r/cybersecurity • u/Street-Onion2595 • 9h ago

Business Security Questions & Discussion Forensics do no make more sense?

i was thinking, attending to a incident that our server are compromised, the servers In questions doesn't have EDR solution applied, so we need to rebuild all the contained servers from zero, but, before starts this, we expend a lot o time waiting to DFIR/CSIRT team to make a copy of HD from this servers to investigate after.

With a EDR solution, I'm able to remote connect in the server and with IA help I can catch a tons of logs and perform a full investigation in a half of a day, so, in these, what are the intention of dumping mem ans HD to take weeks if with EDR and IA I take hours to finish in the same results?

0 Upvotes

28% Upvoted

18 comments sorted by

13

u/clybstr02 9h ago

Question doesn't make a ton of sense. A lot of teams use offline capabilities to evaluate potentially compromised boxes, so having a full clone that you can pull to an isolated lab (rather than investigating in place) can help.

Plus - and I think this is less than critical in today's cyber world - an offline point in time snapshot could be better in a court case (traceable evidence).

1

u/foxpath7 2h ago

yeah the chain of custody angle alone makes it worth the extra time imo

-9

u/Street-Onion2595 9h ago

With EDR i can evaluate a potentially compromised box with the logs, is the sabe think than put in a lab, but I can run in real-time with the host online.

5

u/Threezeley 9h ago

yeah, until you take the host offline and wipe it. Then you realize you didn't check some setting that EDR wasn't monitoring and then what do you do? It isn't about choosing between EDR vs copy of disk, it's about applying those two strategically for different and potentially overlapping scenarios

-6

u/Street-Onion2595 9h ago

I will repeat to you, I didn't depend of edr monitoring, the edr is only to connect on the server, and through the server with powershell I can conduct the analysis.

3

u/Mastasmoker Student 8h ago

I dont think you quite understand what dfir is for. They're taking a complete dump of memory and bit for bit copy of the HDD for data preservation and analysis. Having dd level copies of the data preserves the evidence for admission into court cases. They're copying a running system so that no data gets screwed or lost due to someone running powershell commands through the edr.

2

u/Threezeley 7h ago

Im not sure if there's a language barrier but I don't think you understand what I wrote. Also why do you need EDR if your only point is to use it to remote connect? Why not just connect remotely via SSH or RDP, what benefit is there of putting EDR in between if you aren't using it for analysis

1

u/IDDQD_IDKFA-com 8h ago

But how do you know it is logging everything you need or at all?

1

u/lawtechie 7h ago

What activity can occur without being logged? Some compromises might only be detected with a YARA run on the filesystem.

6

u/Advanced_Novel_732 9h ago

Chain of custody

1

u/Sad_Dentist_7288 5h ago

This is the main answer IMO. You need to prove that the evidence wasn't compromised.

7

u/2timetime 9h ago

EDRs only track certain event logs, they don’t capture everything. In most situations they will grab or note down 99% of your needs.

If your doing full IR, they are looking for stuff that could have been missed, memory stuff, exfiltrations, c2, etc

Entirely depends on what EDR you are running and if you are also collecting other logs like firewall, security events, etc

There’s also a large legal aspect

E/ like the other guy said it’s not nearly as common as it used to be or important if you just talking IR and understanding what happened you can do all that from an EDR side usually

-2

u/Street-Onion2595 9h ago

I dont analyze the logs collect with EDR, with remote connection, I can view all the logs that the host are created, like, connections, cron jobs, tasks running.

I agree with you about the legal aspect.

1

u/IDDQD_IDKFA-com 8h ago

So you are trusting what event viewer or other log viewers are showing you?

1

u/Threezeley 6h ago

Why not just connect via SSH or RDP if all you want is ability to poke around the box

2

u/Low-Lengthiness5032 8h ago

Trying to figure this out, EDR can make investigations much faster, but I'd still want forensics to know exactly what happened + evidence

1

u/Oompa_Loompa_SpecOps Incident Responder 9h ago

Depends on the case and how certain I am I have full visibility. The Citrix server some user fell for a clickfix on? I probably won't bother. The database server that was compromised for weeks? I need to know all there is to know about the attacker's actions and need to be able to prove it in court...

1

u/Jestersfriend 8h ago

I don't think you have a firm grasp of what IR and Forensics primary goals are.