Network Artifacts in Memory

RAM="/cases/CASE001/RAM.raw"
OUT="/cases/CASE001/memory"

# netscan — finds all TCP_ENDPOINT, TCP_LISTENER, UDP_ENDPOINT structures
vol -f $RAM windows.netscan --output csv > $OUT/netscan.csv

# netstat — Windows 10+ alternative (more reliable for newer OS)
vol -f $RAM windows.netstat --output csv > $OUT/netstat.csv

# netscan output columns:
#   Offset    — physical address of the TCP structure
#   Proto     — TCP, TCPv6, UDP, UDPv6
#   LocalAddr — local IP:port
#   ForeignAddr — remote IP:port (the C2!)
#   State     — ESTABLISHED, LISTEN, CLOSE_WAIT, TIME_WAIT
#   PID       — process ID that owns the socket
#   Owner     — process name
#   Created   — connection creation timestamp

# Analyze netscan output for suspicious connections
$net = Import-Csv "/cases/CASE001/memory/netscan.csv"

# Established connections to external IPs from unusual processes
$net | Where-Object {
    $_.State -eq "ESTABLISHED" -and
    $_.ForeignAddr -notmatch "^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01]))" -and
    $_.Owner -notmatch "^(chrome|firefox|edge|svchost.*trusted)"
} | Select-Object Created, Owner, PID, LocalAddr, ForeignAddr, State |
  Sort-Object Created |
  Format-Table -AutoSize

# Look for beacon timing patterns — connections at regular intervals
# Group by PID and ForeignAddr to see recurring connections
$net | Where-Object { $_.State -eq "ESTABLISHED" } |
    Group-Object PID, ForeignAddr |
    Where-Object Count -gt 2 |
    Select-Object Name, Count |
    Format-Table

# Suspicious listening ports (backdoors, local C2 tunnels)
$net | Where-Object {
    $_.State -eq "LISTEN" -and
    $_.LocalAddr -notmatch ":80$|:443$|:445$|:135$|:139$|:3389$"
} | Select-Object Owner, PID, LocalAddr | Format-Table

RAM="/cases/CASE001/RAM.raw"

# Method 1: Use strings to extract DNS cache entries from memory
# DNS entries often have recognizable patterns
strings -el $RAM | grep -iP "^[a-z0-9.-]+\.(com|net|org|io|xyz|ru|cn)\s*$" | \
    sort -u | \
    grep -v "microsoft.com\|windows.com\|windowsupdate.com" > /tmp/dns-strings.txt

# Method 2: Volatility windows.dnsresolver (newer versions have this plugin)
vol -f $RAM windows.dnsresolver --output csv > /tmp/dns-cache.csv 2>/dev/null

# Method 3: Find Dnscache service svchost, dump its memory, grep for DNS entries
# Get PID of svchost hosting Dnscache
vol -f $RAM windows.cmdline | grep -i dnscache

# Then look at the process's heap memory for resolved entries
# Manual: extract VAD memory pages from the Dnscache svchost PID
vol -f $RAM windows.vadump --pid  --output-dir /tmp/dnscache-vad/
strings /tmp/dnscache-vad/*.dmp | grep -iP "\.(com|net|org|io)" | sort -u

# ARP cache from live response (captured BEFORE memory image)
# Should be captured as part of live response phase (Chapter 2)
cat /cases/CASE001/live-response/arp-live.txt

# Alternative: extract from memory image using raw string search
# ARP entries are stored in the TCP/IP driver's MIB structure
# Less reliable than live response — prefer live capture

# strings approach for IP address extraction:
strings -el $RAM | grep -P "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$" | \
    grep -v "0\.0\.0\.0\|255\.255\|127\.0" | \
    sort -u > /tmp/ip-addresses-in-memory.txt

# Cross-reference against known corporate IP ranges
# IPs outside corporate ranges in the ARP cache = lateral movement targets
# or attacker infrastructure