Int 9: Super Timeline (Plaso) - Membuat Timeline Forensik Terpadu

cd ~ && mkdir forensics-int9 && cd forensics-int9

# 1. Konsep Plaso pipeline
echo "=== Plaso Pipeline ==*"
echo "  1. log2timeline → Ekstrak data dari berbagai source"
echo "  2. psort → Filter, sorting berdasarkan waktu"
echo "  3. Output → CSV, JSON, atau Elasticsearch"
echo ""

# 2. Simulasi multiple source digabung
python3 << 'PYEOF'
events = [
    # (timestamp, source, type, description)
    ("08:00:00", "Registry",   "USB_INSERT", "SanDisk 16GB plugged in"),
    ("08:01:00", "FileSystem", "FILE_CREATED", "C:\\Users\\user\\Desktop\\exploit.exe"),
    ("08:02:00", "Prefetch",   "EXECUTED", "exploit.exe (1st run)"),
    ("08:03:00", "Registry",   "USERASSIST", "exploit.exe executed via UserAssist"),
    ("08:04:00", "EventLog",   "EVENT_4688", "Process: cmd.exe started by exploit.exe"),
    ("08:05:00", "Network",    "DNS_QUERY", "malware-c2.com → 203.0.113.5"),
    ("08:05:30", "Network",    "TCP_CONN", "192.168.1.10:4444 → 203.0.113.5:80 ESTABLISHED"),
    ("08:06:00", "FileSystem", "FILE_DELETED", "C:\\Users\\user\\Desktop\\exploit.exe (self-delete)"),
    ("08:07:00", "Registry",   "RUN_KEY", "HKCU\\...\\Run\\Updater added (persistence)"),
    ("08:10:00", "EventLog",   "EVENT_1102", "Security log cleared!"),
]

print("=== SUPER TIMELINE ==*")
print(f"{'Time':<12} {'Source':<15} {'Event':<20} {'Detail':<55}")
print("-"*105)

for ts, src, etype, desc in events:
    sus = " 🚩" if any(x in etype for x in ['DNS_QUERY', 'FILE_DELETED', 'RUN_KEY', '1102', 'EVENT_4688']) else ""
    print(f"{ts:<12} {src:<15} {etype:<20} {desc:<55}{sus}")

print("\n📌 Timeline Analysis:")
print("  08:00 - USB inserted → malware masuk via flashdisk")
print("  08:01-02 - File dibuat & dieksekusi")
print("  08:04 - Command shell (cmd.exe) dijalankan")
print("  08:05 - C2 communication established!")
print("  08:06 - Malware self-delete (anti-forensik)")
print("  08:07 - Registry persistence installed")
print("  08:10 - Log cleared (cover tracks)")
PYEOF

# 3. Plaso output format
echo ""
echo "=== Plaso Output Format ==*"
echo "datetime,timestamp_desc,source,parser,data_type,message"
echo "2026-06-18T08:00:00,USB Device Plugged,Registry,winreg,usb_device,SanDisk..."
echo "2026-06-18T08:01:00,File Created,NTFS,fsstat,file_created,C:\\Users\\..."
echo "2026-06-18T08:05:00,DNS Query,Memory,volatility,dns_query,malware-c2.com..."