네트워크와 메모리 포렌식

네트워크 포렌식 개요

패킷 수집 기초

# tcpdump: capture all traffic on eth0
tcpdump -i eth0 -w /forensics/incident.pcap

# Capture only traffic to/from attacker IP
tcpdump -i eth0 host 198.51.100.10 -w /forensics/attacker.pcap

# Wireshark filter examples:
# Show HTTP GET requests: http.request.method == 'GET'
# Show DNS queries: dns.qr == 0
# Show large outbound transfers: ip.dst != 10.0.0.0/8 && tcp.len > 1000
# Show cleartext FTP creds: ftp.request.command == 'PASS'

NetFlow와 트래픽 분석

# Analyze NetFlow data with nfdump
# Show top talkers (by bytes) in incident time window
nfdump -r /var/cache/netflow/2026/06/20/ \
  -t '2026/06/20.02:00-2026/06/20.06:00' \
  -s ip/bytes -n 20

# Show all connections TO external IPs from suspicious host
nfdump -r /var/cache/netflow/ \
  'src ip 10.0.1.50 and dst ip not in [10.0.0.0/8]'

# VPC Flow Logs provide similar data in cloud environments

DNS 포렌식

# DNS sinkhole detection - check for DGA domains
# DGA: malware generates random domain names to find active C2
# Indicators:
# - High volume of NXDOMAIN responses from one host
# - Domain names with high entropy (random characters)
# - Queries to .ru/.cn/.tk TLDs unusual for organization

# Wireshark filter for NXDOMAIN responses
dns.flags.rcode == 3  # NXDOMAIN

# Calculate domain entropy to find DGA
# Legitimate: google.com (low entropy)
# DGA: xk3j9pqm2v.com (high entropy)

C2 통신 패턴

# Detect beaconing behavior with Zeek/RITA
# RITA (Real Intelligence Threat Analytics) analyzes Zeek logs

# Manual NetFlow beacon detection
nfdump -r /var/cache/netflow/ \
  'src ip 10.0.1.50' \
  -o 'fmt:%ts %sa %da %dp %byt' |
  awk '{print $1}' | sort | uniq -c
# Regular intervals in the timestamp column = beaconing

# Zeek conn.log: look for many connections to same IP
# with similar connection durations and small byte counts

Volatility를 활용한 메모리 포렌식

# Volatility 3 memory analysis commands
# List running processes
vol -f memory.raw windows.pslist

# List processes showing hidden/injected processes
vol -f memory.raw windows.pstree

# Find process injection (code in wrong memory regions)
vol -f memory.raw windows.malfind

# List network connections at time of capture
vol -f memory.raw windows.netstat

# Dump a suspicious process's memory for further analysis
vol -f memory.raw windows.memmap --pid 1234 --dump

메모리에서 악성 코드 Detect

# Find suspicious executable memory regions (malfind output)
# Look for:
# - MZ header (PE file magic bytes: 4d 5a) in injected memory
# - Memory pages with Read+Write+Execute permissions (uncommon)
# - Code in heap or stack regions

vol -f memory.raw windows.malfind
# Output shows process, virtual address, protection flags, hex dump
# MZ in non-standard location = process injection indicator

# Compare pslist (API) vs psscan (pool scanner) to find hidden procs:
vol -f memory.raw windows.psscan  # shows processes hidden from API

메모리에서 자격 증명 추출

# Extract cached credentials from LSASS memory (forensic use)
vol -f memory.raw windows.hashdump  # extracts NTLM hashes from SAM

# Detect Mimikatz execution in memory:
vol -f memory.raw windows.malfind | grep -i lsass
# Or search for Mimikatz strings in process memory:
vol -f memory.raw windows.strings --pid <lsass_pid> |
  grep -i 'mimikatz\|sekurlsa\|wdigest'

# Defense: Credential Guard (Windows 10+) moves LSASS credentials
# to a protected VTL1 hypervisor environment Mimikatz cannot access

네트워크와 메모리 증거의 상관 분석

Network Time Protocol(NTP)과 타임스탬프 정확도

# Verify NTP synchronization on Linux
timedatectl status
# Check: 'System clock synchronized: yes'
# Check: 'NTP service: active'

# Check NTP peers
ntpq -p
# *  = current reference, + = candidate

# Windows NTP status
w32tm /query /status

# During incident: document the clock offset of each system
# so timestamps can be normalized in the timeline

암호화된 트래픽 분석의 과제

# Zeek extracts JA3 fingerprints from TLS connections
# ssl.log contains JA3 and JA3S hashes
# Check against known-malware JA3 database

cat ssl.log | zeek-cut ja3 ja3s server_name |
  sort | uniq -c | sort -rn | head -20

# Known malware JA3 hashes (examples):
# Metasploit: 6734f37431670b3ab4292b8f60f29984
# Cobalt Strike: 72a589da586844d7f0818ce684948eea
# Reference: https://github.com/salesforce/ja3

빠른 확인

lesson 요약