{"id":4658,"date":"2025-03-18T16:24:38","date_gmt":"2025-03-18T15:24:38","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=4658"},"modified":"2025-03-19T09:10:19","modified_gmt":"2025-03-19T08:10:19","slug":"detecting-execution-traces-on-windows","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=4658","title":{"rendered":"Detecting Execution traces on Windows"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Goal: See on a sys\u00adtem if some spe\u00adcif\u00adic exe\u00adcute\u00adable was executed.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check prefetch files&nbsp;<ul class=\"wp-block-list\">\n<li>See <a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=1132\" data-type=\"post\" data-id=\"1132\">Forensic\/Analyze blog&nbsp;post<\/a><\/li>\n\n\n\n<li>Look into Windows\\Prefetch direc\u00adto\u00adry or cre\u00adate a access time\u00adline and scan for <code>.pf<\/code> files.<\/li>\n\n\n\n<li>Exam\u00adple with Win\u00adPrefetchView:<br><code>WinPrefetchView.exe \/folder \"C:\\...\\Prefetch\" \/scomma sorted_by_mtime.csv \/sort \"Modified Time\"<\/code><br>This cre\u00adates a <span class=\"caps\">CSV<\/span> file where we can see all exe\u00adcu\u00adtions of all files for which we have extract\u00aded the .pf&nbsp;files.<\/li>\n\n\n\n<li>To see more infor\u00adma\u00adtion about a spe\u00adcif\u00adic exe\u00adcu\u00adtion: Take the .pf file an ana\u00adlyze it with <a href=\"https:\/\/github.com\/EricZimmerman\/PECmd\">PECmd<\/a>:<br><code>PECmd.exe -f suspect.pf<\/code><br>This returns a lot of exe\u00adcu\u00adtion information.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><span class=\"caps\">SRUM<\/span> Sys\u00adtem Resource Usage Monitor&nbsp;<ul class=\"wp-block-list\">\n<li>Stores some run\u00adtime information<\/li>\n\n\n\n<li>In <span class=\"caps\">HKLM<\/span>\\Software\\Microsoft\\WindowsNT\\CurrentVersion\\<span class=\"caps\">SRUM<\/span>\\Extensions or per\u00adsist\u00aded on \\System32\\sru\\<span class=\"caps\">SRUDB<\/span>.dat<\/li>\n\n\n\n<li><span class=\"caps\">SRUM-DUMP2<\/span> or ScrumECmd can be used for analysis<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Goal: See on a sys\u00adtem if some spe\u00adcif\u00adic exe\u00adcute\u00adable was executed.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[523,512,517],"tags":[],"class_list":["post-4658","post","type-post","status-publish","format-standard","hentry","category-forensic","category-incident-response","category-incident-response-training-march-2025"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4658"}],"version-history":[{"count":5,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4658\/revisions"}],"predecessor-version":[{"id":4666,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4658\/revisions\/4666"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}