DinoHunter

Please note: This project is still in pre-release and may not behave as expected

The goal of DinoHunter is to aid Incident Responders with large scale investigations and quickly spin up a temporary Velociraptor and Elastic Stack server in AWS. This solution can act as a "historical" SIEM when no SIEM was present during a compromise. Velociraptor will query the endpoints and can pipe the data into the Elastic Stack for analysis.

To do list

• Create Terraform script that launches the infrastructure
• Automate the Velociraptor server configuration
• Automate the Velociraptor client configuration
• Automate the Filebeat module configuration for Office365

Velociraptor

Velociraptor is a Digital Forensics and Incident Response (DFIR) tool that allows investigators to "dig deeper" at scale.

Velociraptor Benefits

• A single server can handle environments of up to 10,000 endpoints.
• You can parse forensic artifacts on the fly ($MFT, amcache, prefetch, etc)
• Data can be viewed in the Velociraptor GUI or can be sent to the Elastic Stack for dashboarding and visualization

The Elastic Stack

The Elastic Stack is a data analysis platform that can ingest many forms of data in large volumes and present it in a way that is easily analyzed.

Elastic Stack Benefits

• Speed of querying
• Visualizations
• Dashboards
• Can handle a large amount of data

Prerequisites

• The following software installed on your comptuer:
  • Terraform installed and added to PATH
  • AWS IAM User with the below minimum permissions for Terraform

Terraform Minimum Permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:PLACEHOLDER"
      ],
      "Resource": "*"
    }
  ]
}

Usage Instructions

Terraform

To stand up new infrastructure use the following commands:

• Change into the terraform directory and execute the following commands:

  • Initialize the directory with - terraform init

  • Make sure everything looks good with - terraform plan

  • Create the infrastructure with - terraform apply

  • Note the dns name that is listed when it completes

Connect to the new server

• Execute - ../connect/connect.sh
• As long as this SSH session is open you can access the Kibana and Velociraptor front ends at:
  • http://localhost:5601 (Kibana)
  • https://localhost:8889 (Velociraptor)
    • Default Username and Password is admin:admin
• Once connected you can tail -f /home/ubuntu/dh-install.log to quickly see the status of the installation. Wait to connect to the front ends until you see instalation complete: your server is now ready for use in the file.

Configure Velociraptor Agents

Place holder instructions

Configure Velociraptor to send data to elasticsearch

Directions to send Velociraptor data to elasticsearch