You can use Red Canary to automate the collection of a forensics package from your Windows, macOS, and Linux endpoints. This action can be automatically performed whenever a threat is identified or manually invoked for ad-hoc investigations.

Forensic artifacts give you additional visibility into the state of an endpoint and enhance your ability to scope, contain, and eradicate threats.

Use cases

Automate Forensics Packages enable you to quickly capture forensic artifacts from an endpoint before they are tampered with, expire, or the endpoint goes offline. When combined with endpoint telemetry, this information provides a more complete picture of the endpoint in question.

There are two common use cases:

• Automatically collect a forensics package when a high severity threat is identified.
• Manually collect a forensics package to investigate third-party alerts or support internal investigations.

What was once a one-off, time-sensitive process can now be implemented and automated with a few clicks.

Getting started

1. Click Add Action to a new or existing Automate playbook.
2. From Red Canary Prevention, Containment & Response click Collect Forensics.
3. Click +Add to Playbook.
4. Select a File Type (CSV or JSON) and specify who receives a notification when the package is available for download.
   Note: if necessary, also check Require Approval.
5. Click Save.

For ad-hoc investigations, click Run and choose the desired endpoint:

You will receive a notification email that links to the Red Canary "Share a File" system. Follow the link and download your forensics package.

Note: The download link expires after seven days.

Support

The following endpoint sensors support forensics package collection:

• Crowdstrike Falcon

  • Note for Mac Devices: Please download the the official 7zip to extract (https://www.7-zip.org/download.html) the Forensic Package.

    When using a Mac where the archive utility version is outdated, the file will not be able to be unlocked. After updating the archive utility, the file should be able to be decrypted and unpacked using the password ‘infected’.

• Microsoft Defender Endpoint
• VMware Carbon Black Cloud
  
• VMware Carbon Black Response

The following operating systems support forensics package collection:

• Windows
• macOS
• Linux

Important: If you use an application control product like Carbon Black Protection, you must add additional publishers to your allowlist.

Example

We collect anonymous and named pipes on Windows endpoints. Pipes are an interprocess communication mechanism that are utilized both by malware families like NotPetya and Ramnit and by legitimate tools like Cobalt Strike and PsExec (see our earlier blog here on named pipes and lateral movement):

Details collected

Windows forensic artifacts 

macOS forensic artifacts 

Linux forensic artifacts