Add UserAssist table #5539

puffyCid · 2019-03-27T03:23:50Z

This PR adds a UsserAssist table for Windows systems.
The UserAssist Registry key tracks of what applications were executed on the system.
https://www.magnetforensics.com/blog/artifact-profile-userassist/
https://www.hecfblog.com/2013/08/daily-blog-45-understanding-artifacts.html

Let me know if additional edits need to be made

osquery> select * from userassist;
+------------------------------------------------------------------------------------------------------------------+--------------------------+-------+--------------------------------------------+
| path                                                                                                             | last_execution_time      | count | sid                                        |
+------------------------------------------------------------------------------------------------------------------+--------------------------+-------+--------------------------------------------+
| UEME_CTLCUACount:ctor                                                                                            |                          |       | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.Getstarted_8wekyb3d8bbwe!App                                                                           | Thu Feb 21 01:46:04 2019 | 14    | S-1-5-21-7825111-416168317-3060585499-1001 |
| UEME_CTLSESSION                                                                                                  |                          |       | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.Office.Sway_8wekyb3d8bbwe!Microsoft.Sway                                                               | Thu Feb 21 01:46:04 2019 | 13    | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.WindowsMaps_8wekyb3d8bbwe!App                                                                          | Thu Feb 21 01:46:04 2019 | 12    | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.People_8wekyb3d8bbwe!x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x                                            | Thu Feb 21 01:46:04 2019 | 11    | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.WindowsCalculator_8wekyb3d8bbwe!App                                                                    | Thu Feb 21 01:46:04 2019 | 10    | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.WindowsAlarms_8wekyb3d8bbwe!App                                                                        | Thu Feb 21 01:46:04 2019 | 9     | S-1-5-21-7825111-416168317-3060585499-1001 |
| {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\SnippingTool.exe                                                          | Thu Feb 21 01:46:04 2019 | 8     | S-1-5-21-7825111-416168317-3060585499-1001 |
| {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\mspaint.exe                                                               | Thu Feb 21 01:46:04 2019 | 7     | S-1-5-21-7825111-416168317-3060585499-1001 |
| {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\notepad.exe                                                               | Mon Mar 25 04:25:31 2019 | 8     | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.Windows.StickyNotes                                                                                    | Thu Feb 21 01:46:04 2019 | 5     | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.Windows.Explorer                                                                                       | Tue Mar 26 03:07:30 2019 | 12    | S-1-5-21-7825111-416168317-3060585499-1001 |
| {F38BF404-1D43-42F2-9305-67DE0B28FC23}\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe      | Wed Apr 22 19:24:48 2009 | 0     | S-1-5-21-7825111-416168317-3060585499-1001 |
| {F38BF404-1D43-42F2-9305-67DE0B28FC23}\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe           | Wed Apr 22 19:24:48 2009 | 0     | S-1-5-21-7825111-416168317-3060585499-1001 |
| Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge                                                              | Thu Feb 21 01:49:25 2019 | 1     | S-1-5-21-7825111-416168317-3060585499-1001 |
| C:\Users\bob\Desktop\W10Privacy.exe                                                                              | Mon Mar 25 04:19:51 2019 | 4     | S-1-5-21-7825111-416168317-3060585499-1001 |
+------------------------------------------------------------------------------------------------------------------+--------------------------+-------+--------------------------------------------+

puffyCid · 2019-04-07T15:57:03Z

Is there anything I need to add or change for this to get reviewed/merged?
Any feedback/comments would be great!

…ssist_table

directionless

I can't speak to the implementation, but I think this should have tests. Possible a sample file for them.

osquery/tables/system/BUCK

specs/darwin/diagnostics.table

linux-foundation-easycla · 2019-07-27T21:57:42Z

The committers are authorized under a signed CLA.

✅ puffyCid (a70abc1, db0d8b6, 21a8ce1, 8c34b09, 72a04af, 77fd976, 7529da2, 435a826, 5b252c2, 0f3f190, 473a485, 02a96a2, ce51a08, 6bfbb2b, cca55d9, 2bafe9b, 90ea72a, f2b629f, e94cccb, 6748c33, 84e1af9, 7ffa576, 2cb0aad, 9449ec6, 454651c, 4a3a199, a4e1d63, affa947, c1a05cb, 151235d, 94279ca, 1c0535d, cc4821b, bb2dfdf)

theopolis · 2019-07-28T16:49:33Z

Also, let's rebase against master and change the target branch.

…serassist_table

Fixed formatting

puffyCid · 2019-07-31T03:57:14Z

Also, let's rebase against master and change the target branch.

Rebased and target branch changed

Smjert · 2019-07-31T11:14:52Z

Could it be possible to add a more comprehensive test about the table functionality?
Like testing against known values or edge cases?

Unfortunately the "integration" test that's already present it really only serve the purpose of exposing major issues with the table spec and/or "communication" between the different modules, but it doesn't tell if the table is really working as expected and showing correct values.

osquery/tables/system/windows/userassist.cpp

tests/integration/tables/userassist.cpp

muffins

Thanks for writing this table, this is gunna be super nifty to have! I had a couple of notes, but overall it's looking good. Just a few small changes and I think we'll be good to land.

muffins · 2019-11-24T21:20:04Z

osquery/tables/system/windows/userassist.cpp

+    unsigned long long last_run =
+        tryTo<unsigned long long>(last_run_string, 16).takeOr(0ull);
+    if (last_run == 0ull) {
+      LOG(WARNING) << "Failed to convert FILETIME to UNIX time.";
+      return std::string();
+    }
+    last_run = (last_run / 10000000) - 11644473600;


We've already got a helper function for converting a FILETIME to a unix timestamp here, mind using that? You'll also need to import <osquery/filesystem/fileops.h>

switched to helper function

osquery/tables/system/windows/userassist.cpp

muffins · 2019-11-24T21:25:30Z

osquery/tables/system/windows/userassist.cpp

+
+        // split reg path by \Count\ to get Key values
+        std::size_t count_key = subkey.find("Count\\");
+        std::string value_key = subkey.substr(count_key);


nit: you declare std::string and std::size_t and others quite a bit, could these be auto?

switched to auto

muffins · 2019-11-24T21:27:46Z

osquery/tables/system/windows/userassist.cpp

+          if (time_str == "") {
+            r["count"] = "";
+          } else {
+            r["count"] = INTEGER(count);
+          }


It seems to me like you could bring the function call on line 168 to get the count value inside of your else condition. If the time_str == "", then we should avoid making the call to execution_num.

moved function

specs/windows/userassist.table

puffyCid · 2019-11-27T03:21:32Z

Thanks for writing this table, this is gunna be super nifty to have! I had a couple of notes, but overall it's looking good. Just a few small changes and I think we'll be good to land.

thanks for the review, changes should be applied
let me know if there are any issues

puffyCid · 2020-01-08T04:42:25Z

@muffins I believe all issues should be resolved. Once this gets accepted I can quickly fix and address #5831
If there are any other issues, just let me know I can try to fix them

muffins

This lgtm, I think we're good to merge. I'll leave this for a bit so others have a chance to look it over, but I think we're alright. Thanks for your work on this!

woodruffw · 2020-02-18T19:15:25Z

osquery/tables/system/windows/userassist.cpp

+        auto value_key = subkey.substr(count_key);
+        auto value_key_reg = value_key.substr(6, std::string::npos);
+
+        std::string decoded_value_key = rotDecode(value_key_reg);


N.B.: UserAssist aren't guaranteed to be ROT-13 encoded. If NoEncrypt is a DWORD of value 1 under the UserAssist registry key, the values are saved in plain text.

I'm not sure how common that is, though, so it might just be worth adding as a NOTE or TODO for the future in case someone runs into it.

Thats true if NoEncrypt is added to the Userassist key ROT13 would be turned off (though i tried adding that DWORD to my Windows 10 VM and it was still ROT13 encoding the values, but i may have doing something wrong). I think even if ROT13 is turned off, the existing values would still be encoded. So it would be easy to check to see if the NoEncrypt is set to 1. But I think it would be difficult to determine which data is ROT13 encoded and which is not?

Regardless ive never seen that added to any of the Windows systems ive looked at.

I can add NOTE/comment though mentioning the NoEncrypt setting

Added UserAssist table

a70abc1

facebook-github-bot added the cla signed Automated label: Pull Request author has signed the osquery CLA label Mar 27, 2019

Edit out comments

db0d8b6

puffyCid and others added 4 commits April 21, 2019 13:56

Merge branch 'experimental' of github.com:facebook/osquery into usera…

21a8ce1

…ssist_table

Added Diagnotics Core analytics table

8c34b09

Added Diagnostic Core analytics table

72a04af

Small updates

77fd976

directionless reviewed Jul 15, 2019

View reviewed changes

osquery/tables/system/BUCK Outdated Show resolved Hide resolved

specs/darwin/diagnostics.table Outdated Show resolved Hide resolved

Added tests, removed diagnostic files

7529da2

puffyCid and others added 8 commits July 30, 2019 21:38

Added UserAssist table

435a826

Edit out comments

5b252c2

Added Diagnotics Core analytics table

0f3f190

Added Diagnostic Core analytics table

473a485

Small updates

02a96a2

Added tests, removed diagnostic files

ce51a08

Small updates

6bfbb2b

More small updates

cca55d9

puffyCid changed the base branch from experimental to master July 31, 2019 02:05

puffyCid and others added 6 commits July 30, 2019 22:08

Merge branch 'master' into userassist_table

2bafe9b

Update BUCK

90ea72a

Update BUCK

f2b629f

Fixed formatting

e94cccb

Merge branch 'userassist_table' of github.com:puffyCid/osquery into u…

6748c33

…serassist_table

Update userassist.cpp

84e1af9

Fixed formatting

Minor test change

7ffa576

puffyCid and others added 3 commits September 22, 2019 21:13

fixed formatting

df31bc9

Add check for empty timestamp

5592601

Merge branch 'master' into userassist_table

2a69cd3

theopolis requested changes Sep 28, 2019

View reviewed changes

puffyCid and others added 4 commits October 6, 2019 16:50

Merge branch 'master' into userassist_table

7ed4156

Addressing comments

47cc702

Addressed comments

38fa40d

Small fixes

c67047a

muffins requested changes Nov 24, 2019

View reviewed changes

muffins mentioned this pull request Nov 24, 2019

Background Activity Moderator Table #5831

Closed

puffyCid and others added 3 commits November 26, 2019 21:56

Use builtin osquery function to convert timestamps, minor fixes

6260d39

Merge branch 'master' into userassist_table

b8243b6

Update BUCK

1ae48a1

puffyCid and others added 4 commits November 26, 2019 22:31

Update userassist.h

0cac985

Update userassist.cpp

3f290d9

minor cleanup

0768cc3

minor fix

df1fc32

muffins previously approved these changes Jan 9, 2020

View reviewed changes

Nitpicks

2bfc3b2

theopolis dismissed muffins’s stale review via 2bfc3b2 January 16, 2020 01:53

woodruffw reviewed Feb 18, 2020

View reviewed changes

puffyCid and others added 4 commits February 21, 2020 23:44

Added note about NoEncrypt value

ea8554a

formatting

3fd2e19

Update userassist.cpp

865d595

formatting

d646450

theopolis approved these changes Mar 29, 2020

View reviewed changes

theopolis merged commit d974bb3 into osquery:master Mar 29, 2020

puffyCid deleted the userassist_table branch February 11, 2021 23:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add UserAssist table #5539

Add UserAssist table #5539

puffyCid commented Mar 27, 2019

puffyCid commented Apr 7, 2019

directionless left a comment

linux-foundation-easycla bot commented Jul 27, 2019 •

edited

theopolis commented Jul 28, 2019

puffyCid commented Jul 31, 2019

Smjert commented Jul 31, 2019

muffins left a comment

muffins Nov 24, 2019

puffyCid Nov 27, 2019

muffins Nov 24, 2019

puffyCid Nov 27, 2019

muffins Nov 24, 2019

puffyCid Nov 27, 2019

puffyCid commented Nov 27, 2019

puffyCid commented Jan 8, 2020

muffins left a comment

woodruffw Feb 18, 2020 •

edited

puffyCid Feb 22, 2020 •

edited

Add UserAssist table #5539

Add UserAssist table #5539

Conversation

puffyCid commented Mar 27, 2019

puffyCid commented Apr 7, 2019

directionless left a comment

Choose a reason for hiding this comment

linux-foundation-easycla bot commented Jul 27, 2019 • edited

theopolis commented Jul 28, 2019

puffyCid commented Jul 31, 2019

Smjert commented Jul 31, 2019

muffins left a comment

Choose a reason for hiding this comment

muffins Nov 24, 2019

Choose a reason for hiding this comment

puffyCid Nov 27, 2019

Choose a reason for hiding this comment

muffins Nov 24, 2019

Choose a reason for hiding this comment

puffyCid Nov 27, 2019

Choose a reason for hiding this comment

muffins Nov 24, 2019

Choose a reason for hiding this comment

puffyCid Nov 27, 2019

Choose a reason for hiding this comment

puffyCid commented Nov 27, 2019

puffyCid commented Jan 8, 2020

muffins left a comment

Choose a reason for hiding this comment

woodruffw Feb 18, 2020 • edited

Choose a reason for hiding this comment

puffyCid Feb 22, 2020 • edited

Choose a reason for hiding this comment

linux-foundation-easycla bot commented Jul 27, 2019 •

edited

woodruffw Feb 18, 2020 •

edited

puffyCid Feb 22, 2020 •

edited