-
Notifications
You must be signed in to change notification settings - Fork 21
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* refactor: include artifacts
- Loading branch information
Showing
21 changed files
with
3,020 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,3 @@ | ||
| # config | ||
| config/artifacts/ | ||
|
|
||
| # go | ||
| vendor | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,4 @@ | ||
| artifacts: ["DefaultCollection1"] # artifact definitions to collect | ||
| user: false # optional, if true, do not request admin permissions | ||
| case: "" # optional case name | ||
| output_dir: "" # optional output directory |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| ## Artifact Definitions | ||
|
|
||
| The artifactcollector uses yaml files to define forensic artifacts it can collect. | ||
|
|
||
| The yaml files are based on the [ForensicArtifacts/artifacts](https://github.com/ForensicArtifacts/artifacts) | ||
| repository, but with the following major changes: | ||
|
|
||
| - `provides` on source level are added to enable extraction of parameters | ||
| - All source types are distinctly defined, including the `DIRECTORY` type. | ||
| - Parameter expansion and globing is defined, including `**`. | ||
| - Inconsistent trailing `\*` in REGISTRY_KEYs are removed. | ||
|
|
||
| The [Style Guide](style_guide.md) describes the full specification of the artifact definitions | ||
| how they are used in the artifactcollector. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,168 @@ | ||
| # Predefined opinionated collections | ||
|
|
||
| name: DefaultCollection1 | ||
| doc: Predefined opinionated collections | ||
| sources: | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| - 'FOR500' | ||
| - 'WindowsComputerName' | ||
| - 'WindowsEventLogs' | ||
| - 'WindowsHotfixes' | ||
| - 'WindowsNetworkInterfaceInformation' | ||
| - 'WindowsPersistence' | ||
| - 'WindowsRunKeys' | ||
| - 'WindowsServices' | ||
| - 'WindowsUninstallKeys' | ||
| - 'WindowsUSBInformation' | ||
| supported_os: [ Windows ] | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| # - 'BrowserCache' | ||
| - 'BrowserHistory' | ||
| - 'LinuxIPTablesRulesCommand' | ||
| - 'LinuxAtJobsFiles' | ||
| - 'LinuxAuditLogFiles' | ||
| - 'LinuxCronTabFiles' | ||
| - 'LinuxHostnameFile' | ||
| supported_os: [ Linux ] | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| # - 'BrowserCache' | ||
| - 'BrowserHistory' | ||
| - 'MacOSAtJobsFile' | ||
| - 'MacOSAuditLogFiles' | ||
| - 'MacOSBashHistoryFile' | ||
| - 'MacOSCronTabFile' | ||
| - 'MacOSHostsFile' | ||
| - 'MacOSLastlogFile' | ||
| - 'MacOSMiscLogFiles' | ||
| - 'MacOSRecentItemsFiles' | ||
| - 'MacOSSystemLogFiles' | ||
| - 'MacOSUserTrashFiles' | ||
| supported_os: [ Darwin ] | ||
| supported_os: [ Darwin,Linux,Windows ] | ||
| --- | ||
| # Artifacts from the SANS FOR500 course | ||
|
|
||
| name: FOR500 | ||
| doc: Windows Forensic Analysis | ||
| sources: | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| - WindowsBrowserArtifacts | ||
| - WindowsProgramExecution | ||
| - WindowsDeletedFiles | ||
| - WindowsNetworkActivity | ||
| # - WindowsFileOpening | ||
| - AccountUsage | ||
| - ExternalDevice | ||
| supported_os: [ Windows ] | ||
| --- | ||
| name: WindowsBrowserArtifacts | ||
| doc: WindowsBrowserArtifacts | ||
| sources: | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| - WindowsOpenSaveMRU | ||
| - WindowsOpenSavePidlMRU | ||
| # EmailAttachments | ||
| # SkypeMainDirectory is only for macos | ||
| # BrowserCache not collected by default | ||
| - BrowserHistory | ||
| # AdsZoneIdentifier | ||
| supported_os: [ Windows ] | ||
| --- | ||
| name: WindowsProgramExecution | ||
| doc: Program Execution | ||
| sources: | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| # UserAssist | ||
| - WindowsActivitiesCacheDatabase | ||
| - WindowsMostRecentApplication | ||
| - WindowsAppCompatCache # Shimcache | ||
| # JumpLists | ||
| - WindowsAMCacheHveFile | ||
| - WindowsSystemResourceUsageMonitorDatabaseFile | ||
| # BAM/DAM | ||
| # LastVisitedMRU | ||
| - WindowsPrefetchFiles | ||
| supported_os: [ Windows ] | ||
| --- | ||
| name: WindowsDeletedFiles | ||
| doc: Deleted Files | ||
| sources: | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| # ACMRU | ||
| # Thumbcache | ||
| # Thumbs.db | ||
| # IEEdgeFile -> WindowsBrowserArtifacts | ||
| # WordWheelQuery | ||
| - WindowsRecycleBin | ||
| # LastVisitedMRU -> WindowsProgramExecution | ||
| supported_os: [ Windows ] | ||
| --- | ||
| name: WindowsNetworkActivity | ||
| doc: Network Activity | ||
| sources: | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| - WindowsTimezone | ||
| - InternetExplorerCookiesFile | ||
| # NetworkHistory | ||
| # WLANEventLog | ||
| # BrowserSearchTerms -> WindowsBrowserArtifacts | ||
| # WindowsSystemResourceUsageMonitorDatabaseFile -> WindowsProgramExecution | ||
| supported_os: [ Windows ] | ||
| # --- | ||
| # name: WindowsFileOpening | ||
| # doc: File Opening | ||
| # sources: | ||
| # - type: ARTIFACT_GROUP | ||
| # attributes: | ||
| # names: | ||
| # # WindowsOpenSaveMRU -> WindowsBrowserArtifacts | ||
| # # RecentFiles | ||
| # # JumpLists -> WindowsProgramExecution | ||
| # # ShellBags | ||
| # # LNKFiles | ||
| # # WindowsPrefetchFiles -> WindowsProgramExecution | ||
| # # LastVisitedMRU -> WindowsProgramExecution | ||
| # # IEEdgeFile -> WindowsBrowserArtifacts | ||
| # # OfficeRecentFiles | ||
| # supported_os: [Windows] | ||
| --- | ||
| name: AccountUsage | ||
| doc: Account Usage | ||
| sources: | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| - WindowsSystemRegistryFiles | ||
| - WindowsXMLEventLogSecurityFile | ||
| supported_os: [ Windows ] | ||
| --- | ||
| name: ExternalDevice | ||
| doc: External Device | ||
| sources: | ||
| - type: ARTIFACT_GROUP | ||
| attributes: | ||
| names: | ||
| # KeyIdentification | ||
| - WindowsSetupApiLogs | ||
| # User | ||
| # PnPEvents | ||
| # VolumeSerialNumber | ||
| # DriverLetter | ||
| # LNKFiles -> WindowsFileOpening | ||
| supported_os: [ Windows ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # Linux specific artifacts. | ||
|
|
||
| name: LinuxIPTablesRulesCommand | ||
| doc: List IPTables rules. | ||
| sources: | ||
| - type: COMMAND | ||
| attributes: | ||
| args: [ "-L", "-n", "-v" ] | ||
| cmd: /sbin/iptables | ||
| supported_os: [ Linux ] | ||
| --- | ||
| name: LinuxAtJobsFiles | ||
| doc: Linux at jobs. | ||
| sources: | ||
| - type: FILE | ||
| attributes: { paths: [ '/var/spool/at/*' ] } | ||
| supported_os: [ Linux ] | ||
| --- | ||
| name: LinuxAuditLogFiles | ||
| doc: Linux audit log files. | ||
| sources: | ||
| - type: FILE | ||
| attributes: { paths: [ '/var/log/audit/*' ] } | ||
| supported_os: [ Linux ] | ||
| --- | ||
| name: LinuxCronTabFiles | ||
| doc: Crontab files. | ||
| sources: | ||
| - type: FILE | ||
| attributes: | ||
| paths: | ||
| - '/etc/crontab' | ||
| - '/etc/cron.d/*' | ||
| - '/var/spool/cron/**' | ||
| supported_os: [ Linux ] | ||
| --- | ||
| name: LinuxHostnameFile | ||
| doc: Linux hostname file. | ||
| sources: | ||
| - type: FILE | ||
| attributes: { paths: [ '/etc/hostname' ] } | ||
| supported_os: [ Linux ] | ||
| --- | ||
| name: LinuxPasswdFile | ||
| doc: | | ||
| Linux passwd file. | ||
| A passwd file consist of colon separated values in the format: | ||
| username:password:uid:gid:full name:home directory:shell | ||
| sources: | ||
| - type: FILE | ||
| attributes: { paths: [ '/etc/passwd' ] } | ||
| provides: | ||
| - key: users.homedir | ||
| regex: '.*:(.*?):.*' | ||
| supported_os: [ Linux ] | ||
| --- | ||
| name: LinuxHomePath | ||
| doc: Users directories in /home | ||
| sources: | ||
| - type: PATH | ||
| attributes: { paths: [ '/home/*' ] } | ||
| provides: | ||
| - key: users.homedir | ||
| supported_os: [ Linux ] |
Oops, something went wrong.