[Pauldotcom] Meterpreter as an Incident Response Tool

[Butturini, Russell]

Hi all,

I wanted to see what the group's feelings are on using Meterpreter in
incident response.  Recently I had the opportunity to view a particular
enterprise network forensics and incident response package.  Most of the
functionality it brought to the table could be accomplished with a
Meterpreter shell, launched using the psexec module included with
Metasploit.  However, I would be concerned about this damaging the
integrity of the environment from a forensics standpoint.  Any thoughts?

 

Russell

 


******************************************************************************
This email contains confidential and proprietary information and is not to be used or disclosed to anyone other than the named recipient of this email, 
and is to be used only for the intended purpose of this communication.
******************************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20091215/fe08e12d/attachment.htm