Daily Blog #689: Feature Usage from Oleg Skulkin

Hello Reader,
       Tomorrow on the Forensic Lunch I've asked Oleg Skulkin to join. I mainly asked Oleg to join because he won last week's Sunday Funday contest and this is a new thing I'm trying to start, having the prior winner to come on and talk about what they did in their research.  Well in the mean time Oleg went ahead and posted up some entirely new research unrelated to any Sunday Funday. Oleg found a new registry artifact called FeatureUsage which appears to track programs that you launch through the task bar.

Now this is not the only source of this data conceivably, it could overlap artifacts like AmCache, UserAssist, Shimcache and Prefetch. But what's interesting about this is that its tracking a specific time of GUI execution, that being from the taskbar. Which means you could potentially get additional times of execution. Maybe I'm missing something and I'll find out tomorrow when Oleg is on the lunch at Noon CDT (UTC -5)!

You can read Oleg's research here: https://www.group-ib.com/blog/featureusage

Also Read: Daily Blog #688 -  How to make AWS EBS Direct Block API Events appear in Cloudtrail

Read More

Daily Blog #640: Regipy - A New Python Windows Registry Forensics Library

Hello Reader,
        As I was talking about in #638 I believe automation in DFIR is a big part of our future. With the idea of automating the extraction and basic correlation of data so that a human can use their brain. As we work towards that I'm always looking for new libraries that can support that effort, especially lately if they are written in Python.

So I was happy to see that Martin Korman (who writes the DFIR Dudes blog with Hada Yudovich the winner of the 2018 Defcon DFIR CTF) put out a new python library for parsing Windows Registries.

Read the blog here:
https://medium.com/dfir-dudes/regipy-automating-registry-forensics-with-python-b170a1e2b474

See the code here:
https://github.com/mkorman90/regipy

What's interesting is that Martin has taken alot of the registry parsing and transaction log handling we've seen in YARP and added on the ability for creating simple plugins to automatically parse the data it extracts.

I haven't had a chance to compare the library or its output to any other, but I'm always happy to see more options out there. If nothing else take a look at the code to get an idea of how to handle these kinds of data structures in Python. 

Also Read: Daily Blog #639

Read More

Daily Blog #501: Forensic Lunch Test Kitchen 10/8/18 - Registry Transaction Logs

Hello Reader,
           It's Monday and it's time for another test kitchen! Tonight I tested Maxim Suhanov's assertion that waiting 60 seconds would allow the changes I made to the registry by closing file explorer would allow the transaction logs to be written to. So I did that test and even waited two minutes prior to exiting.

Here is what we learned:

• After waiting two minutes between closing the two file explorer windows the live registry showed the second windows entries. The transaction logs and registry showed the first windows entries but no record of the second.
• Re-extracting the registry from the disk a few minutes later cause the second windows entries to show up, but the first windows entries were lost again
• Parsing the registry without the transaction logs does not show either windows changes initially, but did after the second registry extraction

More to test, more to learn! 

You can watch the video below:

Also Read: Daily Blog #500

Read More

Daily Blog #483: Typed Paths Amnesia

Hello Reader,

               I'm going to update this post with a video when I get to my hotel room tonight and do a test kitchen. I wanted to take a moment to talk about the Typed Paths registry key in Windows. Typed Paths if you are not familiar records the last 25 directories you manually typed into the file explorer path bar seen highlighted below:

If you ever tested this registry key (located under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths) you might have been confused that entries didn't show up in the key when you typed paths into path bar above, but they still showed up in the drop down within the GUI.

You have to close the file explorer window for the entries you see within the GUI to be committed to the registry key.

When I showed this in class some time ago I had a student who asked a very smart question, they asked 'well, what happens if you have two file explorer windows open'. So we did the test and as it turns out something very interesting happens.

Both file explorer windows will start with a copy of the registry key loaded in its process memory and display the same entries. As you type in new paths into each window each will show their own version of the list without any knowledge of the other file explorer process.

When you close the first file explorer window the registry key will get updated with the contents of that processes Typed Paths. However, when you close the second it will overwrite the key without checking its contents meaning you will lose any unique entries typed into the first window as it will just write to the registry the contents of its process memory.

So TypedPaths works, but like every other artifact, it has limitations. Make sure you know what those limitations are!

Also Read: Daily Blog #482

Read More