Skip to main content

VOLATILE_INFO

note

Any Netstat collections on Windows DNS servers may significantly increase the job collection time due to dns.exe listening to almost all open ephemeral UDP ports (MS08-037)

This job template is designed to retrieve dynamic information from a system that can change rapidly in relation to other artifacts. This collection is more-so suited for baselining across multiple systems or searching through data for quick and easy-to-find IOCs.

Job Metadata
NameVOLATILE_INFO-TEMPLATE
Plugin Selection
📷 CollectorsCustom Plugins:
  • 262 - [🔥Volatile Info] ARP Cache (Win/Linux)
  • 262 - [🔥Volatile Info] DNS Cache (Win)
  • 262 - [🔥Volatile Info] Environment Variables (Win/Linux)
  • 262 - [🔥Volatile Info] Injected Threads (Win)
  • 262 - [🔥Volatile Info] Logged-on Users (Win/Linux)
  • 262 - [🔥Volatile Info] Netstat (Win/Linux)
  • 262 - [🔥Volatile Info] Processes (Win/Linux)
  • 262 - [🔥Volatile Info] Route Table (Win/Linux)
Built-in Plugins:
  • Arp Cache Collector
  • DHCP Collector
  • DNSCache Collector
  • Mutex Collector
  • Netstat Collector
  • Null Session Pipes Collector
  • RAIR Collector
  • Active Sessions Collector
  • Survey Collector
⛙ Transports
  • WMI Transport (if Windows targets + credentials available)
  • SMB Transport (if Windows targets + credentials available)
  • SSH Transport (if *Nix targets + credentials available)
🔍 Analyzers
  • Elasticsearch Analyzer