TR3Secure is a set of batch scripts used to capture volatile and log information from a target system. This repository is a fork of the excellent Tr3Secure project written by Corey Harrell @corey_harrell and located here http://code.google.com/p/jiir-resources/
I wanted to manage and maintain a copy of Tr3Secure that could be tailored to how my response team wants to triage and handle malware detections for systems.
- Open a command prompt with admin rights
- Change directories to where the scripts are located
- Execute one of the commands below:
tr3-collect.bat [case number] [drive letter for storing collected data] [menu selection #]
or
tr3-collect-user.bat [path to store collected data] [user profile name]
note
the executables' names in the tools folder has to match the names of the executables listed below. If they don't match then the script won't work properly
- Nothing needs to be done for the programs located in the system32 folder. The batch script uses the executables on the target system.
- The remaining programs need to be placed into a sub-folder named tools
- Customize the antivirus log collection for your environment. For demo purposes the script collects McAfee logs and quarantine folder
- Change the file extension on the batch script from txt to bat
mkdir.exe: Included in UnxUtils package and located at http://unxutils.sourceforge.net/
robocopy.exe: Included in the Windows 2003 resource tool kit and located at http://www.microsoft.com/download/en/details.aspx?id=17657
whoami: Included in Windows OS on Windows 7
at.exe Included in Windows OS on Windows 7
schtasks.exe Included in Windows OS on Windows 7
driverquery.exe Included in Windows OS on Windows 7
rawcopy.exe http://code.google.com/p/mft2csv/downloads/list (ensure you have both RawCopy64.exe and RawCopy.exe)
winpmem acquisition tool Located at http://code.google.com/p/volatility/downloads/list *rename binary to winpmem.exe*
arp.exe: Located in Windows\System32 folder
ipconfig.exe: Located in Windows\System32 folder
nbtstat.exe: Located in Windows\System32 folder
net.exe: Located in Windows\System32 folder
netstat.exe: Located in Windows\System32 folder
pslist.exe: Included in Sysinternals PSTools and located at http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx
CProcess.exe : Located at http://www.nirsoft.net/utils/cprocess.html
handle.exe: Located at http://technet.microsoft.com/en-us/sysinternals/bb896655
listdlls.exe: Located at http://technet.microsoft.com/en-us/sysinternals/bb896656
openports.exe: Located at http://majorgeeks.com/OpenPorts_d3950.html
pslist.exe: Included in Sysinternals PSTools and located at http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx
tasklist.exe: Located in Windows\System32 folder
tcpvcon.exe: Located at http://technet.microsoft.com/en-us/sysinternals/bb897437
psloggedon.exe: Included in Sysinternals PSTools and located at http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx
net.exe: Located in Windows\System32 folder
logonsessions.exe: Located at http://technet.microsoft.com/en-us/sysinternals/bb896769
openedfilesview.exe: Located at http://www.nirsoft.net/utils/opened_files_view.html
psfile.exe: Included in Sysinternals PSTools and located at http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx
pclip.exe: Included in UnxUtils package and located at http://unxutils.sourceforge.net/
ver.exe: Included in Windows OS
uptime.exe: Located at http://support.microsoft.com/kb/232243
ipconfig.exe: Located in Windows\System32 folder
urlprotocolview.exe: Located at http://www.nirsoft.net/utils/url_protocol_view.html
promiscdetect.exe: Located at http://ntsecurity.nu/toolbox/promiscdetect/
autorunsc.exe: Located at http://technet.microsoft.com/en-us/sysinternals/bb963902
gplist.exe: Located at http://ntsecurity.nu/toolbox/gplist/
gpresult.exe: Included in Windows OS
dd.exe Included in UnxUtils package and located at http://unxutils.sourceforge.net/
mmls.exe (also copy zlib1.dll and libewf.dll along with mmls.exe into the tools folder) Located at http://www.sleuthkit.org/sleuthkit/download.php
whoami: Included in Windows OS on Windows 7
These tools should be placed in the scan/ directory under the scripts
tdsskiller.exe: Located at http://media.kaspersky.com/utilities/VirusUtilities/EN/tdsskiller.exe
stinger32.exe: Located at http://www.mcafee.com/us/downloads/free-tools/stinger.aspx
stinger64.exe: Located at http://www.mcafee.com/us/downloads/free-tools/stinger.aspx
Claimwin Portable: *Extract this to a folder called 'ClamWin' under teh scan directory* Located at http://portableapps.com/apps/utilities/clamwin_portable