Skip to content

Commit

Permalink
Add application_execution tag to certain Amcache entries
Browse files Browse the repository at this point in the history
  • Loading branch information
pyllyukko authored and joachimmetz committed Jun 12, 2022
1 parent daa4487 commit f372012
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 0 deletions.
1 change: 1 addition & 0 deletions data/tag_windows.txt
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ application_execution
data_type is 'windows:registry:mrulistex' AND entries contains '.exe'
data_type is 'windows:registry:userassist' AND value_name contains '.exe'
data_type is 'windows:tasks:job'
parser is 'winreg/amcache' AND data_type is 'windows:registry:key_value' AND key_path contains 'InventoryApplicationFile\\'

# Tags Windows application installation events.
application_install
Expand Down
13 changes: 13 additions & 0 deletions tests/data/tag_windows.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
import unittest

from plaso.containers import events
from plaso.containers import windows_events
from plaso.lib import definitions
from plaso.parsers import filestat
from plaso.parsers import winevt
Expand Down Expand Up @@ -168,6 +169,18 @@ def testApplicationExecution(self):
winjob.WinJobEventData, attribute_values_per_name,
['application_execution'])

# Test: parser is 'winreg/amcache' AND
# data_type is 'windows:registry:key_value' AND
# key_path contains 'InventoryApplicationFile\\'
event = events.EventObject()
event.timestamp = self._TEST_TIMESTAMP
event.timestamp_desc = definitions.TIME_DESCRIPTION_MODIFICATION
event_data = windows_events.WindowsRegistryEventData()
event_data.key_path = '\\Root\\InventoryApplicationFile\\7z.exe|afe683e0fa522625'
event_data.parser = 'winreg/amcache'
storage_writer = self._TagEvent(event, event_data, None)
self._CheckLabels(storage_writer, ['application_execution'])

def testApplicationInstall(self):
"""Tests the application_install tagging rule."""
# Test: data_type is 'windows:evtx:record' AND
Expand Down

0 comments on commit f372012

Please sign in to comment.