DARKSURGEON - Windows packer project to empower IR, Forensics, Malware Analysis, and Network Defense

DARKSURGEON is a Windows packer project to empower incident response, digital forensics, malware analysis, and network defense.

DARKSURGEON has three stated goals:

• Accelerate incident response, digital forensics, malware analysis, and network defense with a preconfigured Windows 10 environment complete with tools, scripts, and utilities. 
• Provide a framework for defenders to customize and deploy their own programmatically-built Windows images using Packer and Vagrant.
• Reduce the amount of latent telemetry collection, minimize error reporting, and provide reasonable privacy and hardening standards for Windows 10.

If you haven't worked with packer before, this project has a simple premise:

Provide all the tools you need to have a productive, secure, and private Windows virtual machine so you can spend less time tweaking your environment and more time fighting bad guys.

Please note this is an alpha project and it will be subject to continual development, updates, and package breakage.

Development Principles

DARKSURGEON is based on a few key development principles:

• Modularity is key. Each component of the installation and configuration process should be modular. This allows for individuals to tailor their packer image in the most flexible way.
• Builds must be atomic. A packer build should either complete all configuration and installation tasks without errors, or it should fail. A packer image with missing tools is a failure scenario.
• Hardened out of the box. To the extent that it will not interfere with investigative workflows, all settings related to proactive hardening and security controls should be enabled. Further information on DARKSURGEON security can be found later in this post. 
• Instrumented out of the box. To the extent that it will not interfere with investigative workflows, Microsoft Sysmon, Windows Event Logging, and osquery will provide detailed telemetry on host behavior without further configuration.
• Private out of the box. To the extent that it will not interfere with investigative workflows, all settings related to privacy, Windows telemetry, and error reporting should minimize collection.

Hardening

DARKSURGEON is hardened out of the box, and comes with scripts to enable High or Low security modes.

All default installations of DARKSURGEON have the following security features enabled:

• Windows Secure Boot is Enabled.
• Windows Event Log Auditing is Enabled. (Palantir Windows Event Forwarding Guidance)
• Windows Powershell Auditing is Enabled. (Palantir Windows Event Forwarding Guidance)
• Windows 10 Privacy and Telemetry are Reduced to Minimal Settings. (Microsoft Guidance)
• Sysinternals Sysmon is Installed and Configured. (SwiftonSecurity Public Ruleset)
• LLMNR is Disabled.
• NBT is Disabled.
• WPAD is Removed.
• Powershell v2 is Removed.
• SMB v1 is Removed.
• Application handlers for commonly-abused file extensions are changed to notepad.exe.

Additionally, the user may specify a Low or High security mode by using the appropriate scripts. The default setting is to build an image in Low Security mode.

Github Project