What can you do with FIRP (Firt Incident Response Powershell)?

Security Logs

Analyze Security Logs for brute force attempts, time-frame -> Get-BruteForce
Analyze Security failed logons and successess, time-frame -> Get-FailedAndSuccessLogons
Analyze Security suspicious IP connections to the machine, time-frame -> Get-LogonInfo
Analyze Security scheduled tasks, time-frame -> Get-ScheduledTaskEventLogs4698
Analyze Security failed RDP sessions, time-frame -> Get-FailedRDP
Analyze Security failed network logons -> Get-FailedNetworkLogons
Analyze Security success network logons -> Get-SuccessNetworkLogons
Analyze Security Pass The Hash Attack -> Get-PassTheHash
Analyze Security Windows Services -> Get-Services
Analyze Security Local Account Created -> Get-LocalAccountCreated
Analyze Security Local Account Added to Administrator Group -> Get-LocalAccountAddedToAdmin
Analyze Security Local Account Password changed -> Get-LocalAccountPwdChanged
Analyze Security Local Account Disabled -> Get-LocalAccountDisabled
Analyze Security Local Account Lockout -> Get-LocalAccountLockout
Analyze Security Local Account Changed -> Get-LocalAccountChanged
Analyze Security Local Account Enabled -> Get-LocalAccountEnabled
Analyze Security User Added or Removed from Security Group -> Get-UserAddedGlobalGroup

Windows Defender Logs

Analyze Win Defender logs for malware -> Get-DetectedMalware
Analyze Win Defender logs for Real Time disabled -> Get-DefenderAVRealTimeDisabled
Analyze Win Defender logs, antimalware configuration changed.-> Get-DefenderAVChanged
Analyze Win Defender logs, antimalware engine found malware -> Get-DefenderAntimalware

Powershell Logs

Analyze PowerShell logs using keywords, time-frame -> Get-PowerShellLog
Analyze PowerShell base64 scripts used, time-frame -> Get-PowerShellLogb64
Analyze PowerShell malicious keywords as a database (keywords.txt) -> Get-PowerShellMaldev

Sysmon Logs

Analyze Sysmon Processes using suspicious paths -> Get-SysmonProcess
Analyze Sysmon Network Activity -> Get-SysmonNetwork
Analyze Sysmon Zone Identifier files -> Get-SysmonFileStreamCreate
Analyze Sysmon Process Injection activity -> Get-SysmonCreateRemoteThread
Analyze Sysmon File Creation -> Get-SysmonFileCreate
Analyze Sysmon Process Termination -> Get-SysmonProcessTerminate
Analyze Sysmon Registry key and value create and delete operations -> Get-SysmonRegAddDelete
Analyze Sysmon value rename operations -> Get-SysmonRegRename
Analyze Sysmon Registry event records DWORD and QWORD -> Get-SysmonReg
Analyze Sysmon DNS query -> Get-SysmonDNS
Analyze Sysmon Pipe Created -> Get-SysmonPipe
Analyze Sysmon Pipe Connected -> Get-SysmonPipeConnected
Analyze Sysmon WMI filters -> Get-SysmonWMIFilter
Analyze Sysmon WMI Consumers -> Get-SysmonWMIConsumer
Analyze Sysmon WMI binding -> Get-SysmonWMIBinding
Analyze Sysmon Drivers -> Get-SysmonDriver

Windows Forensic

Analyze Prefetch file -> Get-PrefetchFiles

FIRP (Firt Incident Response PowerShell) is a PowerShell-based framework designed to help with incident response activities. The framework is capable of analyzing a variety of security logs and incident response artifacts, including PowerShell and Sysmon logs, as well as Windows event logs, and hope in future to extend to memory.
FIRP provides a comprehensive set of PowerShell cmdlets that can be used to automate the analysis of these artifacts. The framework can be used to quickly identify and investigate suspicious activities on a system, including malware infections, network intrusions, and other security incidents.

Overall, this framework can be used to automate many of the incident response tasks, making the process faster and more efficient. However, it's important to note that this is just a high-level overview and the actual implementation of such a framework may involve many more steps and considerations depending on the specific requirements of the organization.

How to use it

Open PowerShell with administrative privileges. Import-Module -Force .\firp.ps1

Functions

Get-bruteforce -> Get-bruteforce -StartTime '2023-02-10T12:00:00' -EndTime '2023-02-15T21:58:00'

Get-DetectedMalware -> Get-DetectedMalware -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-DefenderAVRealTimeDisabled -> Get-DefenderAVRealTimeDisabled -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-DefenderAVChange -> Get-DefenderAVChanged -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-DefenderAntimalware -> Get-DefenderAntimalware -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-FailedAndSuccessLogons -> Get-FailedAndSuccessLogons -StartTime '2023-02-12 00:00:00' -EndTime '2023-02-13 23:24:00' > failed.txt

Get-PassTheHash -> Get-PassTheHash -StartTime '2023-01-01T08:06:00' -EndTime '2023-02-19T23:57:00'

Get-ScheduledTaskEventLogs4698 -> Get-ScheduledTaskEventLogs4698 -StartTime '2021-02-14 00:00:00' -EndTime '2023-02-17 23:59:59'

Get-FailedRDP -> Get-FailedRDP -StartTime '2023-02-12 00:00:00' -EndTime '2023-02-13 23:24:00'

Get-FailedNetworkLogons -> Get-FailedNetworkLogons -StartTime '2023-02-12 00:00:00' -EndTime '2023-02-13 23:24:00'

Get-SuccessNetworkLogons -> Get-SuccessNetworkLogons -StartTime '2023-02-12 00:00:00' -EndTime '2023-02-19 23:54:00'

Get-LocalAccountDisabled -> Get-LocalAccountDisabled -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-LocalAccountLockout -> Get-LocalAccountLockout -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-LocalAccountChanged -> Get-LocalAccountChanged -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-Get-LocalAccountEnabled -> Get-Get-LocalAccountEnabled -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-LogonInfo -> Get-LogonInfo -StartTime "2023-02-15T00:00:00" -EndTime "2023-02-16T00:00:00"

Get-LocalAccountCreated -> Get-LocalAccountCreated -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-LocalAccountAddedToAdmin -> Get-LocalAccountAddedToAdmin -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-LocalAccountPwdChanged -> Get-LocalAccountPwdChanged -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Get-PowerShellLog -> Get-PowerShellLog -Keywords "Invoke-WebRequest" -StartTime '2023-02-10T12:00:00' -EndTime '2023-02-15T21:58:00'

Get-PowerShellLogb64 -> Get-PowerShellLogb64 -StartTime '2023-02-10T12:00:00' -EndTime '2023-02-15T21:58:00'

Get-PowerShellMaldev -> Get-PowerShellMaldev -StartTime '2023-02-10T12:00:00' -EndTime '2023-02-15T21:58:00'

Get-SysmonProcess -> Get-SysmonProcess -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonNetwork -> Get-SysmonNetwork -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonFileStreamCreate -> Get-SysmonFileStreamCreate -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonCreateRemoteThread -> Get-SysmonCreateRemoteThread -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonFileCreate -> Get-SysmonFileCreate -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonProcessTerminate -> Get-SysmonProcessTerminate -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonRegAddDelete -> Get-SysmonRegAddDelete -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonReg -> Get-SysmonReg -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonRegRename -> Get-SysmonRegRename -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonDNS -> Get-SysmonDNS -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonPipe -> Get-SysmonPipe -StartTime '2023-02-19T15:06:00' -EndTime '2023-02-19T17:57:00'

Get-SysmonPipeConnected -> Get-SysmonPipeConnected -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonWMIFilter -> Get-SysmonWMIFilter -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonWMIConsumer -> Get-SysmonWMIConsumer -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonWMIBinding -> Get-SysmonWMIBinding -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-SysmonDriver -> Get-SysmonDriver -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

Get-Services -> Get-Services -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-19T11:57:00'

**Get-PrefetchFiles -FolderPath 'C:\Windows\Prefetch' -StartTime '2023-02-18T08:06:00' -EndTime '2023-02-20T11:57:00'

Overall, this PowerShell framework can be used to automate many incident response tasks, making the process faster and more efficient. It's important to note that this is just a high-level overview, and the actual implementation of such a framework may involve many more steps and considerations depending on the specific requirements of the organization.

bashrootshell/FIRP