Skip to content

WAC 2.0.0

Choose a tag to compare

View all tags
@reygiss reygiss released this 12 Oct 19:00
· 488 commits to master since this release
2.0.0
36b7001

WAC 2.0.0 — Windows Artefacts Collector

Collect on the examined machine, convert elsewhere. WAC now either collects (--collect, the default) or converts (--convert=<folder>), never both: the examined machine is only read.

Highlights since 1.3.1

  • 69 artefacts, each switched on or off by its own key in wac.yml: registry (whole SAM with NT/LM hashes and groups, BAM, UserAssist, ShimCache, Amcache, shellbags, USB devices, persistence, Defender settings, installed programs, known networks…), $MFT, $UsnJrnl, $LogFile, event logs with the text Windows renders, Prefetch, shortcuts, jump lists, SRUM, recycle bin, scheduled tasks, WMI, BITS, browsers (Chromium, Firefox, Internet Explorer and WebCache: history, downloads, sessions and closed tabs, favicons), Outlook and Thunderbird mail, thumbnail caches, RDP, Windows Timeline, search index, DPAPI master keys, FAT/exFAT volumes.
  • Raw NTFS reading only, files longer than 260 characters included; executables authenticated in memory (Authenticode, Microsoft catalogs): authentic Microsoft binaries recorded by their fingerprints, any other copied.
  • Sealed exhibit store: MD5, SHA-1, SHA-256, the eight NTFS dates and the MFT entry of every exhibit; checked before every conversion, never read or written again after the initial copy. Every operation in investigation.json, with the trace it is expected to leave and the time of each step.
  • JSON output: typed values, UTC and the suspect's local time with the offset in force at each date, no empty field.
  • No trace, measured under Sysmon against KAPE and Eric Zimmerman's tools: no file on C:, no registry value, no event in Windows' logs.
  • Tested: 494 checks in an autonomous Windows 11 VM cycle, each against an independent source; values confronted with KAPE and eleven EZ tools.

Files

  • WAC.exe — the collector (Windows 10 and 11, x64, standalone).
  • wac.yml — the reference configuration, to keep beside WAC.exe.
  • verify-exhibits.ps1|.sh (English), verifier-consigne.ps1|.sh (French) — recheck a collection's seal and every exhibit without WAC.
  • raw_hive_test.exe — the raw-reading test program of the test bench.
  • SHA256SUMS — fingerprints of the files above.

Documentation (FR and EN): doc/ in the repository — user manual, validation, harmlessness and comparison files.

Assets 10
Loading