In today's brave new world, where incidents have a way of rapidly ballooning out of control without a rapid and effective response, it is integral that DFIR professionals are able to query hosts for relevant information, such as the processes and services running on the system, to make informed investigative decisions to quickly contain the incident. While we can often collect this information on a forensic image of a machine, some of this information is volatile or it may be necessary to collect quickly rather than waiting for a forensic image to be created.
In this chapter, we develop a single script that is compatible with modern operating systems and, using various first- and third-party libraries, extract useful information about the system that the script is running on. With some modification, this script could be leveraged in an environment...