Mastering Windows Network Forensics and Investigation Chapter 9: Registry Evidence

Evidence in Software Key: HKLM\SOFTWARE %SystemRoot%\system32\config\software Installed software Other locations for installed software –HKLM\SOFTWARE\Microsoft\Windows\CurrentVersio n\App Paths –HKLM\SOFTWARE\Microsoft\Windows\CurrentVersio n\Uninstall

Evidence in Software Key: Last Logon –HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Banners –HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Action Center & Firewall Settings: Action Center –Advises user if firewall off, anti-virus not installed or out of date, or if updates not turned on or out of date –Settings stored in: HKLM\SOFTWARE\Microsoft\Security Center OR HKCU\SOFTWARE\Microsoft\ Windows\CurrentVersion\ActionCenter

Windows XP Security Center Settings: ValueDataDescription AntiVirusDisableNotify0User will be notified. 1User will not be notified. FirewallDisableNotify0User will be notified. 1User will not be notified. UpdatesDisableNotify0User will be notified. 1User will not be notified.

Windows 7 Action Center Settings: Key NameFunction 100Virus protection 101Network firewall 102Spyware and related protection 103Windows updates 104Internet security alerts Registry Key Prefix Description Notification Disabled Notification Enabled

Security Center & Firewall Settings: Windows Firewall –Released with XP Service Pack 2 –Firewall is on by default –Powerful logging utility, but is off by default in Windows XP Settings stored in registry –HKLM\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPoli cy

Firewall Settings: Settings stored in registry –Subkey “DomainProfile” for domain –Subkey “StandardProfile” for local machine –Subkeys under each of the above: “AuthorizedApplications “ “GloballyOpenPorts” –Subkey under each of the above: “List” – lists settings in plain text

Restore Point Registry Hive Files: Restore points started with XP / ME Snapshot of system files taken every 24 hrs or when software installed, update installed, or when unsigned driver installed – User can create! Stored for up to 90 days if disk space available

Restore Point Registry Hive Files: Settings stored in registry at: –HKLM\Software\Microsoft\WindowsNT \CurrentVersion\SystemRestore Restore points stored in –C:\System Volume Information\restore{GUID}\RP## –## is sequentially numbered restore points

Restore Point Registry Hive Files: Registry hive files stored under snapshot folder and are renamed Hive File NameRestore Point Hive Filename SAM_REGISTRY_MACHINE_SAM SECURITY_REGISTRY_MACHINE_SECURITY SOFTWARE_REGISTRY_MACHINE_SOFTWARE SYSTEM_REGISTRY_MACHINE_SYSTEM NTUSER.DAT_REGISTRY_USER_NTUSER_SID

Volume Shadow Copy Service Greater number of file types are tracked in VSC – Entire Volume! Every file that changed since the last snapshot is included in VSC restore point Still located in System Volume Information folder but with different name

Volume Shadow Copy Service Registry key tracking the monitored volumes: HKLM\Software\Microsoft\WindowsNT\CurrentVersion\SPP \Clients\{09F7EDC5-294E-4180-AF6A-FB0E6A0E9513} Access VSC by using vssadmin command and creating symbolic link The conduct analysis as if the data was it’s own logical volume

Security Identifiers: SID is a security identifier SID is a unique identifier in that no two SIDs Windows grants or denies access and privileges to system objects based on access control lists (ACLs), which in turn use the SID as a means of identifying users, groups, and machines, since each has its own unique SID

Security Identifiers: SID’s to User mapping is stored in SAM for a local logon In a domain, SID to User resolution is stored in Active Directory on Domain Controller Backdoor to resolving SID to User in a domain setting at key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

User Activities: NTUSER.DAT contains user specific settings about installed software For pre-IE7, Protected Storage System Provider contains encrypted values for MSIE “Autocomplete” and stored user names and passwords For post-IE7 autocomplete information is stored in IntelliForms –HKCU\Software\Microsoft\Internet Explorer\IntelliForms\

User Activities: MRU’s “most recently used” –RunMRU –MRUList HKCU\Software\Microsoft\Windows\Curr entVersion\Explorer\RecentDocs HKCU\Software\Microsoft\Internet Explorer\TypedURLs

User Activities: UserAssist key –HKCU\Software\Microsoft\Windows\Current Version\Explorer\UserAssist –Value names under “Count” stored in ROT13 –2nd dWord value is count starting at 5 (Windows XP, Vista, 2003, 2008) or 1 (Windows 7) –Last eight bytes 64 bit Windows timestamp indicating last time user launched

LSA Secrets: LSA stands for Local Security Authority SECURITY\Policy\Secrets Contains security information regarding various service accounts and other accounts necessary for Windows and is stored by the service control manager Tools to extract: –Lsadump2.exe –Cain

IP Addresses: Stored in registry HKLM\SYSTEM\CurrentControlSet\Servi ces\Tcpip\Parameters\Interfaces Subkeys are interfaces and appear with GUID names Static vs Dynamic addresses

Time Zone Offsets: NTFS stores timestamps in GMT Windows displays time to user based on local host time zone offset. Time zone offset stored in registry –HKLM\SYSTEM\CurrentControlSet\Control \TimeZoneInformation

Startup Locations: Many locations within Windows where programs or code runs with Windows boot, user logon, etc Registry alone contains dozens of locations and methods Windows configuration files can also be used to run code List of these locations is extensive

Startup Locations: If you know what the bad code is and its file name it’s easier to search registry and Windows configuration files for file name When unknown, use tools such as –EnCase Scan Registry Enscript –Autoruns by Sysinternals

Where are auditing settings stored? In most cases you won’t be able to open the LSS applet to determine auditing level on live system Stored in registry: HKLM\SECURITY\Policy\PolAdtEv