akde/infosec

Information security is ultimately about managing risk

Detecting Execution traces on Windows

Goal: See on a system if some specific executeable was executed.

Check prefetch files
- See Forensic/Analyze blog post
- Look into Windows\Prefetch directory or create a access timeline and scan for .pf files.
- Example with WinPrefetchView:
  WinPrefetchView.exe /folder "C:\...\Prefetch" /scomma sorted_by_mtime.csv /sort "Modified Time"
  This creates a CSV file where we can see all executions of all files for which we have extracted the .pf files.
- To see more information about a specific execution: Take the .pf file an analyze it with PECmd:
  PECmd.exe -f suspect.pf
  This returns a lot of execution information.
SRUM System Resource Usage Monitor
- Stores some runtime information
- In HKLM\Software\Microsoft\WindowsNT\CurrentVersion\SRUM\Extensions or persisted on \System32\sru\SRUDB.dat
- SRUM-DUMP2 or ScrumECmd can be used for analysis

You must be logged in to post a comment.

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';