Mastering Windows Network Forensics and Investigation Chapter 9: Registry Evidence

August 28, 2015 © Wiley Inc All Rights Reserved 2 Chapter Topics: Evidence in Software Key Security Center & Firewall Settings Restore Point Registry Hive Files Security Identifiers User Activities

August 28, 2015 © Wiley Inc All Rights Reserved 3 Chapter Topics: LSA Secrets IP Addresses Time Zone Offsets Startup Locations Auditing Settings (Bonus material not in text!)

August 28, 2015 © Wiley Inc All Rights Reserved 4 Evidence in Software Key: HKLM\SOFTWARE %SystemRoot%\system32\config\software Installed software Other locations for installed software –HKLM\SOFTWARE\Microsoft\Windows\CurrentVersio n\App Paths –HKLM\SOFTWARE\Microsoft\Windows\CurrentVersio n\Uninstall

August 28, 2015 © Wiley Inc All Rights Reserved 5 Evidence in Software Key: Last Logon –HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Banners –HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

August 28, 2015 © Wiley Inc All Rights Reserved 6 Security Center & Firewall Settings: Security Center –Advises user if firewall off, anti-virus not installed or out of date, or if updates not turned on or out of date –Settings stored in HKLM\SOFTWARE\Microsoft\Security Center

August 28, 2015 © Wiley Inc All Rights Reserved 7 Security Center Settings: ValueDataDescription AntiVirusDisableNotify0User will be notified. 1User will not be notified. FirewallDisableNotify0User will be notified. 1User will not be notified. UpdatesDisableNotify0User will be notified. 1User will not be notified.

August 28, 2015 © Wiley Inc All Rights Reserved 8 Security Center & Firewall Settings: Windows Firewall –Released with XP Service Pack 2 –Firewall is on by default –Powerful logging utility, but is off by default Settings stored in registry –HKLM\CurrentControlSet\Services\Shared Access\Parameters\FirewallPolicy

August 28, 2015 © Wiley Inc All Rights Reserved 9 Firewall Settings: Settings stored in registry –Subkey “DomainProfile” for domain –Subkey “StandardProfile” for local machine –Subkeys under each of the above: “AuthorizedApplications “ “GloballyOpenPorts” –Subkey under each of the above: “List” – lists settings in plain text

August 28, 2015 © Wiley Inc All Rights Reserved 10 Restore Point Registry Hive Files: Restore points started with XP / ME Snapshot of system files taken every 24 hrs or when software installed, update installed, or when unsigned driver installed – User can create! Stored for up to 90 days if disk space available

August 28, 2015 © Wiley Inc All Rights Reserved 11 Restore Point Registry Hive Files: Settings stored in registry at: –HKLM\Software\Microsoft\WindowsNT \CurrentVersion\SystemRestore Restore points stored in –C:\System Volume Information\restore{GUID}\RP## –## is sequentially numbered restore points

August 28, 2015 © Wiley Inc All Rights Reserved 12 Restore Point Registry Hive Files: Registry hive files stored under snapshot folder and are renamed Hive File NameRestore Point Hive Filename SAM_REGISTRY_MACHINE_SAM SECURITY_REGISTRY_MACHINE_SECURITY SOFTWARE_REGISTRY_MACHINE_SOFTWARE SYSTEM_REGISTRY_MACHINE_SYSTEM NTUSER.DAT_REGISTRY_USER_NTUSER_SID

August 28, 2015 © Wiley Inc All Rights Reserved 13 Security Identifiers: SID is a security identifier SID is a unique identifier in that no two SIDs Windows grants or denies access and privileges to system objects based on access control lists (ACLs), which in turn use the SID asa means of identifying users, groups, and machines, since each has its own unique SID

August 28, 2015 © Wiley Inc All Rights Reserved 14 Security Identifiers: SID’s to User mapping is stored in SAM for a local logon In a domain, SID to User resolution is stored in Active Directory on Domain Controller Backdoor to resolving SID to User in a domain setting at key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

August 28, 2015 © Wiley Inc All Rights Reserved 15 User Activities: NTUSER.DAT contains user specific settings about installed software Protected Storage System Provider contains encrypted values for MSIE “Autocomplete” and stored user names and passwords MRU’s “most recently used” –RunMRU –MRUList

August 28, 2015 © Wiley Inc All Rights Reserved 16 User Activities: HKCU\Software\Microsoft\Windows\Curr entVersion\Explorer\RecentDocs HKCU\Software\Google\NavClient\1.1\Hi story HKCU\Software\Yahoo\Companion\Sear chHistory HKCU\Software\Microsoft\Internet Explorer\TypedURLs

August 28, 2015 © Wiley Inc All Rights Reserved 17 User Activities: UserAssist key –HKCU\Software\Microsoft\Windows\Current Version\Explorer\UserAssist\{ EF1F-11D DEACF9}\Count –Value names stored in ROT13 –16 byte data string –2nd dWord value is count starting at 5, with first value being hex 06 –Last eight bytes 64 bit Windows timestamp indicating last time user launched

August 28, 2015 © Wiley Inc All Rights Reserved 18 LSA Secrets: LSA stands for Local Security Authority SECURITY\Policy\Secrets Contains security information regarding various service accounts and other accounts necessary for Windows and is stored by the service control manager Tools to extract: –Lsadump2.exe –Cain

August 28, 2015 © Wiley Inc All Rights Reserved 19 IP Addresses: Stored in registry HKLM\SYSTEM\CurrentControlSet\Servi ces\Tcpip\Parameters\Interfaces Subkeys are interfaces and appear with GUID names Static vs DHCP addresses

August 28, 2015 © Wiley Inc All Rights Reserved 20 Time Zone Offsets: NTFS stores timestamps in GMT (UT) Windows displays to user based on local host time zone offset. Time zone offset stored in registry –HKLM\SYSTEM\CurrentControlSet\Control \TimeZoneInformation

August 28, 2015 © Wiley Inc All Rights Reserved 21 Startup Locations: Many locations within Windows where programs or code runs with Windows boot, user logon, etc Registry alone contains dozens of locations and methods Windows configuration files can also be used to run code List of these locations is extensive

August 28, 2015 © Wiley Inc All Rights Reserved 22 Startup Locations: Often you’ll know what the bad code is and its file name – when this is known easier to search registry and Windows configuration files for file name When unknown, use tools such as –EnCase EnScript Case Processor>Scan Registry >AutoStart –Autoruns by Sysinternals

Where are auditing settings stored? In most cases you won’t be able to open the LSS applet to determine auditing level on live system Stored in registry hive file “security” Key: SECURITY\Policy\PolAdtEv

SECURITY\Policy\PolAdtEv

Byte Offset Description 0000 No Auditing / 01 Auditing 04System Events Audit Setting 08Logon Events Audit Setting 12Object Access Audit Setting 16Privilege Use Audit Setting 20Process Tracking Audit Setting 24Policy Change Audit Setting 28Account Management Audit Setting 32Directory Service Access Audit Setting 36Account Logon Audit Setting Byte Value Audit Setting 00No Auditing 01Audit Successes 02Audit Failures 03Audit Success & Failures