// 01Executive summary
This report details critical Windows 10 forensic artifacts essential for immediate post-compromise analysis and enhancing detection capabilities. Key data sources like ActivitiesCache.db, Background Activity Monitor, RecentApps, SRUM, and Amcache provide granular insights into application execution, user activity, network connections, and file access. Incident responders can leverage these artifacts to rapidly identify suspicious processes, reconstruct attack timelines, and pinpoint malicious activity on compromised endpoints. Understanding these forensic data points is crucial for developing effective threat hunting queries and improving the speed and accuracy of incident response operations against modern Windows 10 threats.
// 02Key metrics
// ttps
0
ATT&CK techniques
// iocs
23
indicators
// actors
0
threat groups
// kwords
10
keywords
// 03MITRE ATT&CK
// no techniques extracted
// 04Threat actors
// no actors matched
// 05Indicators of compromise
// ips0
none
// domains10
- ntext.user
- srudb.dat
- swapfile.sys
- sample.vmem
- dfir.org
- volexity.com
- introducing-wxtcmd.html
- available-artifacts-evidence-of.html
- truecrypt-master-key-extraction-and.html
- the-secret-to-64-bit-windows-8-and-2012.html
// urls13
- https://binaryforay.blogspot.com/2018/05/introducing-wxtcmd.html
- https://salt4n6.com/2018/05/03/windows-10-timeline-forensic-artefacts/amp/
- https://cclgroupltd.com/windows-10-timeline-forensic-artefacts/
- https://blog.1234n6.com/2018/10/available-artifacts-evidence-of.html
- https://www.andreafortuna.org/2018/05/23/forensic-artifacts-evidences-of-program-
- https://df-stream.com/2017/10/recentapps/
- https://blog.nviso.be/2018/01/09/windows-credential-guard-mimikatz/
- https://df-stream.com/2017/08/memory-acquisition-and-virtual-secure/
- https://volatility-labs.blogspot.com/2014/01/truecrypt-master-key-extraction-and.html
- https://pulsesecurity.co.nz/articles/TPM-sniffing
- https://www.dfrws.org/sites/default/files/session-files/pres-in_lieu_of_swap_-
- https://www.howtogeek.com/319933/what-is-memory-compression-in-windows-10/
- https://volatility-labs.blogspot.com/2014/01/the-secret-to-64-bit-windows-8-and-2012.html
// sha2560
none
// md50
none
// emails0
none
// cves0
none
// 06Geographic coverage
// 07YARA rule
```yara
rule TH_Windows10_DFIR_Research_202310 {
meta:
author = "YARA Expert"
date = "2023-10-27"
description = "Detects artifacts related to Windows 10 DFIR analysis, research, or tools, based on identified domains, URLs, and text patterns. This rule targets documents, presentations, or binaries discussing or utilizing these concepts."
reference = "Contextual IOCs provided by user"
tlp = "WHITE"
severity = "MEDIUM" // Indicates potential research material or tools, not necessarily direct malware execution.
strings:
// Network Indicators - Domains (ASCII and Wide)
// Note: Some listed domains resemble filenames; they are included as per prompt's classification.
$network_domain_ntext_user_ascii = "ntext.user" ascii nocase
$network_domain_ntext_user_wide = "ntext.user" wide nocase
$network_domain_srudb_dat_ascii = "srudb.dat" ascii nocase
$network_domain_srudb_dat_wide = "srudb.dat" wide nocase
$network_domain_swapfile_sys_ascii = "swapfile.sys" ascii nocase
$network_domain_swapfile_sys_wide = "swapfile.sys" wide nocase
$network_domain_sample_vmem_ascii = "sample.vmem" ascii nocase
$network_domain_sample_vmem_wide = "sample.vmem" wide nocase
$network_domain_dfir_org_ascii = "dfir.org" ascii nocase
$network_domain_dfir_org_wide = "dfir.org" wide nocase
// Network Indicators - URLs (ASCII and Wide)
$network_url_binaryforay_ascii = "https://binaryforay.blogspot.com/2018/05/introducing-wxtcmd.html" ascii nocase
$network_url_binaryforay_wide = "https://binaryforay.blogspot.com/2018/05/introducing-wxtcmd.html" wide nocase
$network_url_salt4n6_ascii = "https://salt4n6.com/2018/05/03/windows-10-timeline-forensic-artefacts/amp/" ascii nocase
$network_url_salt4n6_wide = "https://salt4n6.com/2018/05/03/windows-10-timeline-forensic-artefacts/amp/" wide nocase
$network_url_cclgroupltd_ascii = "https://cclgroupltd.com/windows-10-timeline-forensic-artefacts/" ascii nocase
$network_url_cclgroupltd_wide = "https://cclgroupltd.com/windows-10-timeline-forensic-artefacts/" wide nocase
// Unique Text Patterns from provided sample and context
$string_text_volexity_session = "Volexity Cyber Sessions September 2019" ascii nocase
$string_text_dfir_challenges = "Windows 10 DFIR and InfoSec Challenges" ascii nocase
$string_text_andrew_case = "Andrew Case" ascii nocase
$string_text_attrc = "@attrc" ascii nocase
$string_text_activitiescache_db = "ActivitiesCache.db" ascii nocase
$string_text_waas_pain = "WAAS = IT & InfoSec Pain" ascii nocase
$string_text_waas_service = "Windows as a Service (WAAS)" ascii nocase
$string_text_filesystem_analysis = "Windows 10 File System Analysis" ascii nocase
$string_text_last_version = "Windows 10 is the LAST Version of Windows" ascii nocase
$string_text_volexityinc = "VolexityInc" ascii nocase
$string_text_binaryforay_domain = "binaryforay.blogspot.com" ascii nocase // Extracted from URL for broader matching
$string_text_salt4n6_domain = "salt4n6.com" ascii nocase // Extracted from URL for broader matching
$string_text_cclgroupltd_domain = "cclgroupltd.com" ascii nocase // Extracted from URL for broader matching
$string_text_windows10 = "Windows 10" ascii nocase // More generic, but common in the context
$string_text_dfir = "DFIR" ascii nocase // More generic, but common in the context
// File Paths (ASCII and Wide) - Note: C:\Users\ is very generic, use with caution in condition
$string_filepath_users_ascii = "C:\\Users\\" ascii nocase
$string_filepath_users_wide = "C:\\Users\\" wide nocase
condition:
// Rule triggers if any of the following conditions are met:
// 1. At least 3 distinct network indicators (domains or URLs, ASCII or Wide) are found.
// 2. At least 6 distinct specific text patterns are found.
// 3. A combination of at least 1 network indicator and 4 specific text patterns are found.
// 4. The generic "C:\Users\" path is found along with at least 5 specific text patterns,
// providing strong contextual evidence for the path.
(3 of ($network_domain_*, $network_url_*)) or
(6 of ($string_text_*)) or
(1 of ($network_domain_*, $network_url_*) and 4 of ($string_text_*)) or
(1 of ($string_filepath_*) and 5 of ($string_text_*))
}
```
// 08Keywords
{'keyword': 'volexity', 'score': 15.95}
{'keyword': 'https', 'score': 14.729}
{'keyword': 'windows', 'score': 12.6937}
{'keyword': 'com', 'score': 12.4415}
{'keyword': '10', 'score': 7.5684}
{'keyword': 'windows 10', 'score': 6.1278}
{'keyword': 'memory', 'score': 6.0204}
{'keyword': '2019', 'score': 4.9283}
{'keyword': 'sessions', 'score': 4.7622}
{'keyword': 'cyber', 'score': 4.6848}