thank you good morning everybody you
guys all doing well a lot of you
hangover from last night or not because
I'm nearly there
so I don't know how these slides are
going to look up because this this
project is actually quite bright faint
yeah
so my name is Thomas I'm this is I think
the third time I'm speaking at security
the third year so I'm really happy to be
back I have a number of I've been in the
industry for a long time and one of the
things that I do is security
architecture but I also do a lot of
Incident Response and as part of that
incident response process you do a lot
of forensics and investigations and
things like that so you come in on you
go to a customer or you go you're in a
company you're doing your forensics you
come to a site there's no tooling on the
on there on the machines you know like
oh crap what am I going to do it's like
I don't want to install tools because if
I install tools I'm going to ruin
whatever I'm looking for so how do I do
this and then you just end up banging
your head against the wall because
you're thinking oh what am I gonna
do what am I going to do I so I
apologize in advance there might be some
harsh language in my talks because I
usually get really really passionate
about what I'm saying and things just
come out so I said to myself what am I
going to do well simple I'm gonna look
for build a set of requirements all
right you know part of my job is
architecture so I usually build a set of
requirements my requirements was that it
had to be non intrusive I don't want to
mess up anything on the desk or anything
in memory so I don't really want to
change anything I need to be able to
quickly deploy it because if I'm going
on a site and I want to go get ready to
business you know start get ready and
just dump out information and it has to
be in a minimal cost because if you look
at some of the toolkits that you
traditionally use like encase and stuff
like that it's quite becomes quite
expensive so I wanted something easy and
to deploy and easier to use so I also
want something that I can use not only
to do forensics but that I could use to
actually
investigations as well a la fret hunting
so I'm big into fret hunting and I
wanted something that I could use even
for just investigations before I go down
into the deep dark hole of forensics so
I came out with this PowerShell it's
like in a minute it's on Windows 7 it's
on most corporate installations it's on
all Windows servers nowadays it's just
there it's like a really powerful tool
and why is it a really powerful tool
you'd be surprised
it supports reg X so I can do really
complex searches across the desk across
the registry for example because you
have built-in functionality that allows
you to basic to query the registry
directly so you can do like a duck dear
hklm and you get the output of the local
local key machine and then you can also
add stuff to it so you can build objects
you can create data stores you can
create and you can add things like dll's
and modules and so you can extend it
quite efficiently but then I was like ah
crap if I do that I'm gonna have to
write a script I'm gonna have to install
the script and it breaks my initial
principles I don't want to change the
disk I'm like okay there's got to be a
way to get around this this is
ridiculous and thank you our friends an
elite XOR this is a common technique for
malware attacks right where you're
basically downloading a script in
directly into PowerShell memory and
you're running it out of PowerShell
memory so I'm not installing anything on
the disk like yes cool I can do this now
so now I have a tool where I can
actually build pull down things run in
the memory and I can start querying the
system which is really great so awesome
start so I've got a registry access I
can even access the event log with
PowerShell directly I got file system
access I can pump ACLs I can dump a
alternate data streams with PowerShell
it runs in memories and most distain jiz
it's generally available in Windows 7
and lots of cool useful scripts out
there so I started looking around and I
found power forensics
so I've been playing with this for a
quite a number of years now it's been
around I think for about three or four
years essentially what it does is it
gives you a full API to do your typical
disk forensics so you can dump the
prefetch files you can dump things like
ad airstreams event logs the cache is
you can dump the load lock to Timeline
with it so this is really cool ah crap
it needs a DLL to be installed oh my
that breaks my one principles I don't
want to store everything but you know
that's not gonna stop me so really there
is actually a technique in PowerShell
where you can basically dump your file
into as binary put it into a variable or
download the DLL directly into memory
like I did with the script and you can
run it directly from memory so again I
win I'm not installing anything on the
disk yay
see when you drink you've come up with
ideas not necessarily alcohol so I have
my foundations
I've got PowerShell it's good I can
bring in scripts I've got built-in
access to things like registry is Event
log and I can build objects and I can do
things so I can use it for forensics and
I could potentially use it for hunting
so I'm sitting here going ah crap what
am I gonna do now let's go hunting for
some ideas so what else can I do with
this right because now I've got just
basically scripted access and I want to
do something more
so I discover from so what is shrunk
from is Windows system resources usage
manager wanted to kind of remember when
um to a manager essentially it's- was
installed in Windows 8 it started
appearing in Windows 8 and what it does
is it monitors everything that process
and network related that accesses the UI
or runs in the UI so it's continuously
tracking what's going on in the system
right
it's part of the diagnostic policy
service I am going to be able to talk
this morning thank you
and it first appeared in forensics
discussions from a published paper
published by Yogesh Qatari so in March
2015 he wrote a paper in data science
presentation where he talks about using
shrum for forensics purposes which was
wit and it's really interesting it's a
really interesting discussion so back to
the some of the details so it's Windows
8 or above alright so that's pretty
recent that rules out Windows 7 there's
still a lot of companies with Windows 7
running so that's that's a shame it
monitors desktop and windows
applications services network
connections and historical data and it
carries a historical database so I'm
going this is really great I can really
use this this could be really useful so
what can we do with it
so it's always on by default as well and
I'm like oh wow this is cool I'm like
this is really gonna happy helpful in
terms of doing forensics work right
because if you're always on and it's on
by default you're definitely gonna have
some data in there right window
Microsoft had to make some changes a few
years ago where you can actually turn
this thing off because it does collect a
lot of data and a lot of things like
what programs are using and it's got a
lot of personal information like which
networks you log on and things like that
so you don't really so sometimes you
want to turn this off but it does kind
of slow down well it doesn't slow down
but it messes up some of the windows
reporting aspects so if there's
something if you have a bug you don't
get as much information out of it so
essentially SRAM provides us with
application resource usage windows push
notifications energy usage network
connectivity and network data usage so
all of these elements will provide us
information about what's going on on the
system or what's happened
the system because it's historical right
so how does it so what do we get from
the network well from the network we get
an interface type and an ID so we can
pull it back to like a Wi-Fi connection
or a LAN connection or a VPN connection
you have a network profile ID that will
give you things like when you connect to
Wi-Fi and if you collective say Abbott a
university you can pull that out so
you'll know all the Wi-Fi network so
that the machines been on it carries
bytes uploaded and downloaded it carries
the process consuming data including the
users CID right think about that if I
can see which process is doing the most
network activity and I know if it's
associated to user X Y Z I can start
profiling what the users doing or I can
look for non-standard accounts doing
network activity so what's one of the
key things that you're doing with
lateral movement when your X field
training s filtrate as an attacker you
basically try to create an admin user on
your machine you run a bunch of
processes and you start to export rate
data over the network so if I can now go
back and associate that with a
historical data and sieve it that
recently created admin user or a
non-standard admin user for my from way
in my environment starts uploading data
it becomes really interesting it doesn't
provide however endpoint IP addresses it
doesn't provide ports and it doesn't
really specific network activity so you
won't see things like I'm going to wwq
cool calm or I'm going to www-where what
does the application provide the
application provides essentially
everything that you need to know about
an application so CPU cycles context
switches IO reads and reads and writes
number of read operations number of
write operations number of flushes and
it also provides user information so
again if we can associate an application
being run by a user we can see who ran
the application how many I mean I where
you know when you're working in
corporate environment I know some of you
probably run into this is you sitting
there you thought you know some
somebody's run something you're sure
somebody's run something
like now I didn't run this no I didn't
run this with this I can actually
demonstrate me but the use of ran the
program because I can reassociate the
launch of of the malicious program to a
user ID and that becomes really
interesting because you can actually
tell the user wha you did actually run
this so where did you find that
application it doesn't provide memory
type information though so you won't be
able to get anything out of them that's
associated to the memory to number
Fred's number of handles so anything
like DLL injections or reflection
attacks you won't be able to see but I
don't really care about that I just want
to see what the processes have been
running and what processes have happened
they have been used by which user so
there's another aspect to which was the
application history so when you're on
Windows 10 you can actually see this if
you go into the task manager there's a
tab called application history and it
shows you all the applications sort of
run on that system and the interesting
thing is is you have a show history for
all processes and what happens when you
do that is you actually see processes
that have run over time and you can
start to see processes that have been
uninstalled or applications that have
been uninstalled because those are still
those are still in the database but it's
creating so you can see when an
application was installed say like a
dropper gets installed runs and gets
removed so you're going to see that that
process in in in this application
history which is interesting again
because how many times if you do
forensics you like looking for that
freaking application that actually
installed the malware or how they're now
I got onto the box so how does this work
well essentially the Polti Service has a
bunch of dll's
it's like five or six of them so they
all monitor things like data usage
application usage energy usage and
Windows environment information that
pushes stuff into the registry so those
dll's will type the data push it into
registry and then after
amount of time one hour to be precise
it'll be done to to the that file okay
so the first step in this is you have a
registry extension called Windows NT
current versions from extensions so you
actually see you can see that all the
dll's they're all based by greed and
under that you'll also have the
temporary data that's get stored so this
is one part you need to access and I'm
like okay this is good because I can
access this I mean power I can directly
access that the registry so I'm good I'm
still good and it gets written to disk
every 60 minutes 60 minutes the second
part of this is a database so the
database which is thought in windows
system32 s I use SIU DB that is an ESS
extensible storage engine the accessible
storage engine is essentially a database
for Windows started using - with Active
Directory Windows updates it stores all
the information that it needs to
basically run the operating system you
also find it with IE if you if you're
doing IE cache work most of it is stored
in this ESS database format in that ESS
database format you actually have a
bunch of tables one for network
connectivity data one for application
resource usage one for network usage
data windows push notification data and
energy usage so energy usage actually
covers things like how much CPU cycles
and how much power is being drawn
battery life and things like that the
one problem with these data format is
that you actually do have a lot of
fields that have weird formatting so you
have two types of time stamps which is a
pain because you have to mess around
with two times at the types of time
stamps but they're in UTC format which
is nice because usually when you're
doing forensics you want UTC format
anyway you've got a bunch of goo eats
and you've got for the network you
actually have to go back and calculate
you get a
structured data so you need to pull out
the information from that structure data
then we associate it to the registry to
actually find out which network
interface was being used that's a little
bit more complex so what's the forensics
angle to this well in forensics one of
the things you want to do is you
understand what the process activity was
you want to build a process map a
process map over time see which
processes where and when what are the
dependencies how much time was how much
time a process was used you also might
want to see where which network usage
was being used what was being done so
how many times for example Explorer
connected and how much data it uploaded
or downloaded you want to see which apps
have been added or deleted you want to
see which processes run over top over
time how many times have they run for
how long things like that and I was
thinking about this so wait a minute if
I can associate the process with
resource usage specifically power and
CPU cycles I could start looking for
miners you know all these script miners
that you've accidentally get when you go
to certain websites and they start
eating up your CPU cycles well maybe I
could use this to actually see if there
was that kind of incident on a machine
so probably something I need to do I
think about not really a focus because
most of the times yeah unless they
actually drop something like a motet I'm
not too concerned about it but it's
something in the background so typically
when you see attackers one of the things
that I'll do is I'll try to hide when
they've launched an application and the
way they do that is they mess around the
prefetch files essentially what the
prefetch file does is it allows you to
see when an application has been run so
when applications are run from it you
create it but it creates a prefetch file
so you can actually track when that
application was launched by the user but
it only shows the start time now with
Schrom you actually start to see the
visibility because you've got
points of usage you can actually see how
long were windward has actually been
running for example in this chart
example so prefetch will only give you
the last eight start times but SRAM will
actually give you how long that process
has been running which is a lot more
interesting because even if you see it
if you see a malicious app start let's
say the attackers are really bad when he
doesn't delete his prefetch file if you
see it started you also want to know how
long it's been running because it might
start and then just die right because it
doesn't connect to anywhere or it might
it starts and might hide itself and just
continue running until it actually wakes
up and download something else so having
the ability to actually build these
timelines in a more detail well as for
the type nodes for time for that process
has actually been running is a lot more
interesting other things that we can
track is we can map as I said earlier a
process for the user so you can actually
see which users are running which
processes this is helpful again because
one of the tactics is to create a
special you know an admin user so you
can see which admin users of Warnick
running which processes you can map
process the network activity so you can
actually start to look at exfiltration
windings you know one example would be
explorer upload you
copying files or uploading files
creating love network traffic at two
o'clock in the morning most users won't
do that right especially in a corporate
environment and you could use it to do
general program it usage investigation
so you know one of the things i've rent
i ran into my history and my history in
in the corporate environment is that we
weren't really blocking a white listing
applications but the policy said you
weren't allowed to use things like you
taught me you know torrent torrent
downloaders and things like that with
this you can actually track when it uses
being using torrent download azure
non-authorized software which is useful
for many large corporations especially
for especially when you have
users that have admin access to their
machines and they can install anything
so how do we access this data well the
initial thought is you need to access
the from doubt that most of the research
has been done and most of the web has
been done initially and the tool and has
one tool that came from mark baguette
basically they require you to get a copy
of the shrub DB and then download it
dump it into CSV and then process a
bunch of scripts to create into an Excel
mark Baggett's to actually does the
extraction and generates the excels
automatically there's one problem with
that and that's what I don't want to
copy the DB I don't want to have to
process the disk right I want to do this
dynamically I want to be able to do this
fast and wrap it then quickly online if
you need to make a copy of the DB
because it's admin locked and because
continuously usage by the system you
either have to shut down the machine or
you have to do a disk image or you have
to use
VSS to do a shadow copy so your basic to
once you start doing that you're
changing the environment and you're
changing things and you're probably
potentially losing any forensics
evidence which you might want to keep so
I'm like ah God another roadblock so how
am I gonna solve this well hold on a
second my initial thought was I'm gonna
use PowerShell to do all this stuff
right yeah so I'd potentially have a
solution under my hand so how am I gonna
do this
well PowerShell actually supports dotnet
right so you can actually use donate
dotnet api's and donate modules it
directly in PowerShell you can load C
libraries you could actually even
include C code in some versions of
of PowerShell and you can load dll's
directly so all you need to do basically
to add a module or to load a DLL is you
type at you do add that type - path to
the DLL and that loads it as a module
and you have access to your API is there
an API for ESS well from here yes of
course there is right so the good thing
is the DLL is part of dotnet framework
4.0 and as far as I know probably 95% of
all systems actually have got that full
point that the dotnet 4.0 installed
mostly because one of the core MFC
classes it has but has to be an
application in Windows well one of the
baseline applications in Windows will
have that requirement so the exact DLL
is in a really horrible pasture Windows
microsoft.net assembly GAC missile
Microsoft the ASM esn't got interrupt
the 4.0 and and then after the
underscore 10 is actually I think it's
related to the operating system you're
using and the file is called Microsoft
that I send or ES net or interrupt e ll
ok so I have an API to access this
database right yes I'm back to my
success factor right I'm cool no no we
won't get into that um so this is gonna
be hard and let me see if I can actually
let me do something maybe I'll be able
to actually zoom in a bit on this
let's see if this works okay so no no I
can't zoom in now crap that's gonna be I
know what I'll do I'll walk you through
the okay that's a little bit better
right can you guys see that up there is
it better so the first line I basically
I'm going to put the path to my dll into
a in turn em into a variable so for
those of you if you haven't done
PowerShell there's some interesting
things right for those of you done
Python you'll probably recognize some of
this versus done a bash programming you
probably recognize some this dollar env
is a shortcut an alias to the
environment variables so you can
actually reference the environment
variables so here I'm very fitting
system root which is on systems usually
see windows and then you have the path
to your DLL so all that will be expanded
inside the variable next I put the path
of my shrub DB and now I can start
accessing the database so essentially
the database is a jet it's you know it's
you access it with the jet jet file DB
api's so what I'm doing here is I'm
setting up some variables file type and
page size - mine mine and the - one just
says default just ignore this this value
you'll pick it up when when you read the
database so I have ad type path I'm
loading my module right
I then can start to access the database
and so what these hooks right here is
essentially how you access dotnet
classes in PowerShell right so you
basically describe the dotnet class that
you want the function and then you for
this particular thing I'm pulling out
the variable so the first command is to
get the database file info so we know
what database we have a proper database
and then we actually query the database
itself that will do that we'll dump a DB
type if you've got the right file it's a
database the page slot the actual page
size which normally is about 4096 and
the file type as well so then the next
step is like in any database you have to
basically open a session and connect to
it so here a new object basically as a
command in PowerShell allows you to
create a new variable that has an object
structure a variable of an object
structure is essentially is a very is
like it's like a JSON if you want if you
might if you know JSON you know you have
you have very variable name and the
value and it's in a blintz in a block so
you've got that blob with all these data
inside so I'm I'm opening an instance
I'm opening a session ID and then I can
start to pull out some of the system
parameters of that database you know so
I'm putting it into a temp file because
it gives out a value if you ever need to
process the value for for errors and
things like that that's what you do you
can use a temp file so then you have to
create an instance so this is a
particular reality of jet databases is
you're actually creating an instance of
a connection and then you're
initializing that connection and then
you begin your session this is well
documented in Microsoft's documentation
on the jet API once you've done that you
can actually open the database
so I'm opening the database with this
command which gives me a database ID so
from now I can use that database ID to
reference the data I can then attach the
database there's a lot of attaching and
connections in this thing then you can
open the database so now I have a
database idea session and a connect
value and I can actually write that out
so basically this is PS custom object is
is a is another way of initiating an
object the @ symbol also references an
object and then the hooks is actually
the object data structure so you see
I've got instance is equal to dollar
instance session is equal to dollar
session database ID equals dollar base
ID and then the pafter database I'll
show you some of this output in a bit so
then I can get the tables all right so
get tables names now we're back into
more you know standard types of database
manipulation right so we're gonna get
the database tables I can get the
database columns and I can get the
database rows in theory we'll get into
that a little bit so interestingly
enough you know when I first when I
talked when I mentioned that this the
dll's at the beginning and the tables at
the beginning I had like six tables
right when you don't Windows 10 you
actually have a few other tables so
interesting I wonder what data is in
there that's probably one of the things
that's one of the things that small - it
has to do to understand what those extra
tables are so how do I access these
tables well I can put the table name
which is the guiit into a variable and
then I just connect to the table in the
same way that I connected to the
database all right so I'm back my
session ID the database ID and I add the
table name so now I have a reference
pointer to my table and of course I can
connect to multiple tables at once
all right now comes the complicated part
so unlike SQL where you can do select
star from table to get all the imp data
with this API you actually have to pass
each row manually crap and the way you
do that is by column so you have to dump
one column at a time one row at a time
fun I heard the hell wrote this so here
we go I mean might as well do it we're
here now all right so you pull out the
columns get table columns and because
I'm in PowerShell I can do some really
interesting things so try first move
tells the jet API to move to the head of
the database to get to go to the first
row so now I'm gonna do it do a while
loop so do I initiate a temporary row
struck database trip data structure so I
can capture that row and now for each of
the columns in columns so columns is
that the output from their database from
the get columns so dollar column I'm
just basically grabbing one column at a
time I then need to look at the column
type which is really annoying it's okay
because you've got all of these column
types and depending on the Khans hype
you might have to manipulate the data
like down here where basically this will
i've got text unfortunately the text has
a closing zero so you have to remove
that and okay any more characters you've
got currency same thing you have to
remove more characters
then you've got some weird ones where
you basically need to convert a 64-bit
int into a date/time because that's the
what the column does or is referencing
and then sometimes you have columns that
don't have a reference type my knees
thank God
so once I have the information from that
row for all the columns I can add my
data back into my new table so I'm
basically what I'm doing is I'm
essentially copying jet data based data
into a variable in PowerShell and then
you can close that then you can close
the database so that's how you connect
to it I will try to do a demo but I've
been having problems accessing so what I
do have some screenshots so what are the
problems the first problem are an two so
I created my I connected to my database
I got the page size I got the jet I
tried to do the I got the session ID I
got everything done then I did an attach
database and windows just told me that
it actually says the cannot access
file the file is locked so luckily in
PowerShell the window actually tells you
what what account you're using or what
mode you're in I was in my standard user
account so oh no ok let's try it admin
try admin worked so once you do that I
basically now have an instance ID so jet
instance ID session ID a DB ID so DB ID
is one there's only one database in the
here as far as I know and then I the
file path so those are my references to
actually access the database
[Music]
then I can dump columns so this is one
of the new day one in new files data
tables inside we come with Windows 10
and if you look at the field names the
column names so you've got app ID you've
got audio in audio in timeline audio out
audio out time line then you got auto
Inc ID mmm com2 right dirty
comp dirty timeline so there's a lot of
information in here right and in this
table hat this table has like 25 columns
this is the network usage 1 this is a
lot easier so I've got an app ID I've
got an auto ink ID and I've got the
bytes received bytes sent the interface
the LT profile the the connection
profile ID the time stamp and the user
ID and this is what's interesting right
so I could not so say it an app a user a
time step and the amount of data that
the cop that I'm pulling in and out so
this is the application usage our table
so that so once you've run that horrible
while loop you basically get this data
right so I've got the name of the column
and a value and because there's 64-bit
values of the background psycorps time
so that's like so you need to kind of
figure that one out so a lot of
information that can process so how does
this fit into hunting well if I have
applications and I know which ones being
used and I know which ones are running
and I know who's running them I can kind
of do application profiling on the fly
if I know network usage I can start to
look for needle with network patterns
right if I baseline my environment and I
know that this I'm in the corporate
environment and most machines don't do
any network activity of it entering the
night and I starts and I pick up a
machine and it's doing network activity
over not during the night becomes
interesting
so essentially what I've come up what
I'm getting to is like a mini EDR tool
or a MIDI or like a PowerShell version
of OS query to a certain extent which is
fun I mean you know I don't need to
install anything I don't need I can just
use these commands and just start
dumping Dana off a Windows box fun the
good and the bad and the ugly so this is
still that I haven't had as much time as
I wanted to really work on this so I'm
gonna have to automate the data
processing right now I'm doing it
manually just to a lot of extent I want
to create you see how I can do this
remotely right you can actually connect
power shall remotely using win or M but
that means that you have written have to
have winner in it enabled in your
environment and I want to build a module
which I can automatically just pull and
download and install which I haven't
been able to get to you module building
is almost like building a you know an
API library form so you have to give its
own structure you have to give it
certain commands and once you've done
that you reinsert it as a module and you
have in your at your essentially adding
commands to PowerShell
there are implications on powershell
versions so most of the commands I'm
using won't work if you have a
powershell given 3.0 the windows service
does run a diagnostic policy services
but i have yet to figure out where the
from DB is there's a specific switch you
need to turn on in Windows so as to
actually get this from DB to work and
I'm still working on that one and that's
probably I probably gonna run into a
whole bunch of other issues over time
right so I will publish this code at
some time right now it's a private repo
because it's really ugly and there's a
lot of mistakes in it so I'm not gonna
if you want access to it you can come
and see me I can provide you access but
that's the URL that's how you can get in
touch with me now I want to see if I can
do a demo which is going to be
interesting you have to bear with me for
a bit
[Music]
okay so I don't think this is gonna work
but we'll try anyway
so for us I've loaded the DLL into you
cancel it okay I thought I'm a big
enough but I'll make it bigger matter so
first I loads of I basically loaded the
DLL into a variable so now I'm going to
put the database into a path as well
okay I'm gonna set my variables and pull
them up let the my joint the DLL into
the memory so now I can connect to the
date at what I can get the database
following for
[Music]
what am I missing
ah it's a problem when you're doing this
remotely okay so now the database that
the DLL and the API loaded into memory
so now I've base so what I've done right
now is I'm querying the database file to
see what the page size is so I can
actually do though the page size so just
by typing the variable name I can get it
the output so I know the page size is
4096 it's not really pertinent to what
we need to do but it's useful to have it
means you connect into the database and
you also need the information later when
you want actually connect to the
database itself and get the file type
[Music]
like a start all over again sorry
living in okay so we got page size 4096
file type of one and now I can open my
jet my database session okay so I do
have I have a session open now so if I
do a dollar session so actually I don't
so basically the dollar session when you
look at it gives you a value of true or
false is that is invalid so when it's
when it's true
it means you can't you're not connected
to the database so you can't connect to
the database for some reason so we're
not going to go very far
unfortunately if I can connect me and
see on this one so any questions while
this tries to connect was it too
this early in the morning I've been
working with it
but I haven't found anything yeah
because most of the images what I've
been looking at we're essentially clean
so I need to improve the demo on this so
probably what I'll do is I'll actually
infect a few machines and then pull out
the data and do it that way one of the
biggest problems I'm having right now is
actually processing the data because as
you saw on that screen shot earlier it's
a lot of data and it's historical data
you've if the things been running
properly you've basically got data all
the way from the start of the
installation of that Windows 10 box for
example so you can have a massive amount
of data so processing it becomes more
complex plus you have to kind of I'm
still working on pulling out the right
information to then associate it back to
the registry keys because for example
like the user ID you have to associate
it back to the user which is an index
inside the registry key so you have to
go into the registry key pull out the
user yeah you have to index it into the
registry key in the user under the user
profiles to get the actual user ID so
there's a lot of mini relations that you
have to do in the background and that's
where some of my scripts are failing
because i'm ivan pointing to the wrong
place or I'm just not referencing it
properly and just it's taking me time to
actually I basically want to have to do
1 days just draw it outright draw the
links and draw the lines together map it
out but time constraints have basically
let me down yeah
[Music]
yeah so some of the question is can I
pull all the information together to
kind say baseline your environment to
look for indicators or to pull out
indicators that is a really interesting
question and probably very hard to do
and I'll explain what because you're
actually tracking application usage like
you might use Word and PowerPoint and
Excel one way is the person to your
right may not write it may use it in a
different way or may never use Excel so
how do you baseline that across an
organization or across a pool of the
computers you can't really because
you're never going to have the same
usage patterns so what the idea I had in
the back of my mind once I figured out
all the data problems and all the
associations and how to actually pull
this dynamic because I'm having problems
with the database connectivity as well
it likely can timeout especially when
I'm trying to pull out the data I was
running it yesterday on one of my
machines and it been running for like an
hour and it was still processing the
rows okay so it's not very efficient so
I need to find a way to make it more
efficient but long term the idea would
be to maybe do something like you know
like yarrow and have a set of set of
prefix data so I can point it to point
to the script and the script will
actually go looking for those those
types of indicators right but you
wouldn't have
you could essentially build it because
you can you can use PowerShell to pull
out hashes so you could actually look
for a process with a certain hash and
then go and dive into this database and
see how many times it's run or see when
it's run how long it's run and what the
network activity was on it but it's a
very it's again it's a very complex
process and to a certain extent would
require crapload of development and but
the point is to search you missed the
point you can't build a baseline on
application usage on user application
users this user application usage you
can't build a baseline because no use it
unless you're wrote in this we're
talking about a bunch of robots you're
never going to get the same usage are we
still so essentially that's my there's
many directions this could go in but I
need to optimize the initial code first
until I optimize that initial code and
actually have a module that I can just
pull in when I need it to actually do
that that's search to do that query I'm
what I I'm not even thinking about the
possibilities to be honest but I'll note
it down and all right and I'll keep it
in mind you could so the question is why
why search in PowerShell why not drop it
to something like Spock ourselves or
upload it to your sim and things like
that you can actually so in the same way
that I can pull stuff often laughs that
often there I can actually create a
connection and do you know query an API
or post things to an API the idea was I
wanted something I mean let's be honest
Allah Oh is query right where basically
you have the ability to run some kind of
script or some kind of shell and you
could just querying dynamically on live
on that system because I'm I
it was more about finding things rather
than keeping a constant baseline or
keeping a constant inventory of what was
running on the machine because then you
mean in Europe you get into certain
shady areas on on privacy issues right
but you can detect things like browsers
running right talk connections you can
find the VPN connection will show up as
an interface in a network profile so if
anybody creates a VPN you can actually
see it I think we have time for maybe
one more two more questions top I've
probably just got I'm going to write
them I'm going to eventually write a
module but that so let me back up the
question was will I publish this module
on power on power shot gallery I'm going
to rather powers from module I'm
probably gonna leave it in github
because I don't I I want it to be
maintaining that way and if you look at
a lot of the stuff Microsoft is actually
doing around PowerShell it's all in
github now as well even you can I
actually so so for those of you who
can't you haven't seen maybe before I
actually work on a pixel book this weird
crappy so on the pixel book now you have
you have like an Ubuntu VM I actually
have PowerShell install on this because
Microsoft has open source powershell
version 6 and so if I go so I've got
how shall sex on this machine and it's a
pixel book right so they've done a lot
of that work is now in get hub and I'm
just gonna leave it there to be honest
so then people can use it the way they
want to use it cut well thanks everybody
for coming I hope you didn't get too
scared of you like the top
[Applause]