Incident Response & Digital Forensics

事件响应与数字取证

目的

帮助 Claude 按照 NIST SP 800-61 和 SANS PICERL 框架开展结构化事件响应操作。Claude 可生成 IR 手册、指导证据收集及保管链记录、构建取证时间线、解读内存取证输出，并编写事件后报告。

---

激活条件

用户提出以下问题时，此技能会激活：

• 创建事件响应手册（勒索软件、网络钓鱼、数据泄露等）
• 证据收集和保管链流程
• 根据日志或工件构建取证时间线
• 使用 Volatility 进行内存取证
• 生成事件后报告
• DFIR（数字取证与事件响应）流程
• 遏制和根除策略
• 安全事件的根本原因分析
• 面向管理层的 IR 指标、SLA 跟踪或报告

---

前提条件

pip install pyyaml jinja2 pandas python-dateutil

推荐的 DFIR 工具：

• Volatility 3 — 内存取证框架
• Autopsy / Sleuth Kit — 磁盘取证
• plaso / log2timeline — 超级时间线生成
• KAPE — 证据收集（Windows）
• Velociraptor — 企业级终端取证
• FTK Imager — 取证映像（Windows）
• dd / dcfldd / dc3dd — 磁盘映像（Linux）

---

PICERL 框架概述

每次 IR 工作都遵循 PICERL 生命周期：

阶段	关键操作	技能输出
Preparation	验证工具、通信方式和访问权限	准备情况检查清单
Identification	确认事件、范围和严重程度	事件分类
Containment	隔离系统、阻止扩散	遏制行动清单
Eradication	清除威胁、关闭访问途径	根除检查清单
Recovery	恢复系统、验证完整性	恢复运行手册
Lessons Learned	事件后复盘	IR 报告与改进措施

---

核心能力

1. 创建 IR 手册

用户要求为特定事件类型创建手册时：

Claude 会按以下结构生成详细且分配了角色的手册：

勒索软件响应手册（示例）：

# IR Playbook: Ransomware Attack
Version: 2.0 | Owner: SOC Manager | Review: Quarterly

## Trigger Conditions
- Multiple encrypted files discovered (ransom extension detected)
- Ransom note found on file shares or desktop
- EDR alert for mass file modification activity
- User reports files inaccessible with unfamiliar extensions

## Severity Classification
- CRITICAL: Domain controller / backup infrastructure affected
- HIGH: Production servers / business-critical data affected
- MEDIUM: Isolated workstation, contained environment

---

## Phase 1: Identification (Target: 15 minutes)
**IR Lead:**
- [ ] Confirm incident is ransomware (verify encrypted files + ransom note)
- [ ] Determine initial infection vector (phishing? RDP? Supply chain?)
- [ ] Identify Patient Zero — first encrypted system
- [ ] Assess scope: How many systems? Which business units?
- [ ] Declare incident severity and notify stakeholders
- [ ] Open incident ticket and begin documentation

**Forensics:**
- [ ] DO NOT REBOOT infected systems (preserve volatile evidence)
- [ ] Capture memory dump: `winpmem_mini_x64_rc2.exe output.raw`
- [ ] Collect running processes: `tasklist /v > processes.txt`
- [ ] Collect network connections: `netstat -ano > netstat.txt`

## Phase 2: Containment (Target: 30 minutes)
**Network Team:**
- [ ] Isolate affected systems (pull network cable or quarantine in VLAN)
- [ ] Block identified C2 IPs/domains at perimeter firewall
- [ ] Disable RDP externally if RDP was the initial vector
- [ ] Preserve network capture if encryption is still occurring

**Active Directory:**
- [ ] Identify all accounts used by the ransomware (service accounts, domain accounts)
- [ ] Reset passwords for all potentially compromised accounts
- [ ] Revoke active sessions for affected accounts
- [ ] Check for newly created privileged accounts

## Phase 3: Eradication
- [ ] Identify all persistence mechanisms (registry, services, scheduled tasks)
- [ ] Remove all malicious artifacts
- [ ] Verify no backdoors remain (check with Autoruns, process scanning)
- [ ] Patch the exploited vulnerability if one was used

## Phase 4: Recovery
- [ ] Restore from clean backup (verified pre-infection)
- [ ] Validate backup integrity before restoration
- [ ] Rebuild from gold image if backup compromised
- [ ] Verify data integrity after restoration
- [ ] Phased return to production

## Phase 5: Lessons Learned (Within 2 weeks)
- [ ] Full incident timeline documented
- [ ] Root cause identified and remediated
- [ ] Detection gaps addressed
- [ ] CSOC playbook updated
- [ ] Management report delivered

其他支持的手册类型：

• 网络钓鱼活动响应
• 数据泄露 / 数据外泄
• 商业电子邮件入侵（BEC）
• 内部威胁
• DDoS 攻击
• 账户入侵 / 凭据填充攻击
• 供应链入侵
• 云配置错误 / 云端数据泄露

2. 证据收集与保管链

用户要求收集取证证据时：

易失性顺序（最易失 → 最不易失）：

1. CPU registers and cache
2. Routing tables, ARP cache, process table
3. Memory (RAM) — ALWAYS capture first
4. Temporary file systems, swap space
5. Running processes and open files
6. Network connections and open ports
7. Disk images
8. Log files (local + remote SIEM)
9. Physical media

证据收集命令：

# Windows — Live acquisition
winpmem_mini_x64_rc2.exe memory.raw              # Memory dump
tasklist /svc > processes.txt                     # Running processes
netstat -ano > connections.txt                    # Network connections
wmic process get caption,processid,parentprocessid,commandline > process_full.txt
reg export HKLM reg_hklm.reg                     # Registry
dir /s /a "C:\Users\*\AppData\Roaming\*" > appdata.txt

# Linux — Live acquisition
sudo avml /tmp/memory.lime                        # Memory dump (avml)
ps auxf > processes.txt                           # Process tree
netstat -tulnap > connections.txt                 # Network connections
cat /proc/*/cmdline | strings > process_cmdlines.txt
ls -la /tmp/ /var/tmp/ /dev/shm/ > temp_dirs.txt
crontab -l -u root > crontabs.txt
find / -mtime -7 -type f > recently_modified.txt  # Modified in last 7 days

保管链模板：

## Evidence Chain of Custody Form

| Field | Value |
|-------|-------|
| Evidence ID | IR-2025-001-E01 |
| Incident ID | IR-2025-001 |
| Description | Memory dump from HOSTNAME (192.168.1.100) |
| Collected by | [Analyst Name] |
| Collection time | 2025-05-28 14:30 UTC |
| Collection method | winpmem_mini_x64_rc2.exe |
| MD5 hash | [hash of evidence file] |
| SHA256 hash | [hash of evidence file] |
| Storage location | \nas\ir\IR-2025-001\evidence\ |
| Chain of custody | Analyst → Evidence Locker → Lab |

**Access Log:**
| Date/Time | Person | Purpose | Signature |
|-----------|--------|---------|-----------|
| 2025-05-28 14:30 | [Analyst] | Initial collection | [Sig] |

3. 取证时间线分析

用户要求构建事件时间线时：

1. 从所有可用来源收集时间戳：

   • Windows 事件日志（Security、System、Application、PowerShell）
   • Web 服务访问日志
   • 防火墙 / 代理日志
   • 邮件服务器日志（投递、已读回执）
   • 文件系统时间戳（修改、访问、更改、创建）
   • 注册表 LastWrite 时间戳
   • Prefetch 时间戳（执行证据）

2. 统一为 UTC — 转换前确认系统时区

3. 生成超级时间线：

   python scripts/timeline_builder.py --logs ./collected_logs/ --output timeline.csv
   python scripts/timeline_builder.py --logs ./logs/ --format html --start "2025-05-20" --end "2025-05-28"
   

4. 识别攻击链的推进过程：

## Incident Timeline — [Incident ID]

[T-72h] 2025-05-25 09:15 UTC — DELIVERY
  Phishing email received: "Invoice_May2025.pdf.exe" from spoofed sender
  Mail log: SMTP delivery to [email protected] from 185.x.x.x

[T-48h] 2025-05-26 14:22 UTC — EXECUTION
  User executed attachment: Event 4688 (process creation)
  Parent: outlook.exe → Child: powershell.exe -enc [base64]

[T-48h] 2025-05-26 14:22 UTC — C2 ESTABLISHED
  Outbound connection: 203.x.x.x:443 (beacon_interval: 60s)
  DNS query: malicious-c2.evil.com → 203.x.x.x

[T-24h] 2025-05-27 02:00 UTC — LATERAL MOVEMENT
  PsExec from WORKSTATION01 to SERVER02 (admin$)
  Event 4624 (login type 3) on SERVER02 from WORKSTATION01

[T-2h]  2025-05-27 12:30 UTC — DATA EXFILTRATION
  Large POST request (450MB) to dropbox-like service

[T-0h]  2025-05-28 14:00 UTC — DETECTION
  SOC analyst detected anomalous outbound transfer

4. 内存取证

用户分享 Volatility 输出或询问内存取证时：

Volatility 3 常用命令：

# Process listing
python vol.py -f memory.raw windows.pslist
python vol.py -f memory.raw windows.pstree           # Show parent-child
python vol.py -f memory.raw windows.psscan           # Find hidden processes

# Network connections
python vol.py -f memory.raw windows.netscan
python vol.py -f memory.raw windows.netstat

# DLL and module analysis
python vol.py -f memory.raw windows.dlllist --pid [PID]
python vol.py -f memory.raw windows.modscan          # All loaded modules

# Malware detection
python vol.py -f memory.raw windows.malfind           # Injected code
python vol.py -f memory.raw windows.hollowfind        # Process hollowing

# Registry from memory
python vol.py -f memory.raw windows.registry.hivelist
python vol.py -f memory.raw windows.registry.printkey --key "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

# File artifacts
python vol.py -f memory.raw windows.filescan
python vol.py -f memory.raw windows.dumpfiles --physaddr [addr]

可疑内存指标：

• 进程没有对应的磁盘文件（进程空洞化）
• explorer.exe 或 svchost.exe 的父进程异常
• 系统进程（lsass.exe、csrss.exe）建立了网络连接
• windows.malfind 标记的可执行内存区域
• 注入的 shellcode 区域中存在堆叠的 THREADS

5. 事件后报告

用户要求面向管理层或合规用途的 IR 报告时：

# Post-Incident Report — [Incident ID]

**Classification:** CONFIDENTIAL
**Incident Type:** [Ransomware / Data Breach / etc.]
**Severity:** [Critical / High / Medium]
**Incident Window:** [Start] to [End] UTC
**Systems Affected:** [Count and names]
**Data Impact:** [Data at risk / confirmed exfiltrated]
**Report Date:** [Date]
**Report Author:** [IR Lead]

---

## 1. Executive Summary
[3-4 sentences: what happened, how it happened, impact, and current status]

## 2. Incident Timeline
[Key events table with timestamps]

## 3. Root Cause Analysis
**Initial Vector:** [Phishing / Unpatched service / Credential theft / etc.]
**Root Cause:** [Specific technical cause]
**Contributing Factors:**
- [Factor 1: e.g., no MFA on VPN]
- [Factor 2: e.g., delayed patch deployment]

## 4. Impact Assessment
- **Systems Compromised:** [List]
- **Data Accessed/Exfiltrated:** [Description + quantity]
- **Business Impact:** [Downtime hours, revenue impact, regulatory]
- **Customer/Partner Impact:** [If applicable]

## 5. Containment & Remediation Actions
[Chronological list of actions taken]

## 6. Compliance Notification Requirements
- **GDPR:** [Required if EU personal data — 72-hour notification to DPA]
- **HIPAA:** [Required if PHI — notify HHS within 60 days]
- **PCI-DSS:** [Required if cardholder data — notify card brands immediately]
- **State breach laws:** [Applicable laws and timelines]

## 7. Recommendations
| Priority | Recommendation | Owner | Due Date |
|----------|---------------|-------|---------|
| Critical | Deploy MFA for all remote access | IT | 2025-06-01 |
| High | Accelerate patch cycle for internet-facing systems | IT | 2025-06-15 |
| Medium | Implement email attachment sandboxing | Security | 2025-07-01 |

## 8. Lessons Learned
[What worked, what didn't, process improvements]

---

脚本参考

timeline_builder.py

python scripts/timeline_builder.py --logs ./collected_logs/ --output timeline.csv
python scripts/timeline_builder.py --logs ./logs/ --format html --start "2025-05-20" --end "2025-05-28"

---

技能集成

条件	相邻技能
收到 SOC 警报 → 启动 IR	← 技能 11（CSOC 自动化）
收集到恶意软件样本 → 进行分析	→ 技能 05（恶意软件分析）
提取出 IOCs → 在环境中搜寻	→ 技能 06（威胁搜寻）
需要深入分析日志	→ 技能 12（日志分析）

---

参考资料

• NIST SP 800-61 Rev. 2 — 计算机安全事件处理
• SANS 事件响应流程
• Volatility 3 文档
• Velociraptor 文档
• DFIR.training 资源中心
• 《内存取证的艺术》（书籍）

---

v3.0 增强（2026 年更新）

云与身份时代的 IR：

• 云 IR — 提取并分诊 AWS CloudTrail、Azure Activity/Entra 登录与审计日志，以及 GCP Audit 日志；在修复前保留易失的云状态（快照、禁用 IAM 密钥）。
• 身份与 SaaS 入侵 — 处理令牌盗窃/重放、OAuth 授权滥用和联合信任攻击；撤销会话/刷新令牌、轮换签名密钥、审查条件访问。
• 现代工具包 — 使用 Velociraptor 进行大规模资产采集；使用 Hayabusa/Chainsaw + Sigma 分析 EVTX，实现快速 Windows 时间线分析；使用 KAPE 获取分诊映像。
• 勒索软件专项 — 识别双重/三重勒索、加密前数据外泄证据、ESXi/Linux 影响范围，以及基于不可变备份的恢复验证。
• 商业电子邮件入侵 — 收件箱规则和转发滥用、应用密码持久化、邮箱审计日志审查。

**流程规则（优先级不变）：**遵循 NIST SP 800-61 / SANS PICERL；保留证据保管链；在云/OT 环境中权衡证据保全与服务/安全连续性（OT 参见技能 18）。