andreisss / firp

FIRP - First Incident Response Powershell

What can you do with FIRP (Firt Incident Response Powershell)?

• FIRP (Firt Incident Response PowerShell) is a PowerShell-based framework designed to help with incident response activities. The framework is capable of analyzing a variety of security logs and incident response artifacts, including PowerShell and Sysmon logs, as well as Windows event logs, and hope in future to extend to memory.

• FIRP provides a comprehensive set of PowerShell cmdlets that can be used to automate the analysis of these artifacts. The framework can be used to quickly identify and investigate suspicious activities on a system, including malware infections, network intrusions, and other security incidents.

Overall, this framework can be used to automate many of the incident response tasks, making the process faster and more efficient. However, it's important to note that this is just a high-level overview and the actual implementation of such a framework may involve many more steps and considerations depending on the specific requirements of the organization.

How to use it

Open PowerShell with administrative privileges. Import-Module -Force .\firp.ps1

Functions

Get-bruteforce -> Get-bruteforce -StartTime '2023-02-10T12:00:00' -EndTime '2023-02-15T21:58:00'

Get-DetectedMalware -> Get-DetectedMalware -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-DefenderAVRealTimeDisabled -> Get-DefenderAVRealTimeDisabled -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-DefenderAVChange -> Get-DefenderAVChanged -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-DefenderAntimalware -> Get-DefenderAntimalware -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-FailedAndSuccessLogons -> Get-FailedAndSuccessLogons -StartTime '2023-02-12 00:00:00' -EndTime '2023-02-13 23:24:00' > failed.txt

Get-PassTheHash -> Get-PassTheHash -StartTime '2023-01-01T08:06:00' -EndTime '2023-02-19T23:57:00'

Get-ScheduledTaskEventLogs4698 -> Get-ScheduledTaskEventLogs4698 -StartTime '2021-02-14 00:00:00' -EndTime '2023-02-17 23:59:59'

Get-FailedRDP -> Get-FailedRDP -StartTime '2023-02-12 00:00:00' -EndTime '2023-02-13 23:24:00'

Get-FailedNetworkLogons -> Get-FailedNetworkLogons -StartTime '2023-02-12 00:00:00' -EndTime '2023-02-13 23:24:00'

Get-SuccessNetworkLogons -> Get-SuccessNetworkLogons -StartTime '2023-02-12 00:00:00' -EndTime '2023-02-19 23:54:00'

Get-LocalAccountDisabled -> Get-LocalAccountDisabled -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-LocalAccountLockout -> Get-LocalAccountLockout -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-LocalAccountChanged -> Get-LocalAccountChanged -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-Get-LocalAccountEnabled -> Get-Get-LocalAccountEnabled -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-LogonInfo -> Get-LogonInfo -StartTime "2023-02-15T00:00:00" -EndTime "2023-02-16T00:00:00"

Get-LocalAccountCreated -> Get-LocalAccountCreated -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-LocalAccountAddedToAdmin -> Get-LocalAccountAddedToAdmin -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-LocalAccountPwdChanged -> Get-LocalAccountPwdChanged -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-PowerShellLog -> Get-PowerShellLog -Keywords "Invoke-WebRequest" -StartTime '2023-02-10T12:00:00' -EndTime '2023-02-15T21:58:00'

Get-PowerShellLogb64 -> Get-PowerShellLogb64 -StartTime '2023-02-10T12:00:00' -EndTime '2023-02-15T21:58:00'

Get-PowerShellMaldev -> Get-PowerShellMaldev -StartTime '2023-02-10T12:00:00' -EndTime '2023-02-15T21:58:00'

Get-SysmonProcess -> Get-SysmonProcess -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonNetwork -> Get-SysmonNetwork -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonFileStreamCreate -> Get-SysmonFileStreamCreate -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonCreateRemoteThread -> Get-SysmonCreateRemoteThread -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonFileCreate -> Get-SysmonFileCreate -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonProcessTerminate -> Get-SysmonProcessTerminate -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonRegAddDelete -> Get-SysmonRegAddDelete -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonReg -> Get-SysmonReg -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonRegRename -> Get-SysmonRegRename -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonDNS -> Get-SysmonDNS -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonPipe -> Get-SysmonPipe -StartTime '2023-02-19T15:06:00' -EndTime '2023-02-19T17:57:00'

Get-SysmonPipeConnected -> Get-SysmonPipeConnected -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonWMIFilter -> Get-SysmonWMIFilter -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonWMIConsumer -> Get-SysmonWMIConsumer -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonWMIBinding -> Get-SysmonWMIBinding -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonDriver -> Get-SysmonDriver -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-Services -> Get-Services -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

**Get-PrefetchFiles -FolderPath 'C:\Windows\Prefetch' -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Overall, this PowerShell framework can be used to automate many incident response tasks, making the process faster and more efficient. It's important to note that this is just a high-level overview, and the actual implementation of such a framework may involve many more steps and considerations depending on the specific requirements of the organization.

Security Logs

• Analyze Security Logs for brute force attempts, time-frame -> Get-BruteForce
• Analyze Security failed logons and successess, time-frame -> Get-FailedAndSuccessLogons
• Analyze Security suspicious IP connections to the machine, time-frame -> Get-LogonInfo
• Analyze Security scheduled tasks, time-frame -> Get-ScheduledTaskEventLogs4698
• Analyze Security failed RDP sessions, time-frame -> Get-FailedRDP
• Analyze Security failed network logons -> Get-FailedNetworkLogons
• Analyze Security success network logons -> Get-SuccessNetworkLogons
• Analyze Security Pass The Hash Attack -> Get-PassTheHash
• Analyze Security Windows Services -> Get-Services
• Analyze Security Local Account Created -> Get-LocalAccountCreated
• Analyze Security Local Account Added to Administrator Group -> Get-LocalAccountAddedToAdmin
• Analyze Security Local Account Password changed -> Get-LocalAccountPwdChanged
• Analyze Security Local Account Disabled -> Get-LocalAccountDisabled
• Analyze Security Local Account Lockout -> Get-LocalAccountLockout
• Analyze Security Local Account Changed -> Get-LocalAccountChanged
• Analyze Security Local Account Enabled -> Get-LocalAccountEnabled
• Analyze Security User Added or Removed from Security Group -> Get-UserAddedGlobalGroup

Windows Defender Logs

• Analyze Win Defender logs for malware -> Get-DetectedMalware
• Analyze Win Defender logs for Real Time disabled -> Get-DefenderAVRealTimeDisabled
• Analyze Win Defender logs, antimalware configuration changed.-> Get-DefenderAVChanged
• Analyze Win Defender logs, antimalware engine found malware -> Get-DefenderAntimalware

Powershell Logs

• Analyze PowerShell logs using keywords, time-frame -> Get-PowerShellLog
• Analyze PowerShell base64 scripts used, time-frame -> Get-PowerShellLogb64
• Analyze PowerShell malicious keywords as a database (keywords.txt) -> Get-PowerShellMaldev

Sysmon Logs

• Analyze Sysmon Processes using suspicious paths -> Get-SysmonProcess
• Analyze Sysmon Network Activity -> Get-SysmonNetwork
• Analyze Sysmon Zone Identifier files -> Get-SysmonFileStreamCreate
• Analyze Sysmon Process Injection activity -> Get-SysmonCreateRemoteThread
• Analyze Sysmon File Creation -> Get-SysmonFileCreate
• Analyze Sysmon Process Termination -> Get-SysmonProcessTerminate
• Analyze Sysmon Registry key and value create and delete operations -> Get-SysmonRegAddDelete
• Analyze Sysmon value rename operations -> Get-SysmonRegRename
• Analyze Sysmon Registry event records DWORD and QWORD -> Get-SysmonReg
• Analyze Sysmon DNS query -> Get-SysmonDNS
• Analyze Sysmon Pipe Created -> Get-SysmonPipe
• Analyze Sysmon Pipe Connected -> Get-SysmonPipeConnected
• Analyze Sysmon WMI filters -> Get-SysmonWMIFilter
• Analyze Sysmon WMI Consumers -> Get-SysmonWMIConsumer
• Analyze Sysmon WMI binding -> Get-SysmonWMIBinding
• Analyze Sysmon Drivers -> Get-SysmonDriver

Windows Forensic

• Analyze Prefetch file -> Get-PrefetchFiles