No Maintenance Artifact Library

No longer having to maintain forensic artifact libraries for every security vendor has provided me time to tackle other repetitive investigation tasks with automation.

My next challenge is to eliminate the need for manual updates to the artifact library. As software patches are released, I want to collect the new artifacts and update the database.

No Maintenance Artifact Library

AWS System Manager allows you to automate operational tasks for Linux and Windows systems through an installed SSM agent. I set up a maintenance window to apply all available patches to EC2 instances for CentOS, Ubuntu, and Windows operating systems. The Microsoft system rebooted when required, but I needed shell scripts to test if the Linux boxes required a restart after patching.

Ubuntu

#!/bin/bash
if [ -f /var/run/reboot-required ]
then
    init 6
fi

CentOS

#!/usr/bin/bash
needs-restarting -r
if [ $? -eq 1 ]
then
    init 6
fi

I am capturing the SHA256 values of directory names, file full paths, file contents, and filenames for my primary use cases. I decided to leave MD5 available for legacy vendor support for now. The data is sent to an S3 bucket that gets inserted into DynamoDB that is accessible from an API Gateway.

If you would like to try using the data set, I have provided code samples here: https://4n6ir.com/matchmeta/

Happy Coding!
John Lukach

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s