An Ontology for Digital Forensics in IT Security Incidents - OPUS

8.3. CASE 1 67
SELECT DISTINCT ? pid ? name ? conn ? local ? remote
WHERE {
{? pid for : hasForensicTool base : volatility_connscan . }
UNION
{? pid for : hasForensicTool base : volatility_connections . }
? pid rdf : type pro : Process .
? pid pro : Name [ rdf : value ? name ] .
? pid pro : hasConnection ? conn .
? conn pro : Local_Address [ rdf : value ? local ] .
? conn pro : Remote_Address [ rdf : value ? remote ] .
}
Listing 8.1: Processes with connections
SELECT DISTINCT ? pid ? name ? resource ? filename
WHERE
{
? pid rdf : type pro : Process .
? pid pro : Name [ rdf : value ? name ] .
FILTER ( regex ( str (? name ), " PROCESSNAME ", "i "))
? pid pro : hasResource ? resource .
OPTIONAL { ? resource fsfn : name ? filename . }
}
Listing 8.2: Resources of a process
8.3 Case 1
The Autorun query from section 8.2.2 returns key: "mydnswatch.exe"
value:"C:\mydnswatch\mydnswatch.exe" besides the normal values. A
lookup on the internet for mydnswatch.exe proves that malware was running
on the computer. The rst query from section 8.2.3 shows that the processes
explorer.exe and winlogon.exe have connections. Both of them should
not have any connection. All addresses the both processes are connected to
do not look familiar and a search on the internet shows that they belong to
malware related servers.
8.4 Case 2
The Autorun query from section 8.2.2 returns key: "CTEMON.EXE" value:
""C:\Dokumente und Einstellungen\All Users\Application Data\winlogon
.exe" /h" besides the normal values. The rst thing that confuses is that