EnCE · Domain 5
Registry and System Artifacts
About 12% of the exam
Registry structure
- Hive
- one binary file holding a branch
- Key
- container carrying a last write time
- Value
- named data with no timestamp
- Subkey
- nested container beneath a key
- Transaction log
- pending changes not yet merged
- Backup copy
- earlier hive kept by the system
Keys carry the write time, values do not, so date a change by the key that contains it
Hives and their scope
- System hive
- devices, services and time zone
- Software hive
- installed programs and machine settings
- Accounts hive
- local users and logon counts
- Security hive
- policy and cached secrets
- User hive
- per account preferences and activity
- Class hive
- shell state and registrations
Persistence locations
- Run keys in machine and user hives
- Service entries with their image paths
- Scheduled task definitions and triggers
- Startup folder shortcuts and scripts
- Logon script and shell replacement values
- Component registrations pointing at odd paths
Execution artifacts
- Prefetch
- run count and recent execution times
- Compatibility cache
- seen by the subsystem, modified time
- Application inventory
- path, size and file hash
- Interactive launch counter
- user started it from the shell
- Background activity keys
- last execution time per account
- Resource usage database
- hourly bytes and processor time
Not every execution artifact proves execution: some prove only that the file was seen
Reading Windows event logs
Logon and access
- Successful and failed logon records
- Logon type distinguishes console from network
- Explicit credential use marks a pivot
- Special privileges assigned at logon
System changes
- Service installation with image path
- Service state transitions
- Task created and task executed
- System time changed by an account
Interpretation care
- Definitions vary between builds
- Record the exact version examined
- A cleared log is itself an event
- Forwarded copies may outlive the local log
Devices and removable media
- Device keys record vendor and serial
- First and last connection times are recorded
- Volume identifiers link media to artifacts
- Drive letter assignments are stored per user
- Absence of an entry does not prove absence
- Cross check against shortcut and shell records
Network and location traces
- Network profiles record first connection time
- Wireless profiles list remembered networks
- Two systems will differ on first join times
- Mapped drive entries sit in the user hive
- Firewall rule changes are recorded
- Proxy settings can reveal redirection
Identity and accounts
- Account identifier
- stable even if the name changes
- Profile path
- where the account's files live
- Last logon
- recorded per local account
- Group membership
- privilege the account carried
- Account creation
- logged when auditing is enabled
- Password change
- timestamp stored with the account
Time and system configuration
- Record the time zone before reading timestamps
- Daylight settings affect displayed times
- Computer name identifies the machine in logs
- Installed operating system build matters
- Update history dates the system state
- Report timestamps with their zone attached
A timestamp without a time zone cannot be aligned with any other system in the case
Recovering earlier registry states
Sources
- Transaction logs holding uncommitted changes
- Automatic backup copies of hives
- Snapshots containing older hive versions
- Backup images predating the incident
What they show
- Values later deleted by the attacker
- Narrower window for when a change landed
- Configuration as it stood earlier
- Persistence removed before collection
Handling
- Merge logs before parsing where needed
- Note which source produced each value
- Compare live and snapshot copies
- Record the tool and version used
Limits and caveats
- Default values may never have been used
- Caches have size limits and evict entries
- Absence proves nothing on its own
- Portable applications register no uninstall entry
- Cleaner utilities remove artifacts wholesale
- Interpretation depends on the exact build
Reporting system artifacts
- Name the hive each value came from
- Give the key path and the write time
- State whether the value is a default
- Cite the corroborating artifact for each claim
- Separate what is recorded from what it implies
- List the artifacts checked and found empty
Key artifacts
- Key write time
- when that container last changed
- Service image path
- what a persistent service launches
- Device serial
- identifies the specific removable media
- Profile list
- accounts that used this machine
- Time zone setting
- context for every recorded timestamp
- Task trigger
- when and why an action runs
Know the order
- Fix the time zone
- Identify the accounts
- Map persistence locations
- Prove execution
- Recover earlier states
- Corroborate and report
Establish who the accounts were before any artifact can be tied to a person
Reference strip: system artifacts
Hives
- System, software and security
- Local accounts database
- Per user preference hives
- Shell class registrations
Execution
- Prefetch run counts
- Compatibility cache entries
- Application inventory hashes
- Background activity timestamps
Persistence
- Run keys and services
- Scheduled tasks with triggers
- Startup folder items
- Component registration entries
Devices and networks
- Removable device serials
- First and last connection times
- Network and wireless profiles
- Mapped drives per user
Caveats
- Values may be untouched defaults
- Caches evict older entries
- Definitions differ across builds
- Absence is not proof
Quick exam traps
- Trap: Registry values carry their own timestamps
- Trap: A missing device entry proves nothing was ever connected
- Trap: Presence of a value proves the user configured it
- Trap: Compatibility cache entries record execution times
- Trap: Two machines on one network share first connection times
- Trap: Event identifier meanings are identical across every build
- Trap: Deleted registry keys cannot be recovered at all
cybercertprep.com · original revision sheet written from the public body of knowledge