Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Condition logic prevents some valid artifacts from being collected on Windows 10 #988

Open
coperni opened this issue Jun 30, 2022 · 1 comment

Comments

@coperni
Copy link
Contributor

coperni commented Jun 30, 2022

Environment

  • How did you install GRR? Deb
  • What GRR version are you running?: 3.4.5.1
  • What operating system does the GRR server run on? Ubuntu 18.04
  • What operating system does the affected GRR client run on, if applicable? [e.g. Windows 10]

Describe the issue
Some artifacts are unable to be collected on Windows 10 due to CheckCondition logic failing on the minor version. Windows 10 has major version 10 and minor version 0. For the artifact WindowsAMCacheHveFile which has major: 6 and minor 2
GRR is unable to complete the flow because of the minor version mismatch.

Affected artifacts:

Windows:

  • WindowsAMCacheHveFile [os_major_version >= 6 AND os_minor_version >= 1]
  • WinAppXRT [os_major_version >= 6 AND os_minor_version >= 2]
  • WindowsEnvironmentVariableAppxProcess [os_major_version >= 6 AND os_minor_version >= 2]
  • WindowsRecentFileCacheBCF [os_major_version >= 6 AND os_minor_version >= 1]
  • WindowsStartupInfo [os_major_version >= 6 AND os_minor_version >= 2]

WMI:

  • WMIDNSClientCache [os_major_version >= 6 AND os_minor_version >= 2]
  • WMINetNeighbors [os_major_version >= 6 AND os_minor_version >= 2]
  • WMINetTCPConnections [os_major_version >= 6 AND os_minor_version >= 2]
  • WMINetUDPEndpoints [os_major_version >= 6 AND os_minor_version >= 2]
  • WMIScheduledTasks [os_major_version >= 6 AND os_minor_version >= 2]

Error logs
N/A

Additional context
ForensicArtifacts/artifacts/issues/274 is from the original issue back in 2018 and the author lists some suggestions like combining os_major and os_minor into os_version. There is also the possibility of removing the condition altogether. Thoughts?

@coperni
Copy link
Contributor Author

coperni commented Jul 20, 2022

@joachimmetz has rectified this within the ForensicArtifacts repository via Removed support for conditions. All that remains is to tag the ForensicArtifiacts changes and update the reference in the artifacts makefile.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant