Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add application_execution tag to certain Amcache entries #4105

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+14 −0
Open

Add application_execution tag to certain Amcache entries #4105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions data/tag_windows.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ application_execution
data_type is 'windows:registry:mrulistex' AND entries contains '.exe'
data_type is 'windows:registry:userassist' AND value_name contains '.exe'
data_type is 'windows:tasks:job'
parser is 'winreg/amcache' AND data_type is 'windows:registry:key_value' AND key_path contains 'InventoryApplicationFile\\'

# Tags Windows application installation events.
application_install
Expand Down
13 changes: 13 additions & 0 deletions tests/data/tag_windows.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
import unittest

from plaso.containers import events
from plaso.containers import windows_events
from plaso.lib import definitions
from plaso.parsers import filestat
from plaso.parsers import winevt
Expand Down Expand Up @@ -168,6 +169,18 @@ def testApplicationExecution(self):
winjob.WinJobEventData, attribute_values_per_name,
['application_execution'])

# Test: parser is 'winreg/amcache' AND
# data_type is 'windows:registry:key_value' AND
# key_path contains 'InventoryApplicationFile\\'
event = events.EventObject()
event.timestamp = self._TEST_TIMESTAMP
event.timestamp_desc = definitions.TIME_DESCRIPTION_MODIFICATION
event_data = windows_events.WindowsRegistryEventData()
event_data.key_path = '\\Root\\InventoryApplicationFile\\7z.exe|afe683e0fa522625'
event_data.parser = 'winreg/amcache'
storage_writer = self._TagEvent(event, event_data, None)
self._CheckLabels(storage_writer, ['application_execution'])
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use _CheckTaggingRule ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No real reason. I saw it written like this in other tests. Should I change it to _CheckTaggingRule?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, please, unless there is a specific reason not to, also see my comment about AMCacheFileEventData. The current filter rule is fragile since it tests a path as a string, not as a path using using PATH()


def testApplicationInstall(self):
"""Tests the application_install tagging rule."""
# Test: data_type is 'windows:evtx:record' AND
Expand Down