Daily Blog #622: Solution Saturday 2/9/19 - Amcache Hive Challenge Winner Announcement

Hello Reader,
             This week Oleg Skulkin has come in with another win! Oleg found some interesting results. In Oleg's testing all of his executions were caught by the Amcache, except those programs executed from external storage volumes. Very interesting! I think we will have to go back to Syscache and Amcache again in the near future to find more about what Oleg was seeing!

The Challenge:

What are all the methods of execution you can find that are not recorded in the Amcache hive?

The Winning Answer:
Oleg Skulkin
https://cyberforensicator.com/2019/02/06/amcache-forensics-populated-or-not/

Also Read: Daily Blog #621

Read More

Daily Blog #609: Solution Saturday 1/26/19 - Server 2008 R2 System

Hello Reader,
              Looks like my 2019 streak is now broken, this week we have no qualifying answers. When this happens I take it as a sign that the question was harder than I expected which means I really need to focus on finding a real answer myself. I'll be working on that and the other unanswered challenges in the year to come. Tomorrow come back for another challenge and I'll adjust my questions accordingly.

The winning answer: None this week

The Challenge:

On a Server 2008 R2 system make 4 copies of mimikatz (your choice of versions) 64 bit and 32 bit versions. Run them from 4 locations (of your choice) and determine what criteria determines when and if the executable gets logged in the Syscache hive and what dates are associated with the registry keys. 

Also Read: Daily Blog #608

Read More

Daily Blog #604: New Amcache Resarch Paper you really should read

Hello Reader,
      If you've been following the blog and the test kitchens you would have seen that both myself and Maxim Suhanov have been testing and talking alot about the Amcache which lead to our findings about the Syscache hive. Well, it looks like we are not alone in our quest to truely understand this artifact since Blanche Lagny of the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) aka the French National Cybersecurity Agency has released today atleast a years worth of research into not only the Amcache structure but also:

• What processes populate the Amcache
• What determines the format of the Amcache data (dll versions not windows versions)
• What determines the behavior of the Amcache storage (again its dll versions)
• and much more

If you are at all interested in the Amcache and want to understand it at a deeper level I would highly recommend you read this:
http://www.ssi.gouv.fr/uploads/2019/01/anssi-coriin_2019-analysis_amcache.pdf

Please note as with any other paper Lagny has both timing and scope limitations so this paper doesn't include every possible facet of the Amcache,  such as what it does not log or how the latest version of Windows 10 populates it. It's not that she is not aware of the other data points its that they are hopefully going to be covered by future papers. 

Also Read: Daily Blog #603

Read More

Daily Blog #603: Sunday Funday 1/20/19 - Server 2008 R2 System Challenge

Hello Reader,
            Last week's challenge brought out some great research and new tools. I hope that this streak of great responses continues through 2019! Let's switch focus back to the Syscache hive for this weeks challenge.


The Prize:
$100 Amazon Giftcard

The Rules:

1. You must post your answer before Friday 1/25/19 7PM CST (GMT -5)
2. The most complete answer wins
3. You are allowed to edit your answer after posting
4. If two answers are too similar for one to win, the one with the earlier posting time wins
5. Be specific and be thoughtful
6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:

On a Server 2008 R2 system make 4 copies of mimikatz (your choice of versions) 64 bit and 32 bit versions. Run them from 4 locations (of your choice) and determine what criteria determines when and if the executable gets logged in the Syscache hive and what dates are associated with the registry keys. 

Also Read: Daily Blog #602

Read More

Daily Blog #599: Forensic Lunch Test Kitchen 1/16/19 Syscache Server 2008 R2 Mimikatz

Hello Reader,
   Tonight we just had a short testing session (8 minutes of actual testing) were we checked in on last nights test. Here is what we learned:

• The time delay did not effect our results
• A shutdown/power on did not add a new entries
• The registry explorer and hasher entries still had no hash
• We still saw no entries for the other mimikatz executables

On the next broadcast we will be testing the same behavior in Windows 7 and parsing the whole MFT and Syscache rather than individual records to make sure we aren't missing anything.

You can watch the video here:

Also Read: Daily Blog #598

Read More

Daily Blog #598: Forensic Lunch Test Kitchen 1/15/19 Syscache Mimikatz Server 2008 R2

Hello Reader,
       Tonight we returned to the test kitchen to try to solve the mystery of the Multiple mimikatz executables now showing up in the Syscache

Tonight we learned:

• Syscache does not appear to duplicate entries by hash
• We got some entries to appear without a hash
• We are giving the VM enough time to run its background processes to get the Syscache full written to with a new test tomorrow night
• The last write time does not appear to be updated when the program is executed again
• 64bit and 32bit executables are being recorded

You can watch the video here:

Also Read: Daily Blog #597 

Read More

Daily Blog #594: Forensic Lunch Test Kitchen 1/11/19 Server 2008 R2 Syscache Mimikatz

Hello Reader,
  Tonight on request from a viewer we are looking to see what Mimikatz leaves behind in the Syscache hive on Windows Server 2008 R2.

Here is what we learned:

• The Syscache hive did not appear to log the 64 bit mimikatz executable from the first execution
• It did log the 32 bit mimikatz executable on first execution
• It did log the 64 bit mimikatz executable on the desktop
• It did not appear to log the 64 bit mimikatz executable in the documents directory
• The sha-1 16 bit hashes were correctly searched by Virustotal identifying mimikatz

We are going to leave the VM running over the weekend to see if the other 64 bit executables show up, see you next week. In the mean time tomorrow come back to see this weeks Sunday Funday winner with the new contest posted this Sunday.

You can watch the video here:

  

Also Read: Syscache and SHA 16bit hashes

Read More

Daily Blog #592: Syscache and SHA 16bit hashes

Hello Reader,
          Tonight I'm applying my Syscache research in some casework and while testing things out I realized something that I don't think was properly documented before. The Syscache SHA-1 hashes appear to be base16 hashes not base32 hashes. So before you begin looking for that malicious executable make sure you've generated the correct hash!

Also Read: The meaning of Syscache.hve

Read More

Daily Blog #588: Solution Saturday 1/5/19 - Syscache.hve Challenge Winner Announcement

Hello Reader,
       Sometimes you have a winning entry that exceeds all of your expectations. This week is that week for me. Maxhim Suhanov has come through with some pretty thorough testing to show what processes write to the Syscache hive and what dll's reference it. This is great work and I look forward to trying out the application registry monitoring method he found.

The Challenge:

What processes update the Syscache.hve file on Windows Server 2008 R2?

The Winning Answer:

Maxim Suhanov

https://dfir.ru/2019/01/04/what-writes-to-the-syscache-hive/

Also Read: Daily Blog #587

Read More

Daily Blog #586: Forensic Lunch Test Kitchen Server 2019 Shimcache Srum Syscache

Hello Reader,
      Tonight we extended our search to see if the Syscache hive came back to life by looking into Windows Server 2019, Here is what we learned:

• No Syscache hive by default in Server 2019
• There is a SRUM database by default in Server 2019
• There is an Amcache hive by default in Server 2019
• There is still no Preftech in Server 2019
• Shimcache showed an interesting behavior that we need to regression test back versions of Windows where executables viewed in the Explorer GUI only got entered into the Shimcache hive when they were viewable and/or highlighted in the GUI Window
• Executables not yet viewed in the GUI window scroll were not present in the Shimcache

You can watch the video here:

Also Read: Daily Blog #585

Read More

Daily Blog #583: Sunday Funday 12/30/18 - Syscache.hve File Challenge

Hello Reader,
      This will be the first Sunday Funday for 2019 since when the submissions are received and judged the winner will be announced in 2019. Let's see what your system monitoring/debugging skills are like.

The Prize:

$100 Amazon Giftcard

The Rules:

1. You must post your answer before Friday 1/4/19 7PM CST (GMT -5)
2. The most complete answer wins
3. You are allowed to edit your answer after posting
4. If two answers are too similar for one to win, the one with the earlier posting time wins
5. Be specific and be thoughtful
6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:

What processes update the Syscache.hve file on Windows Server 2008 R2?

Also Read: Daily Blog #582

Read More

Daily Blog #582: Solution Saturday 12/29/18 - Syscache Server 2008 R2 Challenge

Hello Reader,
         Well no winner this week, I may have pushed a bit far in a holiday week. Tomorrow is the first contest for the new year and we will all have a fresh start.

The Challenge:

On server 2008 r2 how would the following be seen in the syscache and what was logged:

1. Powershell empire agent

2. Meterpeter

3. Mimikatz

The winning answer:

None! I'll make sure to cover this in the test kitchen

Also Read: Daily Blog #581

Read More

Daily Blog #581: Forensic Lunch Test Kitchen 12/28/18 Syscache Applocker and Server 2012

Hello Reader,
         Tonight we booted up a server 2012 VM which is in line with Windows 8.1 looking to see if we could find a syscache hive with and without applocker configured. So far no such luck but we will keep trying.

If you want to watch the video you can do so here:

Also Read: Applocker and Windows 10

Read More

Daily Blog #580: Applocker and Windows 10

Hello Reader,
          Didn't get started until very late tonight so I didn't do a broadcast, tomorrow though we will for sure. Instead I decided to see if I could get Applocker going on Windows 10 Enterprise since I already have a VM running it. I turned Applocker into audit only mode, made default rules and executed programs and ...

Nothing

So far I haven't had any entries in the event logs or a syscache hive generated, so tomorrow on the stream we will attempt to make this work again and also try this on Sever 2012, 2016 and 2019.

Also Read:  The meaning of Syscache.hve

Read More

Daily Blog #579: The meaning of Syscache.hve

Hello Reader,
     One of the things I've often repeated the last couple of test kitchens in regards to the Syscache hive is why does it exist. In earlier googling I thought based on its locations in slide presentations that it might be involved in the volume shadow copy system, something Maxim Suhanov does not agree with. This left the question though, what does it relate to?

Well reader long time BFF (Best Forensic Friend) Dr. Vico Marziale at blackbag may have found a pretty huge clue. In his googling, which I must say found things I did not even when searching keywords that existed in the document, found a pdf from Legato/EMC networker release notes form July of 2010.

Within these release notes the backup software states:
"The files syscache.hve, syscache.hve.LOG1, and syscache.hve.LOG2 are skipped during backup 

The files syscache.hve, syscache.hve.LOG1, and syscache.hve.LOG2, located in the %systemdrive%\system volume information folder, will be skipped during backup. These hive files are used for maintaining extended data for executable files on the system, such as SRP (Software Restriction Policies) and AppLocker. Microsoft recommends not restoring these files. These files are created from derived data and will be rebuilt over time"

Source: https://nsrd.info/blog/wp-content/uploads/2010/07/NW753_Release.pdf

So the reason this registry hive was placed in the System Volume Information folder could be that the contents of this special folder are not included in shadow copies. Also Windows Applocker was introduced in Windows 7 (https://en.wikipedia.org/wiki/AppLocker) which coincides with creation of the Syscache hive and was available in Windows Server 2008 R2:(https://blogs.technet.microsoft.com/askperf/2009/10/19/windows-7-windows-server-2008-r2-applocker/)

The included scope of Applocker includes Exes, DLL's and Scripts:

"AppLocker currently supports the following file extensions:

• Executables (.exe, .com)
• Dlls (.ocx, .dll)
• Scripts (.vbs, .js, .ps1, .cmd, .bat)
• Windows Installers (.msi, .mst, .msp)
• Packaged app installers (.appx)"

Source: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain

Note that the above link is for Windows 10, in Windows 7 we have not yet seen powershell scripts get logged. 

So this does appear to be the closest thing we've found to a explanation of why Syscache contains the data that it does. Now we need to find out what happened to the hive in later versions of Windows and what else we can infer from its association. 

Tomorrow I plan to return to the test kitchen, just having to much fun over the holidays to do one in time tonight. 

Also Read: Daily Blog #578

Read More

Daily Blog #576: Sunday Funday 12/23/18 - Syscache Challenge On Server 2008 R2

Hello Reader,
    Let's finish the year right. The last challenge of 2018 needs to be special.

The Prize:

$100 Amazon Giftcard

The Rules:

1. You must post your answer before Friday 12/28/18 7PM CST (GMT -5)
2. The most complete answer wins
3. You are allowed to edit your answer after posting
4. If two answers are too similar for one to win, the one with the earlier posting time wins
5. Be specific and be thoughtful
6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:

On server 2008 r2 how would the following be seen in the syscache and what was logged:

1. Powershell empire agent

2. Meterpeter

3. Mimikatz

Also Read: Daily Blog #575

Read More

Daily Blog #573: Forensic Lunch Test Kitchen 12/20/18 Syscache and Server 2008 R2

Hello Reader,
       Tonight after finding out from you that the Syscache.hve exists on Server 2008 R2 we switched OS's in our testing and focused on Syscahe on Server 2008 R2 and away from Windows 7 for now. Here is what we learned:

• The Syscache hive exists on an unpatched Server 2008 R2 SP1 system
• The syscache hive exists even without Amcache coming into existence
• The syscache hive on server 2008 r2 is catching executables just like Windows 7
• The syscache hive on server 2008 r2 is committing changes to the registry hive within seconds of the execution
• The syscache hive on server 2008 r2 includes executions from the Desktop, unlike Windows 7
• The syscache hive on server 2008 r2 does not appear to be catching bat files like Windows 7 but does catch and executables the bat file calls

More testing to be done! Tune in tomorrow for the Forensic Lunch and next week for more testing!

You can watch the video here:

Also Read: Daily Blog #572 

Read More

Daily Blog #572: Forensic Lunch Test Kitchen 12/19/18 Syscache and Python

Hello Reader,
      Tonight we wrote some python code to recover the full path of the files referenced in the Syscache hive, added in the ProgramID and then viewed the data in Timeline Explorer to see the relation between the executables. We learned:

• That pytsk does not have an attribute for parent reference number, so we had to extract it from the file name attribute
• That analyzemft has a great set of example code to pull your unpack's from if you are looking to write your own attribute parser
• That when I grouped my syscache entries by programID I only had 60+ entries which seems more like just what has been executed on this lightly used VM
• That there is no entry of any program run directly from my Desktop

You can get the code here: https://github.com/dlcowen/TestKitchen/blob/master/PrintFileNamesByEntry.py

You can watch the video here:

Also Read: Daily Blog #571 

Read More

Daily Blog #571: Forensic Lunch Test Kitchen 12/18/18 Syscache

Hello Reader,
        Another evening, another test kitchen! Tonight we looked even deeper into the Syscache and we learned:

• Bat files are recorded in the Syscache hives when executed
• Bat files and other executables run from the Desktop are not recorded in the Syscache
• Powershell files (ps1) are not caught in the Syscache hive
• Deleting a file did not eliminate it from the Syscache hive 
• Installing a program recorded its installer, but the program did not prepopulate an entry in the Syscache hive
• Creating a bat file did not pre-populate it in the Syscache hive

You can watch the video here:

Also Read: Daily Blog #570 

Read More

Daily Blog #570: Forensic Lunch Test Kitchen 12/17/18 Syscache.hve

Hello Reader,
       Tonight in the Test Kitchen we expanded our testing of the Syscache hive by adding more data from our python script that is matching MFT entries to the Syscache entries. Here is what we learned:

• The syscache hive seems to record atleast exe, dll, bat and cmd files executed
• The syscache hive like the Amcache hive will store which program by sha1 hash the executable is associated with
• If there is no associated executable (no MSI installer) it will use the sha1 hash 'da39a3ee5e6b4b0d3255bfef95601890afd80709' which is the empty hash. Meaning like the Amcache it is storing information about executables not associated with any MSI installed program
• It appears, this needs more testing, that it may record more related executables than the Amcache does when a program is installed/executed

Still much more testing to be done to really make sure we understand what we are really seeing. To  be tested:

1. Installing a program but not executing it, will it appear
2. Adding full path support to the python script to understand where the associated files are being pulled from
3. Checking to see if powershell scripts get logged
4. Looking to see if deletions of programs/executables change the hive
5. Testing again to see if programs run from the desktop are include

You can watch the video here:

Also Read: Daily Blog #569 

Read More