DARKSURGEON is a Windows packer project to empower incident response, digital forensics, malware analysis, and network defense.
DARKSURGEON has three stated goals:
Accelerate incident response, digital forensics, malware analysis, and network defense with a pre-configured Windows 10 environment complete with tools, scripts, and utilities.
Provide a framework for defenders to customize and deploy their own programmatically-built Windows images using Packer and Vagrant.
Reduce the amount of latent telemetry collection, minimize error reporting, and provide reasonable privacy and hardening standards for Windows 10.
If you haven't worked with packer before, this project has a simple premise:
Provide all the tools you need to have a productive, secure, and private Windows virtual machine so you can spend less time tweaking your environment and more time fighting bad guys.
Please note this is an alpha project, and it will be subject to continual development, updates, and package breakage.
DARKSURGEON is based on a few key development principles:
Modularity is key. Each component of the installation and configuration process should be modular. This allows individuals to tailor their packer image in the most flexible way.
Builds must be atomic. A packer build should either complete all configuration and installation tasks without errors or it should fail. A packer image with missing tools is a failure scenario.
Hardened out of the box. To the extent that it will not interfere with investigative workflows, all settings related to proactive hardening and security controls should be enabled. Further information on DARKSURGEON security can be found later in this post.
Instrumented out of the box. To the extent that it will not interfere with investigative workflows, Microsoft Sysmon, Windows Event Logging, and osquery will provide detailed telemetry on host behavior without further configuration.
Private out of the box. To the extent that it will not interfere with investigative workflows, all settings related to privacy, Windows telemetry, and error reporting should minimize collection.
DARKSURGEON is hardened out of the box and comes with scripts to enable High or Low-security modes.
All default installations of DARKSURGEON have the following security features enabled:
Windows Secure Boot is Enabled.
Windows Event Log Auditing is Enabled. (Palantir Windows Event Forwarding Guidance)
Windows Powershell Auditing is Enabled. (Palantir Windows Event Forwarding Guidance)
Windows 10 Privacy and Telemetry are Reduced to Minimal Settings. (Microsoft Guidance)
Sysinternals Sysmon is Installed and Configured. (SwiftonSecurity Public Ruleset)
LLMNR is Disabled.
NBT is Disabled.
WPAD is Removed.
Powershell v2 is Removed.
SMB v1 is Removed.
Application handlers for commonly-abused file extensions are changed to notepad.exe.
The user may specify a Low or High-security mode by using the appropriate scripts. The default setting is to build an image in Low-Security mode.
Low-Security mode is primarily used for virtual machines intended for reverse engineering, malware analysis, or systems that cannot support VBS security controls.
In Low-Security mode, the following hardening features are configured:
Windows Defender Anti-Virus Real-Time Scanning is Disabled.
Windows Defender SmartScreen is Disabled.
Windows Defender Credential Guard is Disabled.
Windows Defender Exploit Guard is Disabled.
Windows Defender Exploit Guard Attack Surface Reduction (ASR) is Disabled.
Windows Defender Application Guard is Disabled.
Windows Defender Application Guard does not enforce isolation.
Note: High-Security mode is still in development.
High-Security mode is primarily used for production deployment of sensitive systems (e.g., Privileged Access Workstations) and may require additional tailoring or configuration.
In High-Security mode, the following hardening features are configured:
Windows Defender Anti-Virus Real-Time Scanning is Enabled.
Windows Defender SmartScreen is Enabled and applied to All Traffic.
Windows Defender Credential Guard is Enabled.
Windows Defender Exploit Guard is Enabled.
Windows Defender Exploit Guard Attack Surface Reduction (ASR) is Enabled.
Windows Defender Application Guard is Enabled.
Windows Defender Application Guard enforces isolation.
Whether analyzing unknown binaries or working on sensitive projects, endpoint telemetry powers detection and response operations. DARKSURGEON comes pre-configured with the following telemetry sources available for analysis:
Windows Event Log Auditing is enabled. (Palantir Windows Event Forwarding Guidance).
Windows Powershell Auditing is enabled. (Palantir Windows Event Forwarding Guidance).
Sysinternals Sysmon is installed and configured. (SwiftonSecurity Ruleset)
Your operational environment contains some of the most sensitive data from your network, and it's important to safeguard that from prying eyes. DARKSURGEON implements the following strategies to maximize privacy without hindering workflows:
Windows 10 telemetry settings are configured to minimize collection.
Cortana, diagnostics, tracking, and other services are disabled.
Windows Error Reporting (WER) is disabled.
Windows Timeline, shared clipboard, device hand-off, and other synchronize-by-default applications are disabled or neutered.
Microsoft Guidance for reducing telemetry and data collection has been implemented.
Out of the box, DARKSURGEON comes equipped with tools, scripts, and binaries to make your life as a defender easier.
Tools, scripts, and binaries focused on android analysis and reverse engineering.
Tools, scripts, and binaries focused on blue team, network defense, and alerting/detection development.
Bloodhound / Sharphound
EndGame Red Team Automation (RTA)
LOLBAS (Living Off the Land Binaries And Scripts)
Practical Malware Analysis Labs (FLARE)
Tools, scripts, and binaries for debugging binary artifacts.
Tools, scripts, and binaries for disassembling binary artifacts.
IDA Free Trial (FLARE)
Binary Ninja Demo (FLARE)
Document Analysis: Tools, scripts, and binaries for performing analysis of documents.
Tools, scripts, and binaries for performing analysis of DotNet artifacts.
Tools, scripts, and binaries for performing analysis of flash artifacts.
Tools, scripts, and binaries for performing forensic analysis on application and operating system artifacts.