Skip to content

Commit 4f0376d

Browse files
InvalidWaldoInvalidWaldo
committed
1.08 - Initial Public Release
0 parents  commit 4f0376d

11 files changed

Lines changed: 1347 additions & 0 deletions

File tree

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
FLAIR/
2+
Research/
3+
*.inf
4+
*.rpt
5+
~$*.*

‎FLAIR.cmd‎

Lines changed: 429 additions & 0 deletions
Large diffs are not rendered by default.

‎LICENSE‎

Lines changed: 674 additions & 0 deletions
Large diffs are not rendered by default.

‎MakeFlare.cmd‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
@echo off
2+
REM
3+
REM ## Filename | MakeFlare
4+
REM
5+
REM ## Author | Alan Melia (F-Secure)
6+
REM
7+
REM ## Description | Perform collection of transient data for later analysis
8+
REM
9+
for /f "tokens=1-4" %%a in ( Versions.md ) do if "%%b" NEQ "|" SET V_BLD=%%b
10+
echo FLAIR_%V_BLD%
11+
12+
ECHO .OPTION EXPLICIT ; Generate errors >"FLAIR.ddf"
13+
ECHO .Set DiskLabel1="F-Secure FLAIR %V_BLD%" >>"FLAIR.ddf"
14+
ECHO .Set CabinetNameTemplate="FLAIR_%V_BLD%.cab" >>"FLAIR.ddf"
15+
ECHO .Set RptFileName="FLAIR_%V_BLD%.rpt" >>"FLAIR.ddf"
16+
ECHO .Set InfFileName="FLAIR_%V_BLD%.inf" >>"FLAIR.ddf"
17+
ECHO .Set CompressionType="LZX" >>"FLAIR.ddf"
18+
ECHO .Set UniqueFiles="ON" >>"FLAIR.ddf"
19+
ECHO .Set Cabinet="ON" >>"FLAIR.ddf"
20+
ECHO .Set CabinetFileCountThreshold=0 >>"FLAIR.ddf"
21+
ECHO .Set FolderFileCountThreshold=0 >>"FLAIR.ddf"
22+
ECHO .Set FolderSizeThreshold=0 >>"FLAIR.ddf"
23+
ECHO .Set MaxCabinetSize=0 >>"FLAIR.ddf"
24+
ECHO .Set MaxDiskFileCount=0 >>"FLAIR.ddf"
25+
ECHO .Set MaxDiskSize=CDROM >>"FLAIR.ddf"
26+
ECHO .set DestinationDir="FLAIR" >>"FLAIR.ddf"
27+
ECHO .set DiskDirectoryTemplate="FLAIR" >>"FLAIR.ddf"
28+
ECHO .new Folder >>"FLAIR.ddf"
29+
ECHO ".\FLAIR.ddf" >>"FLAIR.ddf"
30+
REM =====================================================================================
31+
ECHO ".\FLAIR.cmd" >>"FLAIR.ddf"
32+
ECHO ".\ReadMe.md" >>"FLAIR.ddf"
33+
REM =====================================================================================
34+
REM Now add the Utils subfolders
35+
REM =====================================================================================
36+
ECHO Adding "Utils"
37+
ECHO .set DestinationDir="FLAIR\Utils" >>"FLAIR.ddf"
38+
ECHO .new Folder >>"FLAIR.ddf"
39+
for /f "delims=@" %%a in (' dir /a:-d /b ".\Utils\*.*"') do (
40+
ECHO ".\Utils\%%a" >>"FLAIR.ddf"
41+
)
42+
REM =====================================================================================
43+
REM Make the CAB
44+
REM =====================================================================================
45+
makecab.exe /f "FLAIR.ddf"
46+
47+
copy /b "%windir%\system32\extrac32.exe"+"FLAIR_%V_BLD%.cab" "FLAIR_%V_BLD%.exe"
48+
del /q /f "FLAIR_%V_BLD%.cab"

‎Readme.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# F-Secure Lightweight Acquisition for Incident Response (FLAIR)
2+
3+
This document describes the purpose and basic operation of the FLAIR acquisition script.
4+
5+
## Purpose
6+
7+
During the investigation of incidents on a client estate, there are occasions where there is no EDR deployed which the IR team can collect artefacts across the client estate. FLAIR was created to perform the semi-automated acquisition of several key artefacts from a host.
8+
FLAIR bridges the gap between the deep level of data available from a full forensic image of the host and the more targeted and interactive approach offered by EDR solutions.
9+
10+
## Design
11+
12+
FLAIR was created based on the following principles:
13+
14+
* As far as practical, only use tooling native to Microsoft Windows systems. i.e. Only programs 'built-in' to the OS
15+
* No 3rd party programs. i.e. only Microsoft signed executables will reduce the impact on running the acquisition on sensitive client sites.
16+
* Batch file operation for maximum compatibility and minimum dependencies.
17+
* Windows XP is the minimum platform version to allow for collections to take place on systems which are out-of-support. (i.e. IoT/ICS envorinments)
18+
19+
## Operation
20+
21+
Execute the 'FLAIR.cmd' from either an external storage device (i.e. a USB drive) or a mapped network drive.
22+
23+
Processing can take over 20 minutes to process and as a lot of files are created/examined the duration has been observed as taking over an hour especially when AV is active.

‎Utils/DiskShadow.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
list shadows all
2+
list providers
3+
list writers detailed

‎Utils/EventLogs.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
System
2+
Application
3+
Security
4+
Powershell
5+
Windows Powershell
6+
Microsoft-Windows-PowerShell/Admin
7+
Microsoft-Windows-PowerShell/Operational
8+
Microsoft-Windows-Windows Defender/Operational
9+
Symantec Endpoint Protection Client
10+
Microsoft-Windows-RemoteApp and Desktop Connections/Operational
11+
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
12+
Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational
13+
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
14+
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
15+
Microsoft-Windows-WMI-Activity/Operational
16+
MSExchange Management

‎Utils/Get_Files.txt‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Malware %SystemRoot%\Cursors\*.exe
2+
Malware %SystemRoot%\Cursors\*.dll
3+
WMI %SystemRoot%\system32\wbem\Repository\FS\OBJECTS.DATA
4+
WMI %SystemRoot%\system32\wbem\Repository\OBJECTS.DATA
5+
Defender %temp%\DiagOutputDir\MPSupportFiles.cab
6+
Defender %ProgramData%\Microsoft\Windows Defender\Support\MpSupportFiles.cab
7+
MRT %systemroot%\debug\mrt.log
8+
MRT %systemroot%\debug\msert.log
9+
Avast C:\Documents And Settings\All Users\Application Data\Avast Software\Avast\Log\*.*
10+
Avast %ProgramData%\Avast Software\Avast\Log\*.*
11+
Avast C:\users\%USERNAME%\Avast Software\Avast\Log\*.*
12+
Avast %ProgramData%\Avast Software\Avast\Chest\index.xml
13+
AVG %ProgramData%\AVG\Antivirus\chest\*.*
14+
AVG %ProgramData%\AVG\Antivirus\report\*.*
15+
Avira %ProgramData%\Avira\Antivirus\LOGFILES\*.*
16+
Bitdefender %ProgramData%\Bitdefender\Endpoint Security\Logs\*.*
17+
ESET C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\*.*
18+
ESET %ProgramData%\ESET\ESET NOD32 Antivirus\Logs\*.*
19+
F-Secure %ProgramData%\F-Secure\Log\*.*
20+
F-Secure C:\users\%USERNAME%\AppData\Local\F-Secure\Log\*.*
21+
F-Secure %ProgramData%\F-Secure\Antivirus\ScheduledScanReports\*.*
22+
HitmanPro %ProgramData%\HitmanPro\Logs\*.*
23+
HitmanPro %ProgramData%\HitmanPro.Alert\Logs\*.*
24+
HitmanPro %ProgramData%\HitmanPro.Alert\excalibur.db
25+
Kaspersky %SOYUZAPPDATA%\Quarantine\*.*
26+
Kaspersky %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Quarantine\*.*
27+
MalwareBytes %ProgramData%\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam-log-*.xml
28+
MalwareBytes %ProgramData%\Malwarebytes\MBAMService\logs\mbamservice.log
29+
MalwareBytes C:\users\%USERNAME%\AppData\Roaming\Malwarebytes\Malwarebytes Anti-Malware\Logs*.*
30+
McAfee C:\Users\All Users\Application Data\McAfee\DesktopProtection\*.*
31+
McAfee %ProgramData%\McAfee\DesktopProtection\*.*
32+
McAfee %ProgramData%\McAfee\Endpoint Security\Logs\*.*
33+
McAfee %ProgramData%\McAfee\Endpoint Security\Logs_Old\*.*
34+
McAfee %ProgramData%\Mcafee\VirusScan\*.*
35+
SentinelOne %ProgramData%\sentinel\logs\*.*
36+
Sophos C:\Documents and Settings\All Users\Application Data\Sophos\Sophos\Logs\*.*
37+
Sophos %ProgramData%\Sophos\Sophos\Logs\*.*
38+
Symantec C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Logs\AV\*.*
39+
Symantec %ProgramData%\Symantec\Symantec Endpoint Protection\Data\Logs\*.*
40+
Symantec C:\users\%USERNAME%\AppData\Local\Symantec\Symantec Endpoint Protection\Logs\*.*
41+
Symantec C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\*.*
42+
Symantec %ProgramData%\Symantec\Symantec Endpoint Protection\Data\Quarantine\*.*
43+
Trend %ProgramData%\Trend Micro\*.*
44+
Trend %ProgramFiles%\Trend Micro\Security Agent\Report\*.log
45+
Trend %ProgramFiles%\Trend Micro\Security Agent\ConnLog\*.log
46+
Trend %ProgramFiles%\Trend Micro\AMSP\report\*.log
47+
VIPRE %ProgramData%\VIPRE Business Agent\Logs\*.*
48+
VIPRE C:\users\%USERNAME%\AppData\Roaming\VIPRE Business\*.*
49+
VIPRE C:\users\%USERNAME%\AppData\Roaming\GFI Software\AntiMalware\Logs\*.*
50+
VIPRE C:\users\%USERNAME%\AppData\Roaming\Sunbelt Software\AntiMalware\Logs\*.*
51+
Webroot %ProgramData%\WRData\WRLog.log

‎Utils/README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Tools Used
2+
3+
Below is a list of files that are used within FLAIR along with URL's where they can be obtained.
4+
5+
To acommodate both x86 and x64 platforms, '64' is added to the x64 versions of the program to ensure that the correct version of the file is used on the target.
6+
7+
| Filename | Origin |
8+
|-----------------|----------------------------------------------------------------------------------------------------|
9+
| autorunsc.exe | <https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns> |
10+
| autorunsc64.exe | |
11+
| handle.exe | <https://docs.microsoft.com/en-us/sysinternals/downloads/handle> |
12+
| handle64.exe | |
13+
| Listdlls.exe | <https://docs.microsoft.com/en-us/sysinternals/downloads/listdlls> |
14+
| Listdlls64.exe | |
15+
| pipelist.exe | <https://docs.microsoft.com/en-us/sysinternals/downloads/pipelist> |
16+
| pipelist64.exe | |
17+
| srvinfo.exe | This tool is from the Microsoft Windows NT/Windows 2000 Resource Kit. This is no longer in print |
18+
| | or supported by Microsoft so please be extremly careful where you obtain a copy of this file. |
19+
| tlist.exe | <https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/tlist> |
20+
| tlist64.exe | |
21+
| LogParser.exe | <https://www.microsoft.com/download/details.aspx?id=24659> |
22+
| | This is an x86 only program, old but it still works for the present. |
23+
| | <https://docs.microsoft.com/en-us/iis/troubleshoot/performance-issues/troubleshooting-iis-performance-issues-or-application-errors-using-logparser> |

‎Utils/diskpart.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
list disk
2+
select disk 0
3+
detail disk
4+
list volume
5+
list vdisk
6+
san
7+
exit
8+

0 commit comments

Comments
 (0)