With this blog post I am pleased to announce the publication of a new ERNW White Paper about our incident analysis and digital forensics framework. It is available on our website.
Due to the increasing number and impact of computer security incidents, it has become essential to develop and implement efficient measures for their investigation. However, comprehensive forensic analyses are time-consuming, and this time is often not available to security analysts during computer security incidents. As a result, automated tools are increasingly being used. These tools, however, often cover only a limited scope of the necessary analyses and typically require deep technical expertise to be used effectively.
In this white paper the PYRAMID framework (Python YAML-based Response & Analysis for Malware & Incident Detection) is presented. The PYRAMID framework enables automated Incident Analysis (IA) of hard drive disk images in the context of computer security incidents and aims to automatically identify whether a system has been compromised. For this purpose, a workflow was designed to control the execution of 14 integrated analysis tools to reproduce the manual analysis process usually performed by analysts. The framework is structured in a modular way, with each module representing a specific analytical aspect. This architecture supports flexible extension and adaptation to new requirements.
To evaluate the framework, tests were conducted using both compromised and non-compromised disk images. The results demonstrate that the PYRAMID Framework is capable of identifying compromised systems, successfully detecting all 2 truly compromised images out of a total of 6 analyzed disk images. However, a significant number of false positive classifications were also observed. Nevertheless, the framework effectively narrows large datasets to relevant artifacts, since on average only 0.19 % of all files per image needed to be analyzed to determine whether a system was compromised.
The white paper can be found here.
Cheers!
Anne
If you are interested in the PYRAMID framework check out my post about the talk I gave at #TROOPERS26.
Or if you’re looking for support with incident analysis or digital forensics, feel free to contact us.