WINDOWS SECURITY: LIVE RESPONSE, FORENSIC ANALYSIS, AND MONITORING

By JOSEPH THOMPSON

CONTENTS PART I PERL SCRIPTING AND LIVE RESPONSE BUILT-IN FUNCTIONS WIN32PL PCLIPPL RUNNING PROCESSES NETSTAT1PL NETSTAT2PL NETSTAT3PL ACCESSING THE API GETSYSPL WMI FWPL NICPL NDISPL DIPL LDIPL ACCESSING THE REGISTRY BHOPL UASSISTPL PROSCRIPTS ACQUIRE1PL FINAL TOUCHES PART II PERL SCRIPTING AND COMPUTER FORENSIC ANALYSIS LOG FILES PARSING BINARY FILES LSLNKPL REGISTRY SAMPARSEPL SECPARSEPL RECENTDOCSPL EVENT LOGS EVT2XLSPL PARSING RAM DUMPS LSPROCPL LSPIPL SYSRESTOREPL PREFETCHPL PARSING OTHER DATA CC-SORTPL PART III MONITORING WINDOWS APPLICATIONS WITH PERL IN THIS TOOLBOX CORE APPLICATION PROCESSES MONITORING SYSTEM KEY PERFORMANCE INDICATORS MONITORING SYSTEM CPU UTILIZATION MONITORING SYSTEM MEMORY UTILIZATION MONITORING SYSTEM NETWORK UTILIZATION MONITORING A CORE APPLICATION PROCESS MONITORING PROCESS AVAILABILITY A SPECI? C PROCESS MONITORING CPU UTILIZATION FOR A SPECI? C PROCESS MONITORING MEMORY UTILIZATION FOR A SPECI? C PROCESS SETTING AND USING THRESHOLDS LOADING AN XML CON? GURATION FILE EVALUATING THRESHOLDS TAKING ACTION PUTTING IT ALL TOGETHER CORE APPLICATION DEPENDENCIES MONITORING REMOTE SYSTEM AVAILABILITY MONITORING AVAILABLE DISK SPACE MONITORING REMOTE DISK AVAILABILITY MONITORING REMOTE DATABASES MONITORING OTHER DEPENDENCIES WEB SERVICES MONITORING WEB SERVICE AVAILABILITY MONITORING WEB SERVICE FUNCTIONALITY BUILDING A MONITORING SYSTEM SUMMARY