SRUM forensics. Yogesh Khatri Champlain College

Transcription

1 RUM forensics Yogesh Khatri Champlain College

2 What is RUM? ystem Resource Usage Monitor First seen in Windows 8 Part of Diagnostic Policy ervice Technology that monitors desktop application programs, services, windows apps and network connections Maintains database of historical activity!

3 ystem Resource Usage Monitor Network Connectivity Network Data usage Application Resource usage Windows push notifications Energy usage

4 Network Connectivity & usage

5 Network Connectivity RUM tracks periods of network connectivity (since 8.1) Items tracked Interface Type & ID Network Profile ID Time connection established Length of time connected

6 Network connectivity tracking ABcorp NetgearWootFi HiltonGuestWifi T-mobile3G

7 Network Usage Information available Application/ervice/App consuming data User ID Bytes Uploaded & Downloaded Interface Type & ID Network Profile ID NOT available Endpoint info (IP addresses, Port numbers) pecific data information (what was downloaded?)

8 Application Resource tracking Process Information CPU cycles Context switches I/O bytes read/written Number of read operations Number of write operations Number of Flushes User Information ID of user who launched program NOT available Memory, Threads, Handles, Cache or Kernel info

9 App History Both App & Desktop Application history To view Desktop Application history View how history for all processes Uninstalled Processes are all programs no longer on disk (in their original locations)

10 Data Collection Written once every hour and at shutdown Extensions monitor and collect data RUM Extension GUID DLL in ystem32 Windows Network Data Usage Monitor {973F5D5C-1D BE8E-24B94231A174} nduprov.dll Windows Push Notifications (WPN) Provider {d10ca2fe-6fcf-4f6d-848e-b2e99266fa86} wpnsruprov.dll Application Resource Usage Provider {d10ca2fe-6fcf-4f6d-848e-b2e99266fa89} appsruprov.dll Windows Network Connectivity Usage Monitor {DD6636C E-22C046A43763} ncuprov.dll Energy Usage Provider {fee4e14f-02a b5ce-5fa2da202e37} energyprov.dll

11 RUM data in registry Registry is temporary location for holding data Data is periodically moved to RUDB.dat HKLM\OFTWARE \Microsoft\Windows NT\CurrentVersion\ RUM\Extensions

12 RUM Database EE database on disk C:\Windows\ystem32\sru\RUDB.dat EE is Extensible torage Engine Windows Updates, Active Directory, Windows earch, IE11,.. Database Table Name {DD6636C E-22C046A43763} {D10CA2FE-6FCF-4F6D-848E-B2E99266FA89} {973F5D5C-1D BE8E-24B94231A174} {D10CA2FE-6FCF-4F6D-848E-B2E99266FA86} {FEE4E14F-02A B5CE-5FA2DA202E37} {FEE4E14F-02A B5CE-5FA2DA202E37}LT Description Network Connectivity data Application Resource usage data Network usage data Windows Push Notification data Energy usage data Energy usage data

13 Raw data Network data usage

14 Data needing interpretation/conversion Timestamps are in UTC in OLE format (64 bits) and FILETIME format (64 bits) Network interfaces are specified as InterfaceLuid (NET_LUID) typedef union _NET_LUID { ULONG64 Value; struct { ULONG64 Reserved :24; ULONG64 NetLuidIndex :24; ULONG64 IfType :16; } Info; } NET_LUID, *PNET_LUID; IfType can be WiFi (802.11), Ethernet, ATM, 4G or one of several other values

15 Resolving network profile from L2ProfileId field Lookup HKLM\OFTWARE\Microsoft\Wlanvc\Interfaces\{Int erfaceguid}\profiles\{profileguid}

16 Reading RUM data 1. Use libesedb ( to convert EE database tables to csv format 2. Use script available at to Resolve Foreign keys, parse InterfaceLuids and timestamps from tables Parse Network profiles from registry Read and parse RUM data from registry

17 Parsed/Resolved data Network data usage

18 Forensic Uses User-Process mapping Which user launched the process? Network statistics Data upload/download per network and per process RUM Data Application run times can be estimated Deleted/Uninstalled/External program tracking

19 Estimate Process Run time Prefetch file records start time of process, not duration Prefetch RUM RUM RUM RUM Estimated duration for Winword.exe Known Unknown

20 Estimate Process Run time Prefetch only retains last 8 start times, no record of prior runs RUM can tell you if an app was run or not RUM RUM RUM RUM Possible duration for Winword.exe? Known Unknown

21 Typical Data Theft scenario Employee downloads a lot of data from the intranet just before leaving the company

22 Investigate Program usage Program run approx. timespan (precision is one hour) Identify User who launched program Identify network & Profile used Get Data statistics How much data uploaded & downloaded? Detailed Process tats CPU cycles Context switches I/O bytes read/written Number of read operations Number of write operations Number of Flushes

23 Questions? Thanks for listening! Link to paper Forensic Implications of RUM in windows Contact info: [email protected]