Skip to content

Commit 3307c97

Browse files
scudettescudette
authored
Implemented a fix for Windows.Timeline.Prefetch (Velocidex#2974)
Fix: Velocidex#2969
1 parent 20f6ff5 commit 3307c97

File tree

4 files changed

+215
-73
lines changed

4 files changed

+215
-73
lines changed

‎accessors/file/accessor_darwin.go

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
package file
2222

2323
import (
24+
"syscall"
2425
"time"
2526
)
2627

‎artifacts/definitions/Windows/Timeline/Prefetch.yaml

+65-73
Original file line numberDiff line numberDiff line change
@@ -39,76 +39,68 @@ sources:
3939
- query: |
4040
LET hostname <= SELECT Fqdn FROM info()
4141
42-
-- Parse prefetch files and apply non time filters
43-
LET pf = SELECT * FROM foreach(
44-
row={
45-
SELECT * FROM glob(globs=prefetchGlobs)
46-
},
47-
query={
48-
SELECT
49-
Executable,
50-
FileSize,
51-
Hash,
52-
Version,
53-
LastRunTimes,
54-
RunCount,
55-
// FilesAccessed,
56-
OSPath,
57-
Name AS PrefetchFileName,
58-
Btime as CreationTime,
59-
Mtime as ModificationTime
60-
FROM prefetch(filename=OSPath)
61-
WHERE
62-
if(condition=binaryRegex, then= Executable =~ binaryRegex,
63-
else=TRUE) AND
64-
if(condition=hashRegex, then= Hash =~ hashRegex,
65-
else=TRUE)
66-
})
67-
-- Flattern and filter on time.
68-
LET executionTimes = SELECT * FROM flatten(
69-
query = {
70-
SELECT *,
71-
OSPath as FilteredPath,
72-
LastRunTimes as ExecutionTime
73-
FROM pf
74-
})
75-
WHERE
76-
if(condition=dateAfter, then=ExecutionTime > timestamp(string=dateAfter),
77-
else=TRUE) AND
78-
if(condition=dateBefore, then=ExecutionTime < timestamp(string=dateBefore),
79-
else=TRUE)
80-
GROUP BY ExecutionTime
81-
LET creationTimes = SELECT * FROM flatten(
82-
query = {
83-
SELECT *,
84-
OSPath as FilteredPath,
85-
CreationTime as ExecutionTime
86-
FROM pf
87-
WHERE RunCount > 8
88-
})
89-
WHERE
90-
if(condition=dateAfter, then=ExecutionTime > timestamp(string=dateAfter),
91-
else=TRUE) AND
92-
if(condition=dateBefore, then=ExecutionTime < timestamp(string=dateBefore),
93-
else=TRUE)
94-
GROUP BY ExecutionTime
95-
96-
-- Output results ready for timeline
97-
LET flatOutput = SELECT
98-
ExecutionTime as event_time,
99-
hostname.Fqdn[0] as hostname,
100-
"Prefetch" as parser,
101-
"Evidence of Execution: " + Executable + format(format=" Prefetch run count %v", args=RunCount) as message,
102-
FilteredPath as source,
103-
Executable as file_name,
104-
CreationTime as prefetch_ctime,
105-
ModificationTime as prefetch_mtime,
106-
FileSize as prefetch_size,
107-
Hash as prefetch_hash,
108-
Version as prefetch_version,
109-
PrefetchFileName as prefetch_file,
110-
RunCount as prefetch_count
111-
FROM chain(
112-
a = { SELECT * FROM executionTimes },
113-
b = { SELECT * FROM creationTimes })
114-
SELECT * FROM flatOutput
42+
SELECT LastRunTimes as event_time,
43+
hostname.Fqdn[0] as hostname,
44+
"Prefetch" as parser,
45+
message,
46+
OSPath as source,
47+
Executable as file_name,
48+
CreationTime as prefetch_ctime,
49+
ModificationTime as prefetch_mtime,
50+
FileSize as prefetch_size,
51+
Hash as prefetch_hash,
52+
Version as prefetch_version,
53+
PrefetchFileName as prefetch_file,
54+
RunCount as prefetch_count
55+
FROM foreach(
56+
row={
57+
SELECT *
58+
FROM Artifact.Windows.Forensics.Prefetch(
59+
prefetchGlobs=prefetchGlobs,
60+
dateAfter=dateAfter,
61+
dateBefore=dateBefore,
62+
binaryRegex=binaryRegex,
63+
hashRegex=hashRegex)
64+
},
65+
query={
66+
SELECT *
67+
FROM chain(a1={
68+
SELECT *
69+
FROM flatten(query={
70+
SELECT Executable,
71+
FileSize,
72+
Hash,
73+
Version,
74+
LastRunTimes,
75+
"Evidence of Execution: " + Executable + format(
76+
format=" Prefetch run count %v", args=RunCount) as message,
77+
RunCount,
78+
OSPath,
79+
PrefetchFileName,
80+
CreationTime,
81+
ModificationTime,
82+
Binary
83+
FROM scope()
84+
})
85+
}, b1={
86+
-- One more row for creation time
87+
SELECT Executable,
88+
FileSize,
89+
Hash,
90+
Version,
91+
CreationTime AS LastRunTimes,
92+
"Evidence of Execution (Btime): " + Executable + format(
93+
format=" Prefetch run count %v", args=RunCount) as message,
94+
RunCount,
95+
OSPath,
96+
PrefetchFileName,
97+
CreationTime,
98+
ModificationTime,
99+
Binary
100+
FROM scope()
101+
})
102+
-- This group by applies on only a single prefetch file to
103+
-- remove duplication with CreationTime
104+
GROUP BY LastRunTimes
105+
})
106+
ORDER BY event_time

‎artifacts/testdata/server/testcases/prefetch.in.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,19 @@ Queries:
55
FROM Artifact.Windows.Forensics.Prefetch(
66
prefetchGlobs=srcDir+"/artifacts/testdata/files/*.pf",
77
IncludeFilesAccessed=TRUE)
8+
9+
# Exclude the Btime added rows
10+
- SELECT *, "hostname" AS hostname,
11+
"prefetch_ctime" AS prefetch_ctime,
12+
"prefetch_mtime" AS prefetch_mtime,
13+
basename(path=source) AS source
14+
FROM Artifact.Windows.Timeline.Prefetch(
15+
prefetchGlobs=srcDir+"/artifacts/testdata/files/*.pf")
16+
WHERE NOT message =~ "Btime"
17+
18+
# Make sure there is a single Btime row
19+
- SELECT count()
20+
FROM Artifact.Windows.Timeline.Prefetch(
21+
prefetchGlobs=srcDir+"/artifacts/testdata/files/*.pf")
22+
WHERE message =~ "Btime"
23+
GROUP BY 1

‎artifacts/testdata/server/testcases/prefetch.out.yaml

+133
Original file line numberDiff line numberDiff line change
@@ -387,4 +387,137 @@ SELECT _SCCAHeader, Executable, FileSize, Hash, Version, LastRunTimes, RunCount,
387387
}
388388
]
389389
}
390+
]SELECT *, "hostname" AS hostname, "prefetch_ctime" AS prefetch_ctime, "prefetch_mtime" AS prefetch_mtime, basename(path=source) AS source FROM Artifact.Windows.Timeline.Prefetch( prefetchGlobs=srcDir+"/artifacts/testdata/files/*.pf") WHERE NOT message =~ "Btime"[
391+
{
392+
"event_time": "2022-02-18T01:40:35Z",
393+
"parser": "Prefetch",
394+
"message": "Evidence of Execution: VELOCIRAPTOR.EXE Prefetch run count 30",
395+
"file_name": "VELOCIRAPTOR.EXE",
396+
"prefetch_size": 32730,
397+
"prefetch_hash": "0XDB95245D",
398+
"prefetch_version": "Win10 (30)",
399+
"prefetch_file": "VELOCIRAPTOR.EXE-DB95245D.pf",
400+
"prefetch_count": 30,
401+
"_Source": "Windows.Timeline.Prefetch",
402+
"hostname": "hostname",
403+
"prefetch_ctime": "prefetch_ctime",
404+
"prefetch_mtime": "prefetch_mtime",
405+
"source": "VELOCIRAPTOR.EXE-DB95245D.pf"
406+
},
407+
{
408+
"event_time": "2022-02-18T05:18:52Z",
409+
"parser": "Prefetch",
410+
"message": "Evidence of Execution: VELOCIRAPTOR.EXE Prefetch run count 30",
411+
"file_name": "VELOCIRAPTOR.EXE",
412+
"prefetch_size": 32730,
413+
"prefetch_hash": "0XDB95245D",
414+
"prefetch_version": "Win10 (30)",
415+
"prefetch_file": "VELOCIRAPTOR.EXE-DB95245D.pf",
416+
"prefetch_count": 30,
417+
"_Source": "Windows.Timeline.Prefetch",
418+
"hostname": "hostname",
419+
"prefetch_ctime": "prefetch_ctime",
420+
"prefetch_mtime": "prefetch_mtime",
421+
"source": "VELOCIRAPTOR.EXE-DB95245D.pf"
422+
},
423+
{
424+
"event_time": "2022-02-18T05:41:13Z",
425+
"parser": "Prefetch",
426+
"message": "Evidence of Execution: VELOCIRAPTOR.EXE Prefetch run count 30",
427+
"file_name": "VELOCIRAPTOR.EXE",
428+
"prefetch_size": 32730,
429+
"prefetch_hash": "0XDB95245D",
430+
"prefetch_version": "Win10 (30)",
431+
"prefetch_file": "VELOCIRAPTOR.EXE-DB95245D.pf",
432+
"prefetch_count": 30,
433+
"_Source": "Windows.Timeline.Prefetch",
434+
"hostname": "hostname",
435+
"prefetch_ctime": "prefetch_ctime",
436+
"prefetch_mtime": "prefetch_mtime",
437+
"source": "VELOCIRAPTOR.EXE-DB95245D.pf"
438+
},
439+
{
440+
"event_time": "2022-02-18T05:43:21Z",
441+
"parser": "Prefetch",
442+
"message": "Evidence of Execution: VELOCIRAPTOR.EXE Prefetch run count 30",
443+
"file_name": "VELOCIRAPTOR.EXE",
444+
"prefetch_size": 32730,
445+
"prefetch_hash": "0XDB95245D",
446+
"prefetch_version": "Win10 (30)",
447+
"prefetch_file": "VELOCIRAPTOR.EXE-DB95245D.pf",
448+
"prefetch_count": 30,
449+
"_Source": "Windows.Timeline.Prefetch",
450+
"hostname": "hostname",
451+
"prefetch_ctime": "prefetch_ctime",
452+
"prefetch_mtime": "prefetch_mtime",
453+
"source": "VELOCIRAPTOR.EXE-DB95245D.pf"
454+
},
455+
{
456+
"event_time": "2022-02-18T06:55:37Z",
457+
"parser": "Prefetch",
458+
"message": "Evidence of Execution: VELOCIRAPTOR.EXE Prefetch run count 30",
459+
"file_name": "VELOCIRAPTOR.EXE",
460+
"prefetch_size": 32730,
461+
"prefetch_hash": "0XDB95245D",
462+
"prefetch_version": "Win10 (30)",
463+
"prefetch_file": "VELOCIRAPTOR.EXE-DB95245D.pf",
464+
"prefetch_count": 30,
465+
"_Source": "Windows.Timeline.Prefetch",
466+
"hostname": "hostname",
467+
"prefetch_ctime": "prefetch_ctime",
468+
"prefetch_mtime": "prefetch_mtime",
469+
"source": "VELOCIRAPTOR.EXE-DB95245D.pf"
470+
},
471+
{
472+
"event_time": "2022-02-21T00:12:14Z",
473+
"parser": "Prefetch",
474+
"message": "Evidence of Execution: VELOCIRAPTOR.EXE Prefetch run count 30",
475+
"file_name": "VELOCIRAPTOR.EXE",
476+
"prefetch_size": 32730,
477+
"prefetch_hash": "0XDB95245D",
478+
"prefetch_version": "Win10 (30)",
479+
"prefetch_file": "VELOCIRAPTOR.EXE-DB95245D.pf",
480+
"prefetch_count": 30,
481+
"_Source": "Windows.Timeline.Prefetch",
482+
"hostname": "hostname",
483+
"prefetch_ctime": "prefetch_ctime",
484+
"prefetch_mtime": "prefetch_mtime",
485+
"source": "VELOCIRAPTOR.EXE-DB95245D.pf"
486+
},
487+
{
488+
"event_time": "2022-02-21T00:45:24Z",
489+
"parser": "Prefetch",
490+
"message": "Evidence of Execution: VELOCIRAPTOR.EXE Prefetch run count 30",
491+
"file_name": "VELOCIRAPTOR.EXE",
492+
"prefetch_size": 32730,
493+
"prefetch_hash": "0XDB95245D",
494+
"prefetch_version": "Win10 (30)",
495+
"prefetch_file": "VELOCIRAPTOR.EXE-DB95245D.pf",
496+
"prefetch_count": 30,
497+
"_Source": "Windows.Timeline.Prefetch",
498+
"hostname": "hostname",
499+
"prefetch_ctime": "prefetch_ctime",
500+
"prefetch_mtime": "prefetch_mtime",
501+
"source": "VELOCIRAPTOR.EXE-DB95245D.pf"
502+
},
503+
{
504+
"event_time": "2022-02-21T01:03:45Z",
505+
"parser": "Prefetch",
506+
"message": "Evidence of Execution: VELOCIRAPTOR.EXE Prefetch run count 30",
507+
"file_name": "VELOCIRAPTOR.EXE",
508+
"prefetch_size": 32730,
509+
"prefetch_hash": "0XDB95245D",
510+
"prefetch_version": "Win10 (30)",
511+
"prefetch_file": "VELOCIRAPTOR.EXE-DB95245D.pf",
512+
"prefetch_count": 30,
513+
"_Source": "Windows.Timeline.Prefetch",
514+
"hostname": "hostname",
515+
"prefetch_ctime": "prefetch_ctime",
516+
"prefetch_mtime": "prefetch_mtime",
517+
"source": "VELOCIRAPTOR.EXE-DB95245D.pf"
518+
}
519+
]SELECT count() FROM Artifact.Windows.Timeline.Prefetch( prefetchGlobs=srcDir+"/artifacts/testdata/files/*.pf") WHERE message =~ "Btime" GROUP BY 1[
520+
{
521+
"count()": 1
522+
}
390523
]

0 commit comments

Comments
 (0)