From 95bfec9362aaf54935dc675ad0ead39a12032cd9 Mon Sep 17 00:00:00 2001 From: Sebastien Chapiron Date: Wed, 12 May 2021 14:33:58 +0200 Subject: [PATCH] New configuration --- .gitattributes | 4 + Configure.cmd | 68 +- README.md | 8 +- config/DFIR-ORC_config.xml | 646 +++++++++++++++++-- config/DFIR-ORC_embed.xml | 107 ++- config/FastFind_config.xml | 6 + config/FastFind_example.xml | 53 ++ config/FatInfoDetail_config.xml | 11 + config/FatInfoFirstBytes_config.xml | 8 + config/FatInfoHashPE_config.xml | 20 +- config/FatInfo_offline_config.xml | 11 + config/GetADS_config.xml | 17 + config/GetADS_offline_config.xml | 16 + config/GetArtefacts_config.xml | 130 +++- config/GetArtefacts_little_config.xml | 16 + config/GetArtefacts_offline_config.xml | 103 +++ config/GetBrowsersArtefacts_config.xml | 180 ++++++ config/GetBrowsersComplet_offline_config.xml | 213 ++++++ config/GetBrowsersHistory_config.xml | 84 +++ config/GetCatRoot_config.xml | 10 + config/GetCatRoot_offline_config.xml | 10 + config/GetEVT_config.xml | 12 + config/GetEVT_little_config.xml | 24 + config/GetEVT_offline_config.xml | 12 + config/GetEXE_TMP_offline_config.xml | 18 + config/GetErrors_config.xml | 20 + config/GetErrors_offline_config.xml | 17 + config/GetExeTMP_config.xml | 18 + config/GetExtAttrs_config.xml | 11 + config/GetExtAttrs_offline_config.xml | 11 + config/GetFuzzyHash_config.xml | 18 + config/GetFuzzyHash_offline_config.xml | 18 + config/GetHives_offline_config.xml | 39 ++ config/GetMFT_config.xml | 10 + config/GetMemDmp_config.xml | 12 + config/GetMemDmp_offline_config.xml | 11 + config/GetResidents_config.xml | 13 + config/GetResidents_offline_config.xml | 10 + config/GetSAM_hive_offline_config.xml | 9 + config/GetSDS_config.xml | 10 + config/GetSDS_offline_config.xml | 10 + config/GetSamHive_config.xml | 14 +- config/GetSamples_config.xml | 6 + config/GetScript_config.xml | 28 + config/GetScript_little_config.xml | 25 + config/GetScript_offline_config.xml | 42 ++ config/GetSystemHives_config.xml | 56 +- config/GetSystemHives_little_config.xml | 12 + config/GetTextLogs_config.xml | 88 +++ config/GetTextLogs_offline_config.xml | 86 +++ config/GetUserHives_config.xml | 16 +- config/GetUserHives_offline_config.xml | 10 + config/GetYaraSamples_config.xml | 39 +- config/GetYaraSamples_offline_config.xml | 18 + config/NTFSInfoDetail_alldrives_config.xml | 11 + config/NTFSInfoDetail_systemdrive_config.xml | 11 + config/NTFSInfoQuick_config.xml | 8 + config/NTFSInfo_little_config.xml | 93 +++ config/NTFSInfo_offline_config.xml | 11 + config/ruleset.yara | 4 +- configure.ps1 | 237 +++++++ 61 files changed, 2633 insertions(+), 206 deletions(-) create mode 100755 .gitattributes mode change 100755 => 100644 config/DFIR-ORC_config.xml mode change 100755 => 100644 config/DFIR-ORC_embed.xml create mode 100644 config/FastFind_config.xml create mode 100644 config/FastFind_example.xml create mode 100755 config/FatInfoDetail_config.xml create mode 100755 config/FatInfoFirstBytes_config.xml create mode 100644 config/FatInfo_offline_config.xml create mode 100755 config/GetADS_config.xml create mode 100644 config/GetADS_offline_config.xml create mode 100644 config/GetArtefacts_little_config.xml create mode 100644 config/GetArtefacts_offline_config.xml create mode 100644 config/GetBrowsersArtefacts_config.xml create mode 100644 config/GetBrowsersComplet_offline_config.xml create mode 100644 config/GetBrowsersHistory_config.xml create mode 100755 config/GetCatRoot_config.xml create mode 100644 config/GetCatRoot_offline_config.xml create mode 100755 config/GetEVT_config.xml create mode 100644 config/GetEVT_little_config.xml create mode 100644 config/GetEVT_offline_config.xml create mode 100644 config/GetEXE_TMP_offline_config.xml create mode 100755 config/GetErrors_config.xml create mode 100644 config/GetErrors_offline_config.xml create mode 100755 config/GetExeTMP_config.xml create mode 100755 config/GetExtAttrs_config.xml create mode 100644 config/GetExtAttrs_offline_config.xml create mode 100755 config/GetFuzzyHash_config.xml create mode 100755 config/GetFuzzyHash_offline_config.xml create mode 100644 config/GetHives_offline_config.xml create mode 100644 config/GetMFT_config.xml create mode 100755 config/GetMemDmp_config.xml create mode 100644 config/GetMemDmp_offline_config.xml create mode 100755 config/GetResidents_config.xml create mode 100755 config/GetResidents_offline_config.xml create mode 100644 config/GetSAM_hive_offline_config.xml create mode 100755 config/GetSDS_config.xml create mode 100644 config/GetSDS_offline_config.xml create mode 100755 config/GetSamples_config.xml create mode 100755 config/GetScript_config.xml create mode 100644 config/GetScript_little_config.xml create mode 100644 config/GetScript_offline_config.xml create mode 100755 config/GetSystemHives_little_config.xml create mode 100755 config/GetTextLogs_config.xml create mode 100644 config/GetTextLogs_offline_config.xml create mode 100644 config/GetUserHives_offline_config.xml mode change 100755 => 100644 config/GetYaraSamples_config.xml create mode 100644 config/GetYaraSamples_offline_config.xml create mode 100755 config/NTFSInfoDetail_alldrives_config.xml create mode 100755 config/NTFSInfoDetail_systemdrive_config.xml create mode 100755 config/NTFSInfoQuick_config.xml create mode 100644 config/NTFSInfo_little_config.xml create mode 100644 config/NTFSInfo_offline_config.xml mode change 100755 => 100644 config/ruleset.yara create mode 100644 configure.ps1 diff --git a/.gitattributes b/.gitattributes new file mode 100755 index 0000000..656d4b3 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,4 @@ +* text eol=crlf +*.exe binary +*.dll binary +*.7z binary \ No newline at end of file diff --git a/Configure.cmd b/Configure.cmd index f484559..9fbdcfa 100755 --- a/Configure.cmd +++ b/Configure.cmd @@ -1,34 +1,34 @@ -@ECHO off - -set ORC_CONFIG_FOLDER=.\config -set ORC_TOOLS_FOLDER=.\tools -set ORC_OUTPUT_FOLDER=.\output - -if not "%1"=="" ( - echo Configuration folder defined: %1 - set ORC_CONFIG_FOLDER=%1 -) - -if not defined ORC_OUTPUT goto DEFINE_ORC_OUTPUT -if "%ORC_OUTPUT%" == "" goto DEFINE_ORC_OUTPUT - -goto CONFIGURE_ORC - - -:DEFINE_ORC_OUTPUT - -set ORC_OUTPUT=DFIR-Orc.exe - -goto CONFIGURE_ORC - - -:CONFIGURE_ORC - -echo Configuring Orc (%ORC_OUTPUT_FOLDER%\%ORC_OUTPUT%) with config: %ORC_CONFIG_FOLDER% - -%ORC_TOOLS_FOLDER%\DFIR-Orc_x64.exe ToolEmbed /Config=%ORC_CONFIG_FOLDER%\DFIR-ORC_embed.xml - -set ORC_CONFIG_FOLDER= -set ORC_TOOLS_FOLDER= -set ORC_OUTPUT_FOLDER= -set ORC_OUTPUT= +@ECHO off + +set ORC_CONFIG_FOLDER=.\config +set ORC_TOOLS_FOLDER=.\tools +set ORC_OUTPUT_FOLDER=.\output + +if not "%1"=="" ( + echo Configuration folder defined: %1 + set ORC_CONFIG_FOLDER=%1 +) + +if not defined ORC_OUTPUT goto DEFINE_ORC_OUTPUT +if "%ORC_OUTPUT%" == "" goto DEFINE_ORC_OUTPUT + +goto CONFIGURE_ORC + + +:DEFINE_ORC_OUTPUT + +set ORC_OUTPUT=DFIR-Orc.exe + +goto CONFIGURE_ORC + + +:CONFIGURE_ORC + +echo Configuring Orc (%ORC_OUTPUT_FOLDER%\%ORC_OUTPUT%) with config: %ORC_CONFIG_FOLDER% + +%ORC_TOOLS_FOLDER%\DFIR-Orc_x64.exe ToolEmbed /Config=%ORC_CONFIG_FOLDER%\DFIR-ORC_embed.xml + +set ORC_CONFIG_FOLDER= +set ORC_TOOLS_FOLDER= +set ORC_OUTPUT_FOLDER= +set ORC_OUTPUT= diff --git a/README.md b/README.md index 1e2ff41..fc70758 100644 --- a/README.md +++ b/README.md @@ -4,12 +4,18 @@ To configure DFIR ORC, you need: * configuration files in XML format, located in the "config" directory * items to embed (especially DFIR-Orc binaries in 32 and 64 bits), stored in the "tools" directory -The configurations given as example here use Sysinternals "Autoruns" tools. You have to download and put it in the "tools" directory. +The configurations given as example here use several Sysinternals tools, DumpIt and WinPmem. You have to download and copy them in the "tools" directory. The "tools" directory must therefore contain the following files: * DFIR-Orc_x64.exe * DFIR-Orc_x86.exe * autorunsc.exe +* handle.exe +* Tcpvcon.exe +* PsService.exe +* Listdlls.exe +* DumpIt.exe +* winpmem.exe Finally, to generate a configured DFIR-Orc executable, you have to run the ".\Configure.cmd" script (on a Windows system, **from an elevated command prompt**). The generated binary is created in the "output" directory. diff --git a/config/DFIR-ORC_config.xml b/config/DFIR-ORC_config.xml old mode 100755 new mode 100644 index 962e61d..ad503dd --- a/config/DFIR-ORC_config.xml +++ b/config/DFIR-ORC_config.xml @@ -1,119 +1,625 @@ + DFIR-ORC_{SystemType}_{FullComputerName}_{TimeStamp}.log - DFIR-ORC_{SystemType}_{FullComputerName}.json + DFIR-ORC_{SystemType}_{FullComputerName}_{TimeStamp}.json - - + + - - - /FO csv - + + + /q /n /u + + - - - -NonInteractive -WindowStyle Hidden - Get-WMIObject win32_process | Export-Csv -NoTypeInformation -Encoding UTF8 - - + + + --truncate --compression none -dd --verbose --acquire-memory --format map --volume_format aff4 --output - + + + + + + + --truncate --compression none -dd --verbose --acquire-memory --volume_format raw --output - + + + + + + + + + + + /config=res:#NTFSInfo_little_config.xml + + - - - /config=res:#GetEvents_config.xml - - + + + /config=res:#GetEVT_little_config.xml + + + + + + + /FO csv + - -a * -c -h -m -s -t -accepteula + -accepteula -c -h -s -t -a * * - - - /config=res:#NTFSInfo_config.xml - - - - + + + %SystemDrive%\ + + - - - /config=res:#NTFSInfoHashPE_config.xml - - - - + + + /config=res:#GetSystemHives_little_config.xml + + - - - /config=res:#FatInfo_config.xml - - + + + /LegacyBootCode /SlackSpace + + - - - /config=res:#FatInfoHashPE_config.xml - - + + + /config=res:#GetArtefacts_little_config.xml + + - - - * - - + + + /accepteula + /a + + + + + + + + + + + + /config=res:#GetScript_little_config.xml + + + + + + + PRINT + + + + + + /displaydns + + + + + + /accepteula -a -n -c + + + + + + -a -n -o + + + + + + + + + + + /config=res:#FastFind_config.xml + + + + + + + + + + + /config=res:#NTFSInfoQuick_config.xml + + + + + + + /config=res:#GetResidents_config.xml + + + + + + + + /config=res:#GetSamples_config.xml + + + + + + + + + + + /config=res:#GetEVT_config.xml + + + + + + + /config=res:#GetADS_config.xml + + + + + + + /accepteula + + + + + + /list /allusers /verbose + + + + + + /VSS + + + + + + + /enumlocs + + + + + + /config=res:#GetExeTMP_config.xml + + - + /config=res:#GetArtefacts_config.xml - - - + + + + + + + /config=res:#GetExtAttrs_config.xml + + + + + + + /config=res:#GetTextLogs_config.xml + + + + + + + /config=res:#GetScript_config.xml + + + + + + + /config=res:#GetErrors_config.xml + + + + + + + /config=res:#GetMemDmp_config.xml + + + + + + + -a + + + + + + /config=res:#GetCatRoot_config.xml + + + + + + + /config=res:#GetSDS_config.xml + + + + - - + + + + + + /config=res:#NTFSInfoDetail_alldrives_config.xml + + + + + + + + + /config=res:#NTFSInfoDetail_systemdrive_config.xml + + + + + - - /config=res:#GetSystemHives_config.xml - - + + /config=res:#GetSystemHives_config.xml /shadows + + - - /config=res:#GetUserHives_config.xml - - + + /config=res:#GetUserHives_config.xml /shadows + + + + + + + /config=res:#FatInfoDetail_config.xml + + + + + * + + + + + + + /UefiFull + + + + + + + /config=res:#GetFuzzyHash_config.xml /fuzzyhash=tlsh,ssdeep + + + + + + + /config=res:#FatInfoHashPE_config.xml + + + + + + + /config=res:#FatInfoFirstBytes_config.xml + + + + + + + + + + + /config=res:#GetBrowsersHistory_config.xml + + + + + + + /config=res:#GetBrowsersArtefacts_config.xml + + + + + + + + - + /config=res:#GetSamHive_config.xml - - + + - - + + - + /config=res:#GetYaraSamples_config.xml - - + + + + + + + + + + + -NonInteractive -WindowStyle Hidden -NoProfile + if (Get-Command Get-DnsServerZone -CommandType Function -ErrorAction SilentlyContinue) { Get-DnsServerZone | ForEach-Object {write-host '' ; write-host '***' $_.ZoneName '***' ; write-host '' ; Get-DnsServerResourceRecord -ZoneName ($_.ZoneName)} } else { Get-WmiObject -Namespace root\MicrosoftDNS MicrosoftDNS_Domain | ? { $_.ContainerName -NotLike '..RootHints' -And $_.ContainerName -NotLike '..Cache' } | select ContainerName | Sort-Object ContainerName | Get-Unique -AsString | % { dnscmd /zoneprint $_.ContainerName } } + + + + + + + -NonInteractive -WindowStyle Hidden -NoProfile + Get-WMIObject -Namespace root\Subscription -Class __EventConsumer + + + + + + + -NonInteractive -WindowStyle Hidden -NoProfile + Import-Module ActiveDirectory ; $TimeAgo = (Get-Date).AddMonths(-3) ; Get-ADComputer -Filter {enabled -eq $true -and lastLogonTimeStamp -gt $TimeAgo} -Properties DNSHostName | Select DNSHostName | ConvertTo-Csv + + + + + + + -NonInteractive -WindowStyle Hidden -NoProfile + Get-WMIObject win32_process | Export-Csv -NoTypeInformation -Encoding UTF8 + + + + + + + -NonInteractive -WindowStyle Hidden -NoProfile + Get-Process | Export-Csv -NoTypeInformation -Encoding UTF8 + + + + + + + + + + + + + + /config=res:#NTFSInfo_offline_config.xml + + + + + + + + + /config=res:#FatInfo_offline_config.xml + + + + + + + + + %OfflineLocation% + + + + + /config=res:#GetFuzzyHash_offline_config.xml /fuzzyhash=tlsh,ssdeep + + + + + + + /config=res:#GetHives_offline_config.xml + + + + + + + /config=res:#GetUserHives_offline_config.xml + + + + + + + + + + + + + + + + + + + + + /config=res:#GetSDS_offline_config.xml + + + + + + + /config=res:#GetADS_offline_config.xml + + + + + + + /config=res:#GetCatRoot_offline_config.xml + + + + + + + /config=res:#GetEVT_offline_config.xml + + + + + + + /config=res:#GetEXE_TMP_offline_config.xml + + + + + + + /config=res:#GetArtefacts_offline_config.xml + + + + + + + /config=res:#GetTextLogs_offline_config.xml + + + + + + + /config=res:#GetScript_offline_config.xml + + + + + + + /config=res:#GetErrors_offline_config.xml + + + + + + + /config=res:#GetMemDmp_offline_config.xml + + + + + + + /config=res:#GetBrowsersComplet_offline_config.xml + + + + + + + /config=res:#GetSAM_hive_offline_config.xml + + + + + + + /config=res:#GetExtAttrs_offline_config.xml + + + + + + + /config=res:#GetResidents_offline_config.xml + + + + + + + + + + + /config=res:#GetMFT_config.xml + + + + + + diff --git a/config/DFIR-ORC_embed.xml b/config/DFIR-ORC_embed.xml old mode 100755 new mode 100644 index 3a62df9..881ac07 --- a/config/DFIR-ORC_embed.xml +++ b/config/DFIR-ORC_embed.xml @@ -1,27 +1,86 @@ - .\tools\DFIR-Orc_x86.exe - .\output\%ORC_OUTPUT% - - 7z:#Tools|DFIR-Orc_x64.exe - self:# - - - - - - - - - - - - - - - - - - - + .\tools\DFIR-Orc_x86.exe + .\output\%ORC_OUTPUT% + + 7z:#Tools|DFIR-Orc_x64.exe + self:# + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/FastFind_config.xml b/config/FastFind_config.xml new file mode 100644 index 0000000..e910954 --- /dev/null +++ b/config/FastFind_config.xml @@ -0,0 +1,6 @@ + + + + %SystemDrive% + + \ No newline at end of file diff --git a/config/FastFind_example.xml b/config/FastFind_example.xml new file mode 100644 index 0000000..4aee2ab --- /dev/null +++ b/config/FastFind_example.xml @@ -0,0 +1,53 @@ + + + + %SystemDrive% + + + + + + + + + + + + + + + + + + + + + + %SystemDrive% + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/FatInfoDetail_config.xml b/config/FatInfoDetail_config.xml new file mode 100755 index 0000000..8a01ad7 --- /dev/null +++ b/config/FatInfoDetail_config.xml @@ -0,0 +1,11 @@ + + + + * + + ComputerName,VolumeID,Default,RecordInUse,FirstBytes + Details + MD5,SHA1,PeSHA1,PeSHA256,Authenticode + MD5,SHA1,PeSHA1,PeSHA256,Authenticode + + diff --git a/config/FatInfoFirstBytes_config.xml b/config/FatInfoFirstBytes_config.xml new file mode 100755 index 0000000..0a2d30f --- /dev/null +++ b/config/FatInfoFirstBytes_config.xml @@ -0,0 +1,8 @@ + + + + * + + ComputerName,VolumeID,Default,RecordInUse,FirstBytes + + diff --git a/config/FatInfoHashPE_config.xml b/config/FatInfoHashPE_config.xml index 85774cd..94d7855 100755 --- a/config/FatInfoHashPE_config.xml +++ b/config/FatInfoHashPE_config.xml @@ -1,10 +1,14 @@ + - * - - ComputerName,VolumeID,Default,RecordInUse,FirstBytes - Details - MD5,SHA1,PeSHA1,PeSHA256,Authenticode - MD5,SHA1,PeSHA1,PeSHA256,Authenticode - - \ No newline at end of file + * + + ComputerName,VolumeID,Default,RecordInUse + Details + MD5,SHA1,PeSHA1,PeSHA256,Authenticode + MD5,SHA1,PeSHA1,PeSHA256,Authenticode + + + + + diff --git a/config/FatInfo_offline_config.xml b/config/FatInfo_offline_config.xml new file mode 100644 index 0000000..ecc593b --- /dev/null +++ b/config/FatInfo_offline_config.xml @@ -0,0 +1,11 @@ + + + + %OfflineLocation% + + ComputerName,VolumeID,Default,RecordInUse,FirstBytes + Details + MD5,SHA1,PeSHA1,PeSHA256,Authenticode + MD5,SHA1,PeSHA1,PeSHA256,Authenticode + + diff --git a/config/GetADS_config.xml b/config/GetADS_config.xml new file mode 100755 index 0000000..2ea26c6 --- /dev/null +++ b/config/GetADS_config.xml @@ -0,0 +1,17 @@ + + + * + + + + + + + + + + + + + + diff --git a/config/GetADS_offline_config.xml b/config/GetADS_offline_config.xml new file mode 100644 index 0000000..08f7b73 --- /dev/null +++ b/config/GetADS_offline_config.xml @@ -0,0 +1,16 @@ + + + %OfflineLocation% + + + + + + + + + + + + + diff --git a/config/GetArtefacts_config.xml b/config/GetArtefacts_config.xml index 3081fb8..419d278 100755 --- a/config/GetArtefacts_config.xml +++ b/config/GetArtefacts_config.xml @@ -1,29 +1,105 @@ + - - * - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file + + * + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetArtefacts_little_config.xml b/config/GetArtefacts_little_config.xml new file mode 100644 index 0000000..08ef9cd --- /dev/null +++ b/config/GetArtefacts_little_config.xml @@ -0,0 +1,16 @@ + + + + %SystemDrive% + + + + + + + + + + + + diff --git a/config/GetArtefacts_offline_config.xml b/config/GetArtefacts_offline_config.xml new file mode 100644 index 0000000..ebecb5a --- /dev/null +++ b/config/GetArtefacts_offline_config.xml @@ -0,0 +1,103 @@ + + + + %OfflineLocation% + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetBrowsersArtefacts_config.xml b/config/GetBrowsersArtefacts_config.xml new file mode 100644 index 0000000..5e3eec7 --- /dev/null +++ b/config/GetBrowsersArtefacts_config.xml @@ -0,0 +1,180 @@ + + + + * + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetBrowsersComplet_offline_config.xml b/config/GetBrowsersComplet_offline_config.xml new file mode 100644 index 0000000..9e433b0 --- /dev/null +++ b/config/GetBrowsersComplet_offline_config.xml @@ -0,0 +1,213 @@ + + + %OfflineLocation% + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetBrowsersHistory_config.xml b/config/GetBrowsersHistory_config.xml new file mode 100644 index 0000000..e3cd56b --- /dev/null +++ b/config/GetBrowsersHistory_config.xml @@ -0,0 +1,84 @@ + + + + * + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetCatRoot_config.xml b/config/GetCatRoot_config.xml new file mode 100755 index 0000000..e0398ed --- /dev/null +++ b/config/GetCatRoot_config.xml @@ -0,0 +1,10 @@ + + + + %SystemDrive%\ + + + + + + diff --git a/config/GetCatRoot_offline_config.xml b/config/GetCatRoot_offline_config.xml new file mode 100644 index 0000000..d8848e4 --- /dev/null +++ b/config/GetCatRoot_offline_config.xml @@ -0,0 +1,10 @@ + + + + %OfflineLocation% + + + + + + diff --git a/config/GetEVT_config.xml b/config/GetEVT_config.xml new file mode 100755 index 0000000..5ec3d17 --- /dev/null +++ b/config/GetEVT_config.xml @@ -0,0 +1,12 @@ + + + %SystemDrive%\ + + + + + + + + + diff --git a/config/GetEVT_little_config.xml b/config/GetEVT_little_config.xml new file mode 100644 index 0000000..f53532c --- /dev/null +++ b/config/GetEVT_little_config.xml @@ -0,0 +1,24 @@ + + + + %SystemDrive%\ + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetEVT_offline_config.xml b/config/GetEVT_offline_config.xml new file mode 100644 index 0000000..775fae9 --- /dev/null +++ b/config/GetEVT_offline_config.xml @@ -0,0 +1,12 @@ + + + %OfflineLocation% + + + + + + + + + diff --git a/config/GetEXE_TMP_offline_config.xml b/config/GetEXE_TMP_offline_config.xml new file mode 100644 index 0000000..b89e2f7 --- /dev/null +++ b/config/GetEXE_TMP_offline_config.xml @@ -0,0 +1,18 @@ + + + %OfflineLocation% + + + + + + + + + + + + + + + diff --git a/config/GetErrors_config.xml b/config/GetErrors_config.xml new file mode 100755 index 0000000..39374fb --- /dev/null +++ b/config/GetErrors_config.xml @@ -0,0 +1,20 @@ + + + %SystemDrive%\ + + + + + + + + + + + + + + + + + diff --git a/config/GetErrors_offline_config.xml b/config/GetErrors_offline_config.xml new file mode 100644 index 0000000..53aca3e --- /dev/null +++ b/config/GetErrors_offline_config.xml @@ -0,0 +1,17 @@ + + + %OfflineLocation% + + + + + + + + + + + + + + diff --git a/config/GetExeTMP_config.xml b/config/GetExeTMP_config.xml new file mode 100755 index 0000000..8aaf884 --- /dev/null +++ b/config/GetExeTMP_config.xml @@ -0,0 +1,18 @@ + + + * + + + + + + + + + + + + + + + diff --git a/config/GetExtAttrs_config.xml b/config/GetExtAttrs_config.xml new file mode 100755 index 0000000..dbb3c30 --- /dev/null +++ b/config/GetExtAttrs_config.xml @@ -0,0 +1,11 @@ + + + + * + + + + + + + diff --git a/config/GetExtAttrs_offline_config.xml b/config/GetExtAttrs_offline_config.xml new file mode 100644 index 0000000..b953ab7 --- /dev/null +++ b/config/GetExtAttrs_offline_config.xml @@ -0,0 +1,11 @@ + + + + %OfflineLocation% + + + + + + + diff --git a/config/GetFuzzyHash_config.xml b/config/GetFuzzyHash_config.xml new file mode 100755 index 0000000..c23f643 --- /dev/null +++ b/config/GetFuzzyHash_config.xml @@ -0,0 +1,18 @@ + + + + * + + + + + + + + + + + + + + \ No newline at end of file diff --git a/config/GetFuzzyHash_offline_config.xml b/config/GetFuzzyHash_offline_config.xml new file mode 100755 index 0000000..2ead87c --- /dev/null +++ b/config/GetFuzzyHash_offline_config.xml @@ -0,0 +1,18 @@ + + + + %OfflineLocation% + + + + + + + + + + + + + + \ No newline at end of file diff --git a/config/GetHives_offline_config.xml b/config/GetHives_offline_config.xml new file mode 100644 index 0000000..0dcb758 --- /dev/null +++ b/config/GetHives_offline_config.xml @@ -0,0 +1,39 @@ + + + %OfflineLocation% + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetMFT_config.xml b/config/GetMFT_config.xml new file mode 100644 index 0000000..daff17a --- /dev/null +++ b/config/GetMFT_config.xml @@ -0,0 +1,10 @@ + + + + %SystemDrive% + + + + + + \ No newline at end of file diff --git a/config/GetMemDmp_config.xml b/config/GetMemDmp_config.xml new file mode 100755 index 0000000..0202046 --- /dev/null +++ b/config/GetMemDmp_config.xml @@ -0,0 +1,12 @@ + + + + %SystemDrive%\ + + + + + + + + diff --git a/config/GetMemDmp_offline_config.xml b/config/GetMemDmp_offline_config.xml new file mode 100644 index 0000000..e1954d7 --- /dev/null +++ b/config/GetMemDmp_offline_config.xml @@ -0,0 +1,11 @@ + + + + %OfflineLocation% + + + + + + + diff --git a/config/GetResidents_config.xml b/config/GetResidents_config.xml new file mode 100755 index 0000000..0b14ac7 --- /dev/null +++ b/config/GetResidents_config.xml @@ -0,0 +1,13 @@ + + + + + * + + + + + + + + diff --git a/config/GetResidents_offline_config.xml b/config/GetResidents_offline_config.xml new file mode 100755 index 0000000..fd2c189 --- /dev/null +++ b/config/GetResidents_offline_config.xml @@ -0,0 +1,10 @@ + + + + %OfflineLocation% + + + + + + diff --git a/config/GetSAM_hive_offline_config.xml b/config/GetSAM_hive_offline_config.xml new file mode 100644 index 0000000..3725ec8 --- /dev/null +++ b/config/GetSAM_hive_offline_config.xml @@ -0,0 +1,9 @@ + + + %OfflineLocation% + + + + + + diff --git a/config/GetSDS_config.xml b/config/GetSDS_config.xml new file mode 100755 index 0000000..863e7e6 --- /dev/null +++ b/config/GetSDS_config.xml @@ -0,0 +1,10 @@ + + + %SystemDrive%\ + + + + + + + diff --git a/config/GetSDS_offline_config.xml b/config/GetSDS_offline_config.xml new file mode 100644 index 0000000..54af970 --- /dev/null +++ b/config/GetSDS_offline_config.xml @@ -0,0 +1,10 @@ + + + %OfflineLocation% + + + + + + + diff --git a/config/GetSamHive_config.xml b/config/GetSamHive_config.xml index ce19255..f6ef2c5 100755 --- a/config/GetSamHive_config.xml +++ b/config/GetSamHive_config.xml @@ -1,9 +1,9 @@ - %SystemDrive% - - - - - - \ No newline at end of file + %SystemDrive%\ + + + + + + diff --git a/config/GetSamples_config.xml b/config/GetSamples_config.xml new file mode 100755 index 0000000..99977fa --- /dev/null +++ b/config/GetSamples_config.xml @@ -0,0 +1,6 @@ + + + + + + diff --git a/config/GetScript_config.xml b/config/GetScript_config.xml new file mode 100755 index 0000000..f2ac170 --- /dev/null +++ b/config/GetScript_config.xml @@ -0,0 +1,28 @@ + + + * + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetScript_little_config.xml b/config/GetScript_little_config.xml new file mode 100644 index 0000000..f1fff88 --- /dev/null +++ b/config/GetScript_little_config.xml @@ -0,0 +1,25 @@ + + + + %SystemDrive% + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetScript_offline_config.xml b/config/GetScript_offline_config.xml new file mode 100644 index 0000000..c594bec --- /dev/null +++ b/config/GetScript_offline_config.xml @@ -0,0 +1,42 @@ + + + %OfflineLocation% + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetSystemHives_config.xml b/config/GetSystemHives_config.xml index 33ffe4d..a0bca66 100755 --- a/config/GetSystemHives_config.xml +++ b/config/GetSystemHives_config.xml @@ -1,21 +1,39 @@ - %SystemRoot% - - - - - - - - - - - - - - - - - - \ No newline at end of file + %SystemDrive% + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetSystemHives_little_config.xml b/config/GetSystemHives_little_config.xml new file mode 100755 index 0000000..47f9f07 --- /dev/null +++ b/config/GetSystemHives_little_config.xml @@ -0,0 +1,12 @@ + + + %SystemDrive% + + + + + + + + + diff --git a/config/GetTextLogs_config.xml b/config/GetTextLogs_config.xml new file mode 100755 index 0000000..694b95c --- /dev/null +++ b/config/GetTextLogs_config.xml @@ -0,0 +1,88 @@ + + + + %SystemDrive%\ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetTextLogs_offline_config.xml b/config/GetTextLogs_offline_config.xml new file mode 100644 index 0000000..18ebeb1 --- /dev/null +++ b/config/GetTextLogs_offline_config.xml @@ -0,0 +1,86 @@ + + + + %OfflineLocation% + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/GetUserHives_config.xml b/config/GetUserHives_config.xml index 3eae401..f284ec1 100755 --- a/config/GetUserHives_config.xml +++ b/config/GetUserHives_config.xml @@ -1,10 +1,10 @@ - * - - - - - - - \ No newline at end of file + * + + + + + + + diff --git a/config/GetUserHives_offline_config.xml b/config/GetUserHives_offline_config.xml new file mode 100644 index 0000000..c933b0b --- /dev/null +++ b/config/GetUserHives_offline_config.xml @@ -0,0 +1,10 @@ + + + %OfflineLocation% + + + + + + + diff --git a/config/GetYaraSamples_config.xml b/config/GetYaraSamples_config.xml old mode 100755 new mode 100644 index c1134f2..b434f14 --- a/config/GetYaraSamples_config.xml +++ b/config/GetYaraSamples_config.xml @@ -1,12 +1,39 @@ + - - %SystemDrive% - + + + + C:\ + + - - + + + + + + + + + + + - \ No newline at end of file + + + diff --git a/config/GetYaraSamples_offline_config.xml b/config/GetYaraSamples_offline_config.xml new file mode 100644 index 0000000..317066a --- /dev/null +++ b/config/GetYaraSamples_offline_config.xml @@ -0,0 +1,18 @@ + + + + + + + %OfflineLocation% + + + + + + + + + + + diff --git a/config/NTFSInfoDetail_alldrives_config.xml b/config/NTFSInfoDetail_alldrives_config.xml new file mode 100755 index 0000000..5ac5bbc --- /dev/null +++ b/config/NTFSInfoDetail_alldrives_config.xml @@ -0,0 +1,11 @@ + + + + * + + Default + MD5,SHA1,SHA256,PeMD5,PeSHA1,PeSHA256 + MD5,SHA1,SHA256,PeMD5,PeSHA1,PeSHA256,Details,Authenticode + + + diff --git a/config/NTFSInfoDetail_systemdrive_config.xml b/config/NTFSInfoDetail_systemdrive_config.xml new file mode 100755 index 0000000..cad3473 --- /dev/null +++ b/config/NTFSInfoDetail_systemdrive_config.xml @@ -0,0 +1,11 @@ + + + + %SystemDrive%\ + + Default,FirstBytes + MD5,SHA1,SHA256,PeMD5,PeSHA1,PeSHA256 + MD5,SHA1,SHA256,PeMD5,PeSHA1,PeSHA256,Details,Authenticode + + + diff --git a/config/NTFSInfoQuick_config.xml b/config/NTFSInfoQuick_config.xml new file mode 100755 index 0000000..02dd7f0 --- /dev/null +++ b/config/NTFSInfoQuick_config.xml @@ -0,0 +1,8 @@ + + + + * + + Default,EASize + + diff --git a/config/NTFSInfo_little_config.xml b/config/NTFSInfo_little_config.xml new file mode 100644 index 0000000..5b91a81 --- /dev/null +++ b/config/NTFSInfo_little_config.xml @@ -0,0 +1,93 @@ + + + + %SystemDrive% + + + File,ParentName,SizeInBytes,CreationDate,LastModificationDate,LastAccessDate,LastAttrChangeDate,FileNameCreationDate,FileNameLastModificationDate,FileNameLastAccessDate,FileNameLastAttrModificationDate,ADS,RecordInUse + SHA1 + SHA1,Details,AuthenticodeStatus,AuthenticodeSignerThumbprint,AuthenticodeCAThumbprint + + diff --git a/config/NTFSInfo_offline_config.xml b/config/NTFSInfo_offline_config.xml new file mode 100644 index 0000000..556df8e --- /dev/null +++ b/config/NTFSInfo_offline_config.xml @@ -0,0 +1,11 @@ + + + + %OfflineLocation% + + ComputerName,VolumeID,Default,ExtendedAttribute,RecordInUse,SecDescrID,ADS,FirstBytes + Details + MD5,SHA1,SHA256,PeMD5,PeSHA1,PeSHA256,Authenticode + MD5,SHA1,SHA256,PeMD5,PeSHA1,PeSHA256,Authenticode + + diff --git a/config/ruleset.yara b/config/ruleset.yara old mode 100755 new mode 100644 index 5421ef8..adf8f16 --- a/config/ruleset.yara +++ b/config/ruleset.yara @@ -1,6 +1,6 @@ rule dfir_orc { strings: $dummy = "This is a dummy rule not supposed to match anything but the binary embedding it!" - condition: + condition : $dummy -} +} \ No newline at end of file diff --git a/configure.ps1 b/configure.ps1 new file mode 100644 index 0000000..cf66ea1 --- /dev/null +++ b/configure.ps1 @@ -0,0 +1,237 @@ +function Configure-Orc +{ + <# + .SYNOPSIS + Configure DFIR-ORC + + .PARAMETER RawBin + Path to DFIR-ORC raw binaries. Default is 'tools\' directory in + configuration directory + + .PARAMETER Configuration + Path to DFIR-ORC configuration root directory containing 'tools\' + and 'config\' subdirectories. Default is '.\' + + .PARAMETER ToolEmbedXml + Path to ToolEmbed's XML configuration file. If not specified the + script will lookup in this order in configuration directory: + - ORC_embed.xml + - DFIR-ORC_embed.xml + - *.xml with '' as root element + + .PARAMETER Destination + Path to configured DFIR-ORC output file. Default is '.\output\' + or 'output\' in configuration root directory if provided with + Configuration parameter + + .PARAMETER Force + DFIR-ORC raw binaries present in tools directory will be replaced + if -RawBin option is used + + .EXAMPLE + .\configure.ps1 ` + -RawBin D:\dfir-orc\build\dev\latest\bin\MinSizeRel\ ` + -Configuration C:\dev\dfir-orc\ ` + -Destination C:\dev\dfir-orc\release\DFIR-Orc.exe + #> + [cmdletbinding()] + Param ( + [Parameter(Mandatory = $false)] + [ValidateNotNullOrEmpty()] + [System.IO.DirectoryInfo] + $RawBin, + + [Parameter(Mandatory = $false)] + [ValidateNotNullOrEmpty()] + [System.IO.DirectoryInfo] + $Configuration = ".", + + [Parameter(Mandatory = $false)] + [System.IO.FileInfo] + $ToolEmbedXml, + + [Parameter(Mandatory = $false)] + [ValidateNotNullOrEmpty()] + [System.IO.FileInfo] + $Destination, + + [Switch] + $Force + ) + + $ErrorActionPreference = "Stop" + + $OrcRawBinaries = @( + "DFIR-Orc_x64.exe" + "DFIR-Orc_x86.exe" + ) + + $OrcRawBinariesToClean = @() + + if($RawBin) + { + foreach($OrcRawBinary in $OrcRawBinaries) + { + if(Test-Path "${RawBin}\${OrcRawBinary}") + { + if($Force -Or -Not (Test-Path "${Configuration}\tools\${OrcRawBinary}")) + { + Copy-Item -Force -Path "${RawBin}\${OrcRawBinary}" -Destination "${Configuration}/tools" + $OrcRawBinariesToClean += $OrcRawBinary + } + else + { + Write-Warning "DFIR-ORC raw binary seems already present at ${Configuration}\tools\${OrcRawBinary} and will be used to configure DFIR-ORC." + Write-Warning "Use -Force option if you want to replace it" + } + } + else + { + Write-Error "Cannot find ${OrcRawBinary} raw binary" + } + } + } + else + { + $RawBin = "./tools" + } + + foreach($OrcRawBinary in $OrcRawBinaries) + { + if(-Not (Test-Path "${Configuration}\tools\${OrcRawBinary}")) + { + Write-Error "DFIR-ORC raw binary ${OrcRawBinary} is not present in ${Configuration}\tools directory" + } + } + + Push-Location $Configuration + try + { + if(-Not $ToolEmbedXml) + { + $ToolEmbedXml = Get-ToolEmbedXml -Path ".\config" + } + + if(-Not $ToolEmbedXml -Or -Not (Test-Path $ToolEmbedXml)) + { + Write-Error "Cannot find ToolEmbed configuration" + } + else + { + Write-Output "Found ToolEmbed configuration: '${ToolEmbedXml}'" + } + + $ENV:__COMPAT_LAYER = "RUNASINVOKER" + + # XML configuration files usually references some environment variables + $ENV:ORC_CONFIG_FOLDER = "config" + $ENV:ORC_OUTPUT = "DFIR-Orc.exe" + + . tools\DFIR-Orc_x64.exe ToolEmbed /Config="${ToolEmbedXml}" + + $ToolEmbedOutput = Get-ToolEmbedOutput -Path $ToolEmbedXml + } + finally + { + Pop-Location + } + + if(! $Destination) + { + $Destination = "${Configuration}\output" + } + + if($Destination -notmatch '\.exe$') + { + $DestinationDir = $Destination + $ExecutableName = Split-Path $ToolEmbedOutput -leaf + $Destination = "$Destination/$ExecutableName" + } + else + { + $DestinationDir = Split-Path $Destination + } + + if(-Not (Test-Path $DestinationDir)) + { + New-Item -ItemType Directory $DestinationDir | Out-Null + Write-Output "Create '$DestinationDir' directory" + } + + if("${Configuration}/${ToolEmbedOutput}" -ne $Destination) + { + Move-Item -Force -Path "${Configuration}/${ToolEmbedOutput}" -Destination $Destination + } + + Write-Output ` + "`n`nDFIR-ORC configuration is done: '$(Resolve-Path ${Destination})'`n" + + # Clean DFIR-ORC raw binaries + if($RawBin) + { + foreach($OrcRawBinary in $OrcRawBinariesToClean) + { + if(Test-Path "$Configuration\tools\$OrcRawBinary") + { + Remove-Item -Path "${Configuration}\tools\${OrcRawBinary}" + } + } + } +} + +function Get-ToolEmbedXml +{ + param( + [System.IO.DirectoryInfo] + $Path + ) + + $EmbedFileNames = @( + "ORC_embed.xml" + "DFIR-ORC_embed.xml" + "Embed.xml" + ) + + foreach($EmbedFileName in $EmbedFileNames) + { + if(Test-Path "$Path\$EmbedFileName") + { + $ToolEmbedXml = "$Path/$EmbedFileName" + if(Get-Item -Path $ToolEmbedXml | Select-Xml -XPath toolembed) + { + return $ToolEmbedXml + } + } + } + + # Lookup for an xml file with 'toolembed' as root element + $ToolEmbedXml = ` + Get-ChildItem -Filter *.xml ${Path}/ | ` + Select-Xml -XPath toolembed | ` + Select-Object -First 1 | ` + Select-Object -ExpandProperty Path + + return $ToolEmbedXml +} + +function Get-ToolEmbedOutput +{ + <# + .SYNOPSIS + Look into ToolEmbed XML configuration for '' element value + #> + [OutputType([String])] + param( + [System.IO.FileInfo] + $Path + ) + + $Output = ` + Select-Xml -XPath "toolembed/output" ${Path} | ` + Select-Object -ExpandProperty Node | ` + Select-Object -ExpandProperty InnerText + + return [Environment]::ExpandEnvironmentVariables($Output) +} + +Configure-Orc @args