Daily Blog #691: Solution Saturday 5/2/20 - Magnet DFIR CTF Winner

Hello Reader,
       This week an previous winner stepped up the challenge. Not only have they won a Sunday Funday before but they are also a Magnet DFIR CTF winner! This week Kevin Pagano stepped up and brought in the win with a good bit of research!

The Question:
Windows Timeline is an amazing source of user data, however like all things it has limitations. Answer the following questions:
1. How long before an action is taken before it is committed to the Windows Timeline database
2. What process and/or service creates the events
3. What call do developers need to make to support it
4. What is excluded?
5. When do events get removed?

The Winning Answer:
Kevin Pagano 

Windows Timeline is an amazing source of user data, however like all things it has limitations. Answer the following questions:

1. How long before an action is taken before it is committed to the Windows Timeline database

Almost instantly it seems, when running KAPE to test parsing the DB file, it actually wrote the kape.exe as the latest interaction.

2. What process and/or service creates the events

SVCHOST populates events into the ActivitiesCache database files. We can see a bunch of locks/unlocks through ProcMon:

3. What call do developers need to make to support it

Microsoft breaks this down in pretty good detail:

https://blogs.windows.com/windowsdeveloper/2017/12/19/application-engagement-windows-timeline-user-activities/ 

It uses the UserActivity API class object pulling in ActivityID, ActivationUri, and DisplayText as the minimum set. They also show all the code that is needed to add activities and adaptive cards to the Timeline. I am in no way a developer so this is all Greek to me.

4. What is excluded?

Applications that have activities that don't support using the API above won't be included from the GUI but they are still written to the DB file. 

5. When do events get removed?  

From Microsoft's site, items will be stored for up to 30 days (https://support.microsoft.com/en-us/help/4230676/windows-10-get-help-with-timeline), where after I assume they are deleted out of the database. There may be potential events you can recover from SQL slack. The user can also remove items as they see fit but they might not be purged until the Expiration Time is up for each entry.

Parsing using Eric Zimmerman's WxTCmd, we can see this is true.

Also Read: Daily Blog #690 

Read More

Daily Blog #114: Solving Sunday Funday 10/13/13 - Timeline intersection

Hello Reader,
           It was an interesting contest this Sunday in that we had so few responses. To those of you who watched our forensic lunch on Friday we did talk about strategies for tracking lateral movement, we just didn't get into Linux specifically. Today we are going to talk about how I would approach stitching together lateral movement based on the netflow data we have. For those not familiar with Netflow and how it works/what it can do you might want to start here.

The key to this challenge is the availability of netflow and the fact that the systems here are on the DMZ. Since we started the scenario with the knowledge of the attackers source country, this is your first pivot point and what I would do at this point is the following:

1. Load the netflow data into a datbase.

2. Pull out the distinct times in days/hours where your attacker was active based on his initially detected ip.

3. Determine which hosts that ip has accessed.

4. Go to each of those hosts and create a timeline from the logs stored within them, this is one advantage of Linux of Windows as Linux tends by default to log more events by default.

5. Look then at the netflow data from all traffic originating from the dmz hosts identified in step 3 and find all the traffic within the network that they originated on the times identified in step 2.

6. Access those hosts identified in step 5 and pull a timeline of those logs.

Your next step will be to limit your timeline to those days and times identified in step 2. You want to review those systems and determine if there a reason to believe that they have been used for lateral movement as well, in which case repeat step 5 for each host where you believe this is possible.

This intersection of host based and netflow diagrams for time periods will allow you to slice and dice your timeline data from the hosts to focus on those periods of activity you most need to focus on in order to determine what the attacker was up to and their capabilities.

Tomorrow let's talk about host artifacts to inspect.

Also Read: Daily Blog #113

Read More