Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.
Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.
# Active network connections# Windows
netstat -anob > "$EVIDENCE_DIR/netstat_connections.txt" 2>&1
Get-NetTCPConnection | Export-Csv "$EVIDENCE_DIR/tcp_connections.csv" -NoTypeInformation
Get-NetUDPEndpoint | Export-Csv "$EVIDENCE_DIR/udp_endpoints.csv" -NoTypeInformation
# Linux
ss -tulnp > "$EVIDENCE_DIR/socket_stats.txt"
netstat -anp > "$EVIDENCE_DIR/netstat_all.txt" 2>/dev/null
cat /proc/net/tcp > "$EVIDENCE_DIR/proc_net_tcp.txt"cat /proc/net/udp > "$EVIDENCE_DIR/proc_net_udp.txt"# ARP cache
arp -a > "$EVIDENCE_DIR/arp_cache.txt"# Routing table
route print > "$EVIDENCE_DIR/routing_table.txt"# Windows
ip route show > "$EVIDENCE_DIR/routing_table.txt"# Linux# DNS cache
ipconfig /displaydns > "$EVIDENCE_DIR/dns_cache.txt"# Windows# Linux: varies by resolver, check systemd-resolve or nscd
systemd-resolve --statistics > "$EVIDENCE_DIR/dns_stats.txt" 2>/dev/null
# Active firewall rules
netsh advfirewall show allprofiles > "$EVIDENCE_DIR/firewall_rules.txt"# Windows
iptables -L -n -v > "$EVIDENCE_DIR/iptables_rules.txt"# Linux
Step 4: Capture Running Processes
# Windows - Detailed process list
tasklist /V /FO CSV > "$EVIDENCE_DIR/process_list_verbose.csv"
wmic process list full > "$EVIDENCE_DIR/wmic_process_full.txt"
Get-Process | Select-Object Id,ProcessName,Path,StartTime,CPU,WorkingSet |
Export-Csv "$EVIDENCE_DIR/ps_processes.csv" -NoTypeInformation
# Windows - Process with command line and parent
wmic process get ProcessId,Name,CommandLine,ParentProcessId,ExecutablePath /FORMAT:CSV > \
"$EVIDENCE_DIR/process_commandlines.csv"# Linux - Full process tree
ps auxwwf > "$EVIDENCE_DIR/process_tree.txt"
ps -eo pid,ppid,user,args --forest > "$EVIDENCE_DIR/process_forest.txt"cat /proc/*/cmdline 2>/dev/null | tr'\0'' ' > "$EVIDENCE_DIR/proc_cmdline_all.txt"# Process modules/DLLs loaded# Windows
listdlls.exe -accepteula > "$EVIDENCE_DIR/loaded_dlls.txt"# Linuxfor pid in $(ls /proc/ | grep -E '^[0-9]+$'); doecho"=== PID $pid ===" >> "$EVIDENCE_DIR/proc_maps.txt"cat"/proc/$pid/maps" 2>/dev/null >> "$EVIDENCE_DIR/proc_maps.txt"done# Open file handles
handle.exe -accepteula > "$EVIDENCE_DIR/open_handles.txt"# Windows (Sysinternals)
lsof > "$EVIDENCE_DIR/open_files.txt"# Linux
Step 5: Capture Logged-in Users and Sessions
# Windows
query user > "$EVIDENCE_DIR/logged_in_users.txt"
query session > "$EVIDENCE_DIR/active_sessions.txt"
net session > "$EVIDENCE_DIR/net_sessions.txt" 2>&1
net use > "$EVIDENCE_DIR/mapped_drives.txt" 2>&1
# Linuxwho > "$EVIDENCE_DIR/who_output.txt"
w > "$EVIDENCE_DIR/w_output.txt"
last -50 > "$EVIDENCE_DIR/last_logins.txt"
lastlog > "$EVIDENCE_DIR/lastlog.txt"cat /var/log/auth.log | tail -200 > "$EVIDENCE_DIR/recent_auth.txt" 2>/dev/null
