Mac4n6どうしてる？ (公開用)

Mac4n6の情報源やツールなどについてのLT
(2019/8/13のDFIR LT大会発表資料の公開用Ver.)

Transcript

1. 
   
   
2. 
   
   
3. 
   3 . . . / /- 6444
4. 
   1 / 5 5 1 / / / . - 1 / / . / 8:8
5. 
   
   
6. 
   -
7. ) M X
        • W U 6 d ) i • 6 c a • ) ( I N 4
8. • 2 FH :NLMY • 43= :12 • 1B8= • FHo x w FH)S ndhks FH )S t r f 6 4 • FWFM 4I FWIX 0NFR Y NS b MYY X. #RFH)S #H R • C L XM MFYWN 0 NKY5 W SXNHX bMYY X. #X NKYK W SXNHX#H R • FH)S FHFIRNSX bMYY X. LNYMZG#H R XYNW FW RFH)S • =G O HYN X b MYY X. GO HYN X #H R NSI #MYR • 2 FH GFL G L b MYY X. #G FH GFLY HM#H R NSI # M G L • SYNS =S b MYY X. #X SYNS S #H R G L • 5 HZX XY RX b MYY X. H G WK W SXNH#K HZX X#H R S IL FWYNH XEI YFN epgliqjm cgn FH)S ova w uy _ MYY X. I HX#L L #H R X W FIXM YX I B 7Z 4 YI O (=@A86 IV = 3K 7:=AE6 6 B- INY LNI/ ( )
9. - 4 ( / B • 4 C CC B) :C D3 4 C : 41 C • 4 : C CC B) :C D3 4 3 B 4B 41: C • T opn m e h f g bS d i YM • h bfh_ kac l d iY M CC B) :C D3 4 06 B 4 64C CC B) :C D3 4 .C : 6 DC 4C4 CC B) :C D3 4 4C6CB C6B : 3 3 BC6 : 64C B
10. ( A 6 • 6 4 • ) • ( • ( B EC 6 4 6
11. 663 C ) & (4 )6 P T I T 644 C 663 C&    
     ) D I F M   
12. 0 c 0 C B C - &R B 0 d BB C B nF CAL C C C F y 1F w .F A F B E rd h m d d r 036 F C F C AL C A , op d gi ty bae w c- &n g f ik n A F , BB C F B A B C yO F F EO ‒ f l op d dg T p B A up s i C E d• T E C M EA EA stx n T BB C Ul 64 d T 0 (C)aS kP d u
13. 0 c 0 C B C - &R B 0 d BB C B nF CAL C C C F y 1F w B E rd h m d d r 036 F C F C AL C A , op d gi ty bae w c- &n g f ik A F   (*    , BB C F
    %!)" '&#
     $ 0 (C)aS kP d u n .F A F B A B C yO F F EO ‒ f l op d dg T p B A up s i C E d• T E C M EA EA stx n T BB C Ul 64 d T
14. 6 a C B M AC B , & A M 6 b CAA6B A lE CB BC BCC B E o w M 0E ‒ uP -E 4CC F 16EF M A6 6 Ppb f k b b Pp ) CE B CE 6B6 F BC M mn b h eg rw h c‒ uP a, &l e d gi l • ‒ 4CC F 16EF • CAA6B 16EF • P 6 B( R iO M A F A B ytw ) E EC P d mn b be S nxP M A sn P FB6 F C Fb S M C B L6 C F F r l S M .C CAA6B T b U S
15. , 0 P a n ws , 0 , D cn ws E 1 4 E 16 68 1 4udg rfn ceo p E 3 1 4c 1 8D 2 20 2 h s E F h srf s _)6 0 F 0 a rfn c P M c h s cy y _ E 682 8 rfn iwl c n gt (x m , 0 F F v kc •P
16. 4 8 c P hy tnc 6 ), U ( O dR C 8 6 3 R U , 6 34 vl g l pmn •O aMreg ) 8 Rreg R y nfmt 8 c ( 8 S P hytn U go & ( 8 s ic P
17. () ) ( 6 4