Skip to content

usage-sample.md

Latest commit

 

History

History
213 lines (167 loc) · 7.9 KB

usage-sample.md

File metadata and controls

213 lines (167 loc) · 7.9 KB
Raw

WinFIRE — Usage Samples (Real-Case Playbook)

Practical, copy-paste command samples for using WinFIRE during a real incident-response engagement on a Windows 10/11 host. Run from an elevated prompt for complete results.

Repository: https://github.com/Masriyan/WinFire/

Authorized use only. WinFIRE collects forensic data from the live host. Use it only on systems you are authorized to investigate.

0. First things first

Launch with auto-elevation (recommended)

WinFIRE.bat self-elevates to Administrator, then runs the orchestrator. Most probes (services, scheduled tasks, raw NTFS, protected-process memory) need admin.

WinFIRE.bat -LiveTriage -CaseNumber INC-2026-001 -Investigator "J. Doe"

Or run the PowerShell orchestrator directly (already-elevated shell)

powershell -NoProfile -ExecutionPolicy Bypass -File .\WinFIRE.ps1 -LiveTriage -CaseNumber INC-2026-001

See what modules exist

.\WinFIRE.ps1 -ListModules

Check / fetch the bundled tools

.\WinFIRE.ps1 -GetTools                 # report present vs missing
.\WinFIRE.ps1 -GetTools -AutoGetTools   # download yara + hayabusa + rawcopy from GitHub
.\tools\Get-Tools.ps1 -Auto             # same, standalone (run on a staging box, carry bin\ on USB)

Eric Zimmerman tools (PECmd / AmcacheParser / AppCompatCacheParser / SrumECmd / MFTECmd) are manual — drop them in bin\EZTools\ (get them from https://ericzimmerman.github.io/).

1. Triage profiles (fastest way to start)

Quick triage — persistence + fileless indicators

-Quick = LiveTriage + YARA over registry + YARA over PowerShell event logs.

WinFIRE.bat -Quick -CaseNumber INC-2026-001 -Investigator "J. Doe"

Full sweep — every module

Runs everything that has its tool present; missing-tool modules degrade gracefully.

WinFIRE.bat -Full -CaseNumber INC-2026-001 -Investigator "J. Doe" -Purpose "Suspected compromise"

2. Scenario-driven commands

A. "This box might be compromised — give me the persistence picture"

Autoruns, services, scheduled tasks, WMI subscriptions, scored for suspicion.

WinFIRE.bat -LiveTriage -CaseNumber INC-2026-001 -Investigator "J. Doe"

B. "Hunt malware on disk with my YARA rules"

Recursive, multithreaded YARA scan of a path (also unpacks .zip archives and scans inside).

WinFIRE.bat -ScanFiles C:\Users -CaseNumber INC-2026-001
WinFIRE.bat -ScanFiles "C:\Users\suspect\Downloads","C:\ProgramData" -CaseNumber INC-2026-001

Use a specific rules folder instead of the bundled rules\yara\:

WinFIRE.bat -ScanFiles C:\ -RulesPath D:\rules\signature-base -CaseNumber INC-2026-001

C. "Look for injected / fileless code in memory"

YARA against running-process memory (needs admin + SeDebugPrivilege for protected processes).

WinFIRE.bat -ScanMemory -CaseNumber INC-2026-001

Behavioral injection/hollowing detection (RWX regions, unbacked executable memory):

WinFIRE.bat -DetectInjection -CaseNumber INC-2026-001

D. "Did they use encoded PowerShell?"

Scan PowerShell Operational (4104/4103) script-block logs with YARA, then auto-deobfuscate Base64/XOR and re-scan the cleartext.

WinFIRE.bat -ScanEventLogs -Deobfuscate -CaseNumber INC-2026-001

E. "Registry-resident / fileless persistence"

YARA over exported Run/Winlogon/Policies keys.

WinFIRE.bat -ScanRegistry -CaseNumber INC-2026-001

F. "Behavioral detections over the event logs (Sigma)"

Runs Hayabusa (Sigma engine) over the EVTX store and maps hits to ATT&CK.

WinFIRE.bat -SigmaScan -CaseNumber INC-2026-001

G. "Program-execution timeline (Prefetch / Amcache / Shimcache / SRUM)"

Requires the EZTools in bin\EZTools\.

WinFIRE.bat -CollectArtifacts -CaseNumber INC-2026-001

H. "I suspect a user-land rootkit hiding files"

Parse the raw MFT (via RawCopy + MFTECmd) and diff it against the Windows API.

WinFIRE.bat -UseRawNtfs -CaseNumber INC-2026-001

I. "Everything, full evidence package, on a malware case"

WinFIRE.bat -Full -CaseNumber INC-2026-001 -Investigator "J. Doe" -Purpose "Ransomware IR" -HashAlgorithm SHA256

J. Combine exactly the surfaces you want

WinFIRE.bat -LiveTriage -ScanFiles C:\Users\suspect -ScanRegistry -ScanEventLogs -SigmaScan -CaseNumber INC-2026-001

3. Common options (mix with any command)

Option Purpose
-CaseNumber <id> Stamped into the report + chain-of-custody record
-Investigator "<name>" Recorded in the report header / custody
-Purpose "<text>" Free-text reason for the collection
-OutputPath <dir> Where the case folder is created (default: current dir)
-RulesPath <dir> Use a different YARA rules folder than rules\yara\
-HashAlgorithm MD5|SHA1|SHA256 Hash algorithm for evidence (default SHA256)
-Quiet Suppress console chatter (errors/warnings still show); report still written 
WinFIRE.bat -Full -OutputPath E:\Evidence -CaseNumber INC-2026-001 -Investigator "J. Doe" -Quiet

4. What you get (output)

Each run creates a timestamped case folder, e.g. WinFIRE_<HOST>_<yyyyMMdd_HHmmss>\, containing:

  • report.html — self-contained report: severity summary, MITRE ATT&CK matrix, and a findings table. Each finding has an expandable evidence block (YARA rule name + surface, PID, registry key, memory address, matched path, etc.).
  • findings.json — machine-readable findings (full evidence) for SOAR / ingestion.
  • raw\ — raw collected artifacts: triage CSV/JSON, exported registry, EVTX string dumps, YARA index, parsed MFT/artifact CSVs, decoded payloads, the Hayabusa timeline, etc.
  • winfire.log — run log.
  • raw\chain_of_custody.json — tool/version, case, investigator, host, start time, modules.

5. Exit codes (useful for automation / SOAR)

Code Meaning
0 No findings at all
1 Highest finding was Info / Low / Medium
2 At least one High / Critical finding 
.\WinFIRE.ps1 -Quick -CaseNumber INC-2026-001
if ($LASTEXITCODE -ge 2) { Write-Host "High/Critical findings — escalate." }

Note: informational findings (e.g. "engine unavailable", benign autoruns) count toward exit 1, so a perfectly clean run that still emits Info notes returns 1, not 0.

6. YARA rules — notes for real packs

  • Drop .yar / .yara files anywhere under rules\yara\ (subfolders are scanned recursively).
  • WinFIRE auto-skips rule files that fail to compile (duplicate rule names, syntax errors, unsupported imports) and logs YARA: excluding non-compiling rule file: ... — one bad file in a large third-party pack will not break the whole scan.
  • The standard external variables used by signature-base / LOKI / THOR rules (filename, filepath, extension, filetype, owner) are defined automatically so those rules compile. Because recursive scanning can't set them per file, rules that condition on filename/path/extension may under-match on the file surface; pure content rules match fully.
  • Save rules as ASCII or UTF-8 without BOM (a BOM makes yara reject the file).

7. Offline / air-gapped targets

  1. On an internet-connected staging machine: \.tools\Get-Tools.ps1 -Auto (and manually add EZTools to bin\EZTools\).
  2. Copy the whole WinFIRE folder (with a populated bin\ and your rules\yara\) to USB.
  3. On the target: WinFIRE.bat -Full -CaseNumber <id> — no network calls are made unless you pass -AutoGetTools.

8. Tip: run elevated, write evidence off-host

WinFIRE.bat -Full -OutputPath \\evidence-share\cases -CaseNumber INC-2026-001 -Investigator "J. Doe"

Running via WinFIRE.bat keeps the working directory in the WinFIRE folder during elevation, so relative paths and the default output location behave as expected.