe task) limits the functionality of IOC testing.

Room Answers | TryHackMe RedLine

Video Walkthrough

P1

P2