The install places Invoke-LiveResponse into the running users profile.

On a Powershell 4+ collector machine, assuming you trust me, run the following proxy aware powershell commands to download then install.

SMB Network share with write access (for file collections).

WinRM setup with Kerberos and/or Negotiation authentication.

Powerforensics installed in running user Powershell Modules path (I have included automatic installation below).

Powershell 2.0 or above target machine/s.

Powershell 4.0 or above collector machine (3 should also be functional).

During use, I have tweaked some performance and learnt a lot in implementation about both Powershell and Powerforensics. Invoke-LiveResponse is the result of converting some scripts for raw collection with redirected acquisition and live response into an easy to use tool. Powerforensics enables the capability for remote raw disk analysis using Assembly.Load Method. The same techniques can be used by the Blue Team and quite a few practitioners are starting to use this feature for things like memory and volatile data forensics. That means security tools can be loaded from a Powershell script, in some cases never touching disk. In offensive security, one of the biggest enablers in Powershell is the capability to reflectively load PE files, shellcode and assembly into memory. Powerforensics can also be used for similar tasks over Powershell remoting. Typical use case is local analysis from a traditional collection enabling the analyst to perform detailed disk forensics similar to the more well known Sleuth Kit. PowerForensics is a disk forensic framework for Powershell written in C# by Jared Atkinson. Some of the difficulties in accessing these artefacts include lack of endpoint visibility or capabilities for ad-lib collection, from either a technical or business limitation. The ability to collect these data points quickly, enables informed decisions and reduces risk of loss from an incident.

Rouge processes, code injection, suspicious network activity or other disk and memory artefacts are some of data points an analyst may look for signs of evil. The ability to collect live response data from a remote system is a fundamental requirement for modern incident response. The goal of this project was to promote Powershell as a blue team tool and improve my Powershell knowledge with research. The module uses Powerforensics over WinRM, and after some interest, I think is worth sharing. The initial use case was considered after an endpoint vendor appliance failed and capability for raw collections was limited. Implementation for live response and file collections over Powershell remoting.

In this post, I am going to talk about a Powershell module I have authored as a simple

Powershell scripts for forensics