KARIM ASHRAF SPACE.
  • Who Am I ?
  • WRITEUPS
    • What about Practice in Cyber Security?
    • Dark Side of VSCode
    • What about Cy-nix Machine?
    • Cyberdefenders Labs
      • Web Investigation Blue Team Lab
      • Red Stealer Blue Team Lab
      • WebStrike Blue Team Lab
      • BlueSky Ransomware Blue Team Lab
      • PsExec Hunt Blue Team Lab
      • OpenWire Blue Team Lab
      • 3CX Supply Chain Blue Team Lab
      • PoisonedCredentials Lab
      • Reveal Lab
    • Lets Defend
      • Incident Responder Path
        • Cybersecurity Incident Handling Guide
          • Introduction to Incident Handling
          • Incident Handling Steps
          • Preparation
          • Detection and Analysis
          • Containment, Eradication, and Recovery
          • Post-Incident Activity
        • Incident Response on Windows
          • How to Create Incident Response Plan?
          • Incident Response Procedure
          • 3 Important Things
          • Free Tools That Can Be Used
          • Live Memory Analysis
          • Task Scheduler
          • Services
          • Registry Run Keys / Startup Folder
          • Files
          • Checklist
        • Incident Response on Linux
          • How to Create Incident Response Plan?
          • Incident Response Procedure
          • 3 Important Things
          • Users and Groups
          • Processes
          • Files and File System
          • Mounts
          • Network
          • Service
          • Cron Job
          • SSH Authorized Keys
          • Bash_rc & Bash_profile
          • Useful Log Files
        • Hacked Web Server Analysis
          • Introduction to Hacked Web Server Analysis
          • Log Analysis on Web Servers
          • Attacks on Web Servers
          • Attacks Against Web Applications
          • Vulnerabilities on Servers
          • Vulnerabilities in Programming Language
          • Discovering the Web Shell
          • Hacked Web Server Analysis Example
        • Log Analysis with Sysmon
          • Introduction and Set Up of Sysmon
          • Detecting Mimikatz with Sysmon
          • Detecting Pass The Hash with Sysmon
          • Detecting Privilege Escalation with Sysmon
        • Forensic Acquisition and Triage
          • Introduction to Forensics Acquisition and Triage
          • Acquiring Memory Image From Windows and Linux
          • Custom Image Using FTK and Mounting Image for Analysis
          • KAPE Targets for Acquisition
          • KAPE Modules for Triage and Analysis
          • Triage Using FireEye Redline
          • Acquisition and Triage of Disks Using Autopsy
        • Memory Forensics
          • What is Memory Forensics
          • Memory Analysis Procedures
        • Registry Forensics
          • Introduction to Windows Registry Forensics
          • Acquiring Registry Hives
          • Regedit and Registry Explorer
          • System, Users and Network Information
          • Shellbags
          • Shimcache
          • Amcache
          • Recent Files
          • Dialogue Boxes MRU
        • Event Log Analysis
          • Introduction to Event Logs
          • Event Log Analysis
          • Authentication Event Logs
          • Windows Scheduled Tasks Event Logs
          • Windows Services Event Logs
          • Account Management Events
          • Event Log Manipulation
          • Windows Firewall Event Logs
          • Windows Defender Event Logs
          • Powershell Command Execution Event logs
        • Browser Forensics
          • Introduction to Browser Forensics
          • Acquisition
          • Browser Artifacts
          • Tool: BrowsingHistoryView
          • Manual Browser Analysis
          • Hindsight Framework
        • GTFOBins
          • Introduction to GTFOBins
          • Shell
          • Command
          • Reverse Shell
          • Bind Shell
          • File Upload
          • File Download
          • Sudo
        • Hunting AD Attacks
          • Introduction to Active Directory
          • Hunting AS-REP Roasting Attack
          • Hunting for Kerberoasting Attacks
          • Hunting for LDAP Enumerations (Bloodhound_Sharphound)
          • Hunting for NTDS Database Dumping
          • Hunting for Golden Ticket Attacks
          • Hunting for NTLM Relay Attacks
        • Writing a Report on Security Incident
          • Introduction to Technical Writing
          • Reporting Standards
          • Reporting Style
          • Report Formatting
          • Report Templates
        • How to Prepare a Cyber Crisis Management Pla
          • Introduction to Crisis Management
          • General Preparation
          • Tools
          • Backups
          • Alerts and End of Crisis
        • Advanced Event Log Analysis
          • Process Creation
          • DNS Activity
          • File/Folder Monitoring
          • BITS Client Event Log
          • Network Connections Event Log
          • MSI Event Logs
        • USB Forensics
          • Introduction to USB Forensics
          • USB Registry Key
          • USB Event Logs
          • Folder Access Analysis via Shellbags
          • File Access Analysis via Jumplists
          • Automated USB Parsers Tools
        • Windows Disk Forensics
          • SRUM Database
          • Jumplists
          • Recycle Bin Artifacts
          • RDP Cache
          • Thumbnail Cache
    • BTLO LABS
      • Bruteforce BTLO
    • The Complete Active Directory Security Handbook
      • Introduction
      • Active Directory
      • Attack Technique 1: Pass the Hash: Use of Alternate Authentication Material (T1550)
      • Attack Technique 2: Pass the Ticket: Use of Alternate Authentication Material (T1550)
      • Attack Technique 3: Kerberoasting
      • Attack Technique 4: Golden Ticket Attack
      • Attack Technique 5: DCShadow Attack
      • Attack Technique 6: AS-REP Roasting
      • Attack Technique 7: LDAP Injection Attack
      • Attack Technique 8: PetitPotam NTLM Relay Attack on a Active Directory Certificate Services (AD CS)
      • Conclusion & References
    • Windows Privilege Escalation
      • Tools
      • Windows Version and Configuration
      • User Enumeration
      • Network Enumeration
      • Antivirus Enumeration
      • Default Writeable Folders
      • EoP - Looting for passwords
      • EoP - Incorrect permissions in services
      • EoP - Windows Subsystem for Linux (WSL)
      • EoP - Unquoted Service Paths
      • EoP - $PATH Interception
      • EoP - Named Pipes
      • EoP - Kernel Exploitation
      • EoP - AlwaysInstallElevated
      • EoP - Insecure GUI apps
      • EoP - Evaluating Vulnerable Drivers
      • EoP - Printers
      • EoP - Runas
      • EoP - Abusing Shadow Copies
      • EoP - From local administrator to NT SYSTEM
      • EoP - Living Off The Land Binaries and Scripts
      • EoP - Impersonation Privileges
      • EoP - Privileged File Write
      • References
      • Practical Labs
    • Advanced Log Analysis
      • Key Windows Event IDs for Cybersecurity Monitoring
      • Analyzing a Series of Failed Login Attempts from Multiple IP Addresses
      • Steps to Investigate Suspicious Outbound Network Traffic
      • Identifying and Responding to Lateral Movement within a Network
      • Distinguishing Between Legitimate and Malicious PowerShell Executions
      • Detecting and Analyzing a Potential Data Exfiltration Incident Using Log Data
      • Steps to Analyze PowerShell Logging (Event ID 4104) for Malicious Activity
      • How to Identify an Internal Pivot Attack Using Log Data
      • Indicators in Logs Suggesting a Privilege Escalation Attack
      • How to Detect Command and Control (C2) Communication Using Log Analysis
      • How to Analyze Logs to Detect a Brute-Force Attack on an RDP Service
      • How to Analyze Logs to Detect a Brute-Force Attack on an RDP Service
      • How to Detect the Use of Living-Off-the-Land Binaries (LOLBins) in Logs
      • How to Detect Malware Masquerading as a Legitimate Process Using Log Analysis
      • How to Detect and Analyze Lateral Movement Using Windows Event Logs
      • How to Detect Potential Ransomware Attacks in Their Early Stages Using Log Analysis
      • How to Detect and Analyze Privilege Escalation Using Windows Event Logs
      • How to Detect the Use of Mimikatz or Similar Tools in Log Data
      • How to Detect and Analyze DNS Tunneling Through Log Analysis
      • How to Detect a Pass-the-Hash (PtH) Attack Using Logs
      • How to Detect and Analyze an Attacker’s Use of a Remote Access Trojan (RAT) Using Log Data
      • How to Detect Lateral Movement Using Windows Event Logs
      • How to Detect and Investigate Data Exfiltration Using Logs
      • How to Identify and Analyze an Internal Phishing Campaign Using Email and System Logs
      • How to Detect and Analyze Ransomware Activity Using Logs
      • How to Detect Malicious PowerShell Activity Using Log Analysis
      • How to Detect and Respond to Brute-Force Attacks Using Log Data
      • How to Detect Privilege Escalation Attempts Using Windows Event Logs
      • How to Detect and Analyze Suspicious Domain Name Resolution Requests in DNS Logs
      • How to Detect and Respond to Unauthorized Access to Critical Files
      • How to Detect and Analyze Suspicious PowerShell Command Execution
      • How to Detect and Investigate Account Takeover (ATO) Attempts Using
      • How to Detect and Analyze the Use of Living Off the Land Binaries (LOLBins)
      • How to Detect and Investigate Lateral Movement
      • How to Detect and Investigate Data Exfiltration
      • How to Detect and Analyze Suspicious Activity Involving Service Accounts
      • How to Detect and Investigate Anomalous PowerShell Activity Related to Credential Dumping
      • How to Detect and Analyze the Execution of Unsigned or Malicious Executables
      • How to Detect and Investigate Abnormal Spikes in Network Traffic
    • Methods for Stealing Password in Browser
      • Important Tables and Columns
      • Important Queries
      • Profiles
      • Tools
        • HackBrowserData
        • Browser-password-stealer
        • BrowserPass
        • WebBrowserPassView
        • Infornito
        • Hindsight
        • BrowserFreak
        • BrowserStealer
  • The Ultimate Active Directory CheatSheet
  • COURSES SUMMARY
    • TCM SEC
      • TCM linux Privilege Escalation
      • TCM OSINT
    • The SecOps Group
      • Certified AppSec Practitioner exam
      • CNSP Review
    • Cybrary
      • Cybrary Offensive Pentesting
  • TIPS&TRICKS
    • Windows Shorcuts Arrow Remover
    • Kali KEX
    • Intel TurboBoost
    • Pentest_Copilot
    • Ferdium
    • Youtube Adblock_Bybass
    • Burb-Bambdas
    • Burb Customizer
    • BetterFox
Powered by GitBook
On this page
  • Analyzing Mounted File Systems in Incident Response (Linux Systems)
  • Why Mounted File System Analysis is Crucial
  • Steps for Analyzing Mounted File Systems
  • 1. Identify Active Mounts
  • 2. Investigate Logs for Mount Events
  • 3. Evaluate Mounted File Systems
  • 4. Analyze Disk Usage
  • Post-Incident Actions
  • 1. Unmount Suspicious File Systems
  • 2. Isolate Compromised Systems
  • 3. Restore from Backups
  • Hardening and Prevention
  • 1. Restrict Mount Permissions
  • 2. Implement Network Share Security
  • 3. Enable File System Monitoring
  • 4. Use Read-Only Mounts for Non-Essential Data
  • Key Commands
  • Key Points
  1. WRITEUPS
  2. Lets Defend
  3. Incident Responder Path
  4. Incident Response on Linux

Mounts

Analyzing Mounted File Systems in Incident Response (Linux Systems)

In Linux systems, mounted file systems are essential for accessing external drives, network shares, and removable media. However, they can also serve as attack vectors during incidents, especially in ransomware attacks or malware propagation. Here's how to effectively analyze mounted file systems during an incident response.

Why Mounted File System Analysis is Crucial

Attackers exploit file systems for various malicious purposes:

  1. Ransomware Attacks: Encrypt data on shared or mounted storage.

  2. Malware Propagation: Spread malware across network shares and external drives.

  3. Data Exfiltration: Steal sensitive data stored on mounted devices.

  4. Persistence: Store malicious files in obscure mounts to evade detection.

Steps for Analyzing Mounted File Systems

1. Identify Active Mounts

Command: mount

Lists all currently mounted file systems along with their mount points.

mount

Output Example:

/dev/sda1 on / type ext4 (rw,relatime)
192.168.1.10:/shared on /mnt/shared type nfs (rw,noexec)

Command: findmnt

Displays mounted file systems in a tree-like structure, making it easier to trace mount points and dependencies.

findmnt

Command: df -aTh

Shows disk usage and type of file systems in a human-readable format.

df -aTh

Key Information:

  • File System Type: e.g., ext4, nfs, smbfs.

  • Mount Point: e.g., /mnt/shared.

  • Disk Usage: Helps detect unusual or critical storage consumption.

Command: cat /proc/mounts

Reads the real-time list of mounted file systems from the kernel.

cat /proc/mounts

2. Investigate Logs for Mount Events

Though mounting and unmounting events aren't always explicitly logged, they may leave traces in system logs.

Command: dmesg

Search for mount-related events in kernel messages.

dmesg | grep mount

Example Output:

[45678.123456] EXT4-fs (sdb1): mounted filesystem with ordered data mode. Opts: (null)
[45678.654321] CIFS VFS: Server 192.168.1.15 has mounted a share

Command: grep Logs for Related Events

grep "mount" /var/log/syslog
grep "mount" /var/log/messages

Key Logs:

  • Unauthorized mounts: Look for mounts not configured by administrators.

  • Network file systems: Identify mounts from suspicious external servers.

3. Evaluate Mounted File Systems

Focus on Critical Mount Points:

  • /mnt and /media: Temporary storage or external drives.

  • NFS/SMB Shares: Mounted over the network.

  • /dev and /proc: Special file systems that could hide malicious activity.

Look for Unusual or Unauthorized Mounts:

  • Unexpected Remote Shares: Mounted from unknown or unauthorized IPs.

  • Non-Standard Paths: Files or directories mounted in unusual locations.

  • Hidden Volumes: Mounted with obscure names to avoid detection.

4. Analyze Disk Usage

Command: du

Shows disk usage within a specific directory.

du -sh /mnt/shared

Command: lsblk

Displays detailed information about block devices and their mount points.

lsblk

Post-Incident Actions

1. Unmount Suspicious File Systems

If unauthorized or malicious mounts are identified, unmount them immediately:

umount /path/to/mount

2. Isolate Compromised Systems

Quarantine affected systems or shares to prevent further spread of malware or encryption by ransomware.

3. Restore from Backups

If data has been compromised, such as in a ransomware attack, restore the affected file systems from clean, verified backups.

Hardening and Prevention

1. Restrict Mount Permissions

  • Use the noexec option for mounts to prevent execution of binaries.

  • Limit mounting permissions to trusted users only.

Example:

mount -o noexec /dev/sdb1 /mnt/secure

2. Implement Network Share Security

  • Limit access to network shares using IP whitelisting.

  • Monitor and log all access to shared mounts.

3. Enable File System Monitoring

Use tools like Auditd to monitor file system activities, including mount operations:

auditctl -w /mnt -p rwxa -k mounted-shares

4. Use Read-Only Mounts for Non-Essential Data

Prevent attackers from writing malicious files to critical shares:

mount -o ro /dev/sdc1 /mnt/readonly

Key Commands

Command

Purpose

mount

List currently mounted file systems.

findmnt

Display mounts in a tree structure.

df -aTh

Show disk usage and file system types.

cat /proc/mounts

Real-time view of mounted file systems.

`dmesg

grep mount`

umount /path/to/mount

Unmount a suspicious or unauthorized file system.

auditctl -w /mnt

Monitor mounted directories for changes.

Key Points

Mounted file systems are critical to the functionality and storage capabilities of Linux systems, but they also pose security risks during an attack. By methodically analyzing mounted file systems, incident responders can identify malicious activity, secure compromised environments, and prevent further exploitation. Proactive measures such as limiting permissions, monitoring file system activity, and using secure mounts significantly enhance a system's resilience against attacks.

PreviousFiles and File SystemNextNetwork

Last updated 7 months ago