version v0.28.0

cuhsat · Jun 13, 2024 · 034388b · 034388b
1 parent 108d5bd
commit 034388b
Show file tree

Hide file tree

Showing 13 changed files with 325 additions and 160 deletions.
diff --git a/README.md b/README.md
@@ -104,8 +104,8 @@ Required system commands:
 - [ ] [System Prefetch Files](https://forensics.wiki/prefetch/)
 - [x] [System Event Logs](https://forensics.wiki/windows_event_log_%28evt%29/)
 - [ ] [System AmCache](https://forensics.wiki/amcache/)
-- [ ] [User ShellBags](https://forensics.wiki/shell_item/)
 - [x] [User JumpLists](https://forensics.wiki/jump_lists/)
+- [x] [User ShellBags](https://forensics.wiki/shell_item/)
 - [ ] [User Browser Histories](https://forensics.wiki/google_chrome/)
 
 ## License

diff --git a/internal/flog/ez.go → internal/flog/cmd.go b/internal/flog/ez.go → internal/flog/cmd.go
@@ -2,13 +2,15 @@
 package flog
 
 import (
+	"fmt"
+	"os"
 	"path/filepath"
 
 	"github.com/cuhsat/fact/internal/fact/ez"
 	"github.com/cuhsat/fact/internal/sys"
 )
 
-func EvtxeCmd(src, dir string) (log string, err error) {
+func Evtxe(src, dir string) (log string, err error) {
 	cmd, err := ez.Path("EvtxECmd.dll")
 
 	if err != nil {
@@ -27,7 +29,7 @@ func EvtxeCmd(src, dir string) (log string, err error) {
 	return
 }
 
-func JleCmd(src, dir string) (log string, err error) {
+func Jle(src, dir string) (log string, err error) {
 	cmd, err := ez.Path("JLECmd.dll")
 
 	if err != nil {
@@ -52,3 +54,43 @@ func JleCmd(src, dir string) (log string, err error) {
 
 	return
 }
+
+func Sbe(src, dir string) (log string, err error) {
+	cmd, err := ez.Path("SBECmd.dll")
+
+	if err != nil {
+		return
+	}
+
+	if len(dir) == 0 {
+		dir = filepath.Dir(src)
+	}
+
+	b := BaseFile(filepath.Base(src))
+
+	dst := "out.csv"
+	tmp := filepath.Join(dir, "tmp")
+	log = filepath.Join(dir, fmt.Sprintf("%s_%s", b, dst))
+
+	if err = os.MkdirAll(tmp, sys.MODE_DIR); err != nil {
+		return
+	}
+
+	if err = Copy(tmp, src); err != nil {
+		return
+	}
+
+	_, err = sys.StdCall("dotnet", cmd, "-d", tmp, "--csv", dir, "--csvf", dst)
+
+	if err != nil {
+		return
+	}
+
+	if err = os.Remove(filepath.Join(dir, "!SBECmd_Messages.txt")); err != nil {
+		return
+	}
+
+	err = os.RemoveAll(tmp)
+
+	return
+}
diff --git a/internal/flog/file.go b/internal/flog/file.go
@@ -18,6 +18,24 @@ func BaseFile(name string) string {
 	return strings.TrimSuffix(b, filepath.Ext(b))
 }
 
+func Copy(dir, src string) (err error) {
+	dst := filepath.Join(dir, filepath.Base(src))
+
+	b, err := os.ReadFile(src)
+
+	if err != nil {
+		return
+	}
+
+	err = os.WriteFile(dst, b, sys.MODE_FILE)
+
+	if os.IsNotExist(err) {
+		err = nil
+	}
+
+	return
+}
+
 func ConsumeJson(name string) (lines []string, err error) {
 	f, err := os.Open(name)
 

diff --git a/internal/testdata/windows/ms.zip b/internal/testdata/windows/ms.zip
diff --git a/internal/testdata/windows/evtx.zip → internal/testdata/windows/system.zip b/internal/testdata/windows/evtx.zip → internal/testdata/windows/system.zip
diff --git a/internal/testdata/windows/user.zip b/internal/testdata/windows/user.zip
diff --git a/pkg/ecs/event.go b/pkg/ecs/event.go
@@ -2,8 +2,6 @@
 package ecs
 
 import (
-	"time"
-
 	"github.com/cuhsat/fact/internal/flog"
 )
 
@@ -14,48 +12,39 @@ func MapEvent(s, src string) (log *Log, err error) {
 		return
 	}
 
-	channel := m.GetString("Event/System/Channel")
-
-	timestamp := m.GetTime("Event/System/TimeCreated/@SystemTime")
-	timezone, _ := timestamp.Zone()
-	message := m.GetString("Event/EventData/Data/#text")
-
-	return NewLog(
-		src,
-		Base{
-			Timestamp: timestamp,
-			Message:   message,
-			Tags:      "EventLog",
-			Labels: map[string]interface{}{
-				"Channel": channel,
-				"Level":   m.GetInt64("Event/System/Level"),
-				"Task":    m.GetInt64("Event/System/Task"),
-			},
-		},
-		Evt{
-			Kind:     "event",
-			Module:   "EventLog",
-			Dataset:  "EventLog." + channel,
-			Severity: m.GetInt64("Event/System/Level"),
-			ID:       m.GetString("Event/System/EventRecordID"),
-			Code:     m.GetString("Event/System/EventID/#text"),
-			Provider: m.GetString("Event/System/Provider/@Name"),
-			Timezone: timezone,
-			Created:  timestamp,
-			Ingested: time.Now().UTC(),
-			Original: s,
-			Hash:     GetHash(s),
-		},
-		Host{
-			Hostname: m.GetString("Event/System/Computer"),
-			Name:     m.GetString("Event/System/Computer"),
+	log = NewLog(s, src, &Base{
+		Timestamp: m.GetTime("Event/System/TimeCreated/@SystemTime"),
+		Message:   m.GetString("Event/EventData/Data/#text"),
+		Tags:      "EventLog",
+		Labels: map[string]interface{}{
+			"Channel": m.GetString("Event/System/Channel"),
+			"Level":   m.GetInt64("Event/System/Level"),
+			"Task":    m.GetInt64("Event/System/Task"),
 		},
-		User{
-			ID: m.GetString("Event/System/Security/@UserID"),
-		},
-		Process{
-			PID:      m.GetInt64("Event/System/Execution/@ProcessID"),
-			ThreadID: m.GetInt64("Event/System/Execution/@ThreadID"),
+	})
+
+	log.Event.Kind = "event"
+	log.Event.Module = "EventLog"
+	log.Event.Dataset = "EventLog." + log.Labels["Channel"].(string)
+	log.Event.Severity = m.GetInt64("Event/System/Level")
+	log.Event.ID = m.GetString("Event/System/EventRecordID")
+	log.Event.Code = m.GetString("Event/System/EventID/#text")
+	log.Event.Provider = m.GetString("Event/System/Provider/@Name")
+
+	log.Host = &Host{
+		Hostname: m.GetString("Event/System/Computer"),
+	}
+
+	log.User = &User{
+		ID: m.GetString("Event/System/Security/@UserID"),
+	}
+
+	log.Process = &Process{
+		PID: m.GetInt64("Event/System/Execution/@ProcessID"),
+		Thread: &Thread{
+			ID: m.GetInt64("Event/System/Execution/@ThreadID"),
 		},
-	), nil
+	}
+
+	return
 }
diff --git a/pkg/ecs/jumplist.go b/pkg/ecs/jumplist.go
@@ -4,7 +4,6 @@ package ecs
 import (
 	"path/filepath"
 	"strings"
-	"time"
 
 	"github.com/cuhsat/fact/internal/flog"
 )
@@ -16,60 +15,43 @@ func MapJumpList(s, src string) (log *Log, err error) {
 		return
 	}
 
-	exec := m.GetString("LocalPath", "Path")
+	exe := m.GetString("LocalPath", "Path")
 	arg := m.GetString("Arguments")
 
+	log = NewLog(s, src, &Base{
+		Timestamp: m.GetTime("LastModified", "TargetAccessed"),
+		Message:   strings.TrimSpace(exe + " " + arg),
+		Tags:      "JumpList",
+		Labels:    make(map[string]interface{}, 1),
+	})
+
+	if strings.Contains(s, "DestListVersion") {
+		log.Labels["Destination"] = "automatic"
+	} else {
+		log.Labels["Destination"] = "custom"
+	}
+
+	log.Host = &Host{
+		Hostname: m.GetString("Hostname", "MachineID"),
+		MAC:      m.GetString("MacAddress", "MachineMACAddress"),
+	}
+
 	var args []string
 
 	if len(arg) > 0 {
 		args = strings.Split(arg, " ")
 	}
 
-	timestamp := m.GetTime("LastModified", "TargetAccessed")
-	timezone, _ := timestamp.Zone()
-	message := strings.TrimSpace(exec + " " + m.GetString("Arguments"))
-
-	return NewLog(
-		src,
-		Base{
-			Timestamp: timestamp,
-			Message:   message,
-			Tags:      "JumpList",
-			Labels: map[string]interface{}{
-				"Destination": target(s),
-			},
-		},
-		Evt{
-			Timezone: timezone,
-			Created:  timestamp,
-			Ingested: time.Now().UTC(),
-			Original: s,
-			Hash:     GetHash(s),
-		},
-		Host{
-			Hostname: m.GetString("Hostname", "MachineID"),
-			Name:     m.GetString("Hostname", "MachineID"),
-			MAC:      m.GetString("MacAddress", "MachineMACAddress"),
-		},
-		User{},
-		Process{
-			EntityID:         m.GetString("AppId"),
-			Start:            timestamp,
-			Name:             filepath.Base(exec),
-			Title:            m.GetString("AppIdDescription"),
-			Executable:       exec,
-			Args:             args,
-			ArgsCount:        int64(len(args)),
-			CommandLine:      message,
-			WorkingDirectory: m.GetString("WorkingDirectory"),
-		},
-	), nil
-}
-
-func target(log string) string {
-	if strings.Contains(log, "DestListVersion") {
-		return "automatic"
-	} else {
-		return "custom"
+	log.Process = &Process{
+		EntityID:         m.GetString("AppId"),
+		Name:             filepath.Base(exe),
+		Title:            m.GetString("AppIdDescription"),
+		Executable:       exe,
+		Args:             args,
+		ArgsCount:        int64(len(args)),
+		CommandLine:      log.Message,
+		WorkingDirectory: m.GetString("WorkingDirectory"),
 	}
+
+	return
 }
diff --git a/pkg/ecs/shellbag.go b/pkg/ecs/shellbag.go
@@ -0,0 +1,26 @@
+// ECS shellbag mapping functions.
+package ecs
+
+import (
+	"github.com/cuhsat/fact/internal/flog"
+)
+
+func MapShellBag(s, src string) (log *Log, err error) {
+	m, err := flog.NewMap(s)
+
+	if err != nil {
+		return
+	}
+
+	log = NewLog(s, src, &Base{
+		Timestamp: m.GetTime("LastInteracted", "LastWriteTime"),
+		Message:   m.GetString("AbsolutePath"),
+		Tags:      "ShellBag",
+	})
+
+	log.Registry = &Registry{
+		Hive: "HKU",
+	}
+
+	return
+}