An Ontology for Digital Forensics in IT Security Incidents - OPUS

66 CHAPTER 8. EVALUATION
6. The last step, was to query the database for evidence. This step is
described in sections 8.3, 8.4, 8.5 and 8.6. For these sections it is
assumed that it is not known what kind of malware was run. The
approach is to run selected queries to get an overview and then examine
more in detail.
8.2 SPARQL Queries
This section shows the queries that are used to nd traces of malware. Some
of them are already explained in detail in chapter 7.
8.2.1 Find le
A query to nd les as shown in listing 7.4 is explained in section 7.6.1.
FILENAME has to be replaced by the string to search for. The result contains
all les that have the given string in their path.
8.2.2 Autorun
The query shown in listing 7.6 is explained in section 7.6.2. It lists all
key-value pairs of the values of the Windows/CurrentVersion/Run registry
subtrees. These subtrees contain the programs that are started with the
operating system.
8.2.3 Network
Another sign for malware may be the network connections. The query from
listing 8.1 can be used to nd all processes that have TCP connections. This
returns the processes and what they are connected to.
Replace the two tools in the hasForensicTool lines by their socket equivalent
(see 4.3.2) to search for all network protocols.
8.2.4 Parent Process
The query explained in section 7.6.3 and shown in listing 7.7 lists all processes
that do not have a normal line of ancestors.
8.2.5 Resources
A useful piece of evidence is which resources a process uses. To obtain
this information the query from listing 8.2 can be used. The query binds
the process to the variable ?pid and lters the name matching the regular
expression PROCESSNAME. If the resource is a le, the OPTIONAL block binds
the name of the le to the variable ?filename.