deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Verification Standard: MASVS PRIVACY 2

# MASVS-PRIVACY-2

## Control

The app prevents identification of the user.

## Description

Protecting user identity is crucial. This control emphasizes the use of unlinkability techniques like data abstraction, anonymization and pseudonymization to prevent user identification and tracking.

Another key aspect addressed by this control is to establish technical barriers when employing complex 'fingerprint-like' signals (e.g. device IDs, IP addresses, behavioral patterns) for specific purposes. For instance, a fingerprint used for fraud detection should be isolated and not repurposed for audience measurement in an analytics SDK. This ensures that each data stream serves its intended function without risking user privacy.
OWASP Mobile Application Security Verification Standard: MASVS PLATFORM 3

# MASVS-PLATFORM-3

## Control

The app uses the user interface securely.

## Description

Sensitive data has to be displayed in the UI in many situations (e.g. passwords, credit card details, OTP codes in notifications). This control ensures that this data doesn't end up being unintentionally leaked due to platform mechanisms such as auto-generated screenshots or accidentally disclosed via e.g. shoulder surfing or sharing the device with another person.
OWASP Mobile Application Security Verification Standard: MASVS PRIVACY 4

# MASVS-PRIVACY-4

## Control

The app offers user control over their data.

## Description

Users should have control over their data. This control ensures that apps provide mechanisms for users to manage, delete, and modify their data, and change privacy settings as needed (e.g. to revoke consent). Additionally, apps should re-prompt for consent and update their transparency disclosures when they require more data than initially specified.
OWASP Mobile Application Security Verification Standard: MASVS PRIVACY 3

# MASVS-PRIVACY-3

## Control

The app is transparent about data collection and usage.

## Description

Users have the right to know how their data is being used. This control ensures that apps provide clear information about data collection, storage, and sharing practices, including any behavior a user wouldn't reasonably expect, such as background data collection. Apps should also adhere to platform guidelines on data declarations.
OWASP Mobile Application Security Verification Standard: MASVS CODE 3

# MASVS-CODE-3

## Control

The app only uses software components without known vulnerabilities.

## Description

To be truly secure, a full whitebox assessment should have been performed on all app components. However, as it usually happens with e.g. for third-party components this is not always feasible and not typically part of a penetration test. This control covers "low-hanging fruit" cases, such as those that can be detected just by scanning libraries for known vulnerabilities.
OWASP Mobile Application Security Verification Standard: MASVS CODE 4

# MASVS-CODE-4

## Control

The app validates and sanitizes all untrusted inputs.

## Description

Apps have many data entry points including the UI, IPC, the network, the file system, etc. This incoming data might have been inadvertently modified by untrusted actors and may lead to bypass of critical security checks as well as classical injection attacks such as SQL injection, XSS or insecure deserialization. This control ensures that this data is treated as untrusted input and is properly verified and sanitized before it's used.
OWASP Mobile Application Security Verification Standard: MASVS RESILIENCE 3

# MASVS-RESILIENCE-3

## Control

The app implements anti-static analysis mechanisms.

## Description

Understanding the internals of an app is typically the first step towards tampering with it (either dynamically, or statically). This control tries to impede comprehension by making it as difficult as possible to figure out how an app works using static analysis.
OWASP Mobile Application Security Verification Standard: MASVS RESILIENCE 4

# MASVS-RESILIENCE-4

## Control

The app implements anti-dynamic analysis techniques.

## Description

Sometimes pure static analysis is very difficult and time consuming so it typically goes hand in hand with dynamic analysis. Observing and manipulating an app during runtime makes it much easier to decipher its behavior. This control aims to make it as difficult as possible to perform dynamic analysis, as well as prevent dynamic instrumentation which could allow an attacker to modify the code at runtime.
OWASP Mobile Application Security Verification Standard: MASVS PLATFORM 1

# MASVS-PLATFORM-1

## Control

The app uses IPC mechanisms securely.

## Description

Apps typically use platform provided IPC mechanisms to intentionally expose data or functionality. Both installed apps and the user are able to interact with the app in many different ways. This control ensures that all interactions involving IPC mechanisms happen securely.
OWASP Mobile Application Security Verification Standard: MASVS CODE 2

# MASVS-CODE-2

## Control

The app has a mechanism for enforcing app updates.

## Description

Sometimes critical vulnerabilities are discovered in the app when it is already in production. This control ensures that there is a mechanism to force the users to update the app before they can continue using it.
OWASP Mobile Application Security Verification Standard: MASVS RESILIENCE 1

# MASVS-RESILIENCE-1

## Control

The app validates the integrity of the platform.

## Description

Running on a platform that has been tampered with can be very dangerous for apps, as this may disable certain security features, putting the data of the app at risk. Trusting the platform is essential for many of the MASVS controls relying on the platform being secure (e.g. secure storage, biometrics, sandboxing, etc.). This control tries to validate that the OS has not been compromised and its security features can thus be trusted.
OWASP Mobile Application Security Verification Standard: README

# MASVS PDFs Generation with Docker

The MASVS document generation is based on pandocker: [https://github.com/dalibo/pandocker/blob/latest/LICENSE](https://github.com/dalibo/pandocker/blob/latest/LICENSE).

## On your Machine

- Install Docker
- `cd` to the MASVS root folder `masvs/`
- Run the `pandoc_makedocs.sh` script with the language folder and an optional version number (**do not `cd` into `tools/docker` to run it**):

    ```sh
    $ ./tools/docker/pandoc_makedocs.sh Document 1.3
    ```

- You can set `VERBOSE=1` for a more detailed output

- For non-european languages (Hindi, Persion, CJK, etc.) you need to use the `stable-full`
  version of the docker image. Define the `TAG` variable like this :

  ```sh
  $ TAG=stable-full ./tools/docker/pandoc_makedocs.sh Document-ja
  ```

> __NOTE:__ The size `stable-full` docker image is approx. 800MB whereas the
> regular `stable` version is 330MB.


## On GitHub

Each time you push to GitHub the workflows in the [MASVS GitHub Actions](https://github.com/OWASP/masvs/actions "MASVS GitHub Actions") will be triggered. You can check what will be executed inside the folder `masvs/.github/workflows`, where `docgenerator.yml` takes care of building the Docker image and running the generation script once per language inside the container.

See the results in: <https://github.com/OWASP/masvs/actions>

## Generation Steps

### In case of a new Docker image

- Create a PR with the new changes on the Docker generation scripts.
- Once the PR is approved, create a tag:

  ```sh
    git tag -a docker-<docker-container-image-version> -m "Changeson docker image"
  ```

- Create a new image and push it to docker hub (requires being logged in to Docker hub and Docker hub membership of OWASP organization):

  ```sh
    docker build --tag owasp/masvs-docgenerator:<docker-container-image-version> tools/docker/
    docker images
    #check the output and find the tag of the masvs-generator container image you created
    docker tag <imageid> owasp/masvs-docgenerator:<docker-container-image-version>
    docker push owasp/masvs-docgenerator:<docker-container-image-version>
  ```

- Create a new PR with the new version in the `docgenerator.yml`, `release.yml`, and `run_docker_masvs_generation_on_local.sh`.

### In case of a new document

Given a new version:

- Run Docker container which will run the generation script (`pandoc_makedocs.sh`).
- The script should be self explanatory, it basically:
  - Reads the `metadata.md` for the given language folder
  - Using that metadata creates the cover dynamically including language and version (no GIMP required anymore!)
  - For more details, read the inline comments in `pandoc_makedocs.sh`.
- The PDFs will be generated in the MASVS root folder.

## Open Points (REMOVE from here when DONE!)

Finish items for [https://github.com/OWASP/masvs/issues/361](https://github.com/OWASP/masvs/issues/361):
Windows Forensic Artifact Reference: task scheduler operational log

# TaskScheduler/Operational Log
The TaskScheduler/Operational event log channel provides detailed tracing of scheduled tasks on an endpoint. 

### Behavioral Indications
 - [x] Behavioral - Persistence (TA0003)
 - [x] Behavioral - Lateral Movement (TA0008)

### Analysis Value
 - [x] Execution - Command Line Options
 - [x] Execution - First Executed
 - [x] Execution - Last Executed
 - [x] Execution - Evidence of Execution
 - [x] Execution - Time
 - [x] File - Path
 - [x] Network Activity - Source Identification

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2

## Artifact Location(s)
 - `%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx`

## Artifact Interpretation
The following event IDs are useful to hunt for persistent implants on an endpoint:

| Event ID | Description | Information |
| - | - | - |
| 106 | Scheduled Task Created | Origin Account/User |
| 140 | Scheduled Task Updated | Origin Account/User |
| 141 | Scheduled Task Deleted | Origin Account/User |
| 200 | Scheduled Task Executed | Executable file path |
| 201 | Scheduled Task Execution Completed | Executable file path |

This activity is also logged in the Security channel with more granular information, as follows:
| Event ID | Description |
| - | - |
| 4698 | Scheduled Task Created |
| 4702 | Scheduled Task Updated |
| 4699 | Scheduled Task Deleted |

## Caveats
Logging for these events is disabled by default and must be enabled to provide these artifacts.

## Analysis Tips

### Deleted Scheduled Tasks
Scheduled task deletion is a rare event on Windows systems and provides an easy to query, high-fidelity indicator of suspicious activity. The following event IDs may be queried:

 - `Windows-TaskScheduler\Operational Event 141: Scheduled Task Deleted`
 - `Security Event 4699: Scheduled Task Deleted`

### Software Installation/Uninstallation
When applications are installed on a Windows system, they will sometimes create a scheduled task to run their update functionality, making the Task Scheduler Operational log a possible option for cross-validation of other application installation artifacts such as the `Uninstall` registry key. 

### Lateral Movement through Remote Scheduled Task Installation
In the event that tasks are remotely scheduled, as is commonly seen during lateral movement attempts, this activity may be identified by observing Type 3 logons via [4624: An account was successfully logged on](/account/evtx-4624-successful-logon.md) events in close proximity to task creation.
Windows Forensic Artifact Reference: registry services

# Services Registry Key
The Services registry key, located in the SYSTEM hive, stores information regarding installed services on the endpoint. It is useful when searching for evidence of persistence mechanisms on an endpoint. 

### Behavioral Indications
 - [x] Behavioral - Persistence (TA0003)

### Analysis Value
 - [x] File - Path

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2
 - [x] Windows Server 2003 R2
 - [x] Windows Server 2003

## Artifact Location(s)
🔋 Live System:
- `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services`

🔌 Offline system:
- File: `%SystemRoot%\system32\config\SYSTEM`
- Key: `SYSTEM\{CURRENT_CONTROL_SET}\Services`

> [!NOTE]
> More information on [{CURRENT_CONTROL_SET}](/enumeration/select.md)

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
Within the `Services` key you will find subkeys, one for each service installed on an endpoint. 

The values within this key may be interpreted as follows:

| Value | Interpretation |
| --- | --- |
| DisplayName | The name of the service as it would appear in `services.msc` |
| Description | The description of the service as it would appear in `services.msc` |
| ImagePath | The path to the executable for this service |
| Start | Start mode of the service |
| Type | Type of service |

The Last Write Timestamp for each service key represents the time at which the service was installed or modified.

Additionally, for each service there may be an optional `Parameters` subkey. This key may contain any options that are passed to the executable when the service is started. Certain service installers such as NSSM (Non-Sucking Service Manager) will show the "true" executable for the service under this `Parameters` key.  

### Interpreting the ```Start``` Value
| Value | Interpretation |
| - | - |
| 0 | **Boot** - Service is a device driver |
| 1 | **System** - Service is a device driver |
| 2 | **Automatic** - Service and all of its dependency services is started on boot by the OS |
| 3 | **Manual** - Service is started manually by user interaction |
| 4 | **Disabled** - Service is disabled and cannot be started automatically or manually |
Windows Forensic Artifact Reference: evtx 5861 event consumer created

# WMI-Activity/Operational/5861: New WMI Event Consumer
This event, logged to the WMI-Activity/Operational channel, is logged when a new WMI event consumer is registered on the system.

### Behavioral Indications
 - [x] Behavioral - Persistence (TA0003)

### Analysis Value
 - [x] Account - Security Identifier (SID)

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista

## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx`

## Artifact Interpretation
Because new WMI event consumers on Windows enpoints are rather rare, this artifact provides a high-fidelity indicator of persistence activity. The information that you find in this event may vary depending on specific attacker techniques. In general, suspicious WMI event consumers will be of the following types, which are indicated in the event data for event ID `5861`:

 - `CommandLineEventConsumer`
 - `ActiveScriptEventConsumer`

## Analysis Tips
### Proximate Execution
Depending on the method an attacker has used to install a WMI event consumer, they will either have run `mofcomp.exe` or powershell. Consider cross-referencing this finding with artifacts that provide evidence of execution and searching for such activity. 

### Live System Collection
Evidence of WMI event consumers may also be queried on a live system through Powershell's Get-WMI module as follows:

`Get-WMIObject -Namespace root/Subscription -Class CommandLineEventConsumer`

## Example
![Example Image](/media/examples/wmi.png)
Windows Forensic Artifact Reference: tracing keys

# Tracing Registry Keys
Tracing registry keys can be used to indicate that a program has initiated a network connection leveraging the Windows Remote Access Server (RAS) through the `rasapi32.dll` and `rasman.dll` libraries.

### Behavioral Indications
 - [x] Behavioral - Execution (TA0002)
 
### Analysis Value
 - [x] Execution - Evidence of Execution
 - [x] Network - Evidence of Network Activity

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7

## Artifact Location(s)
🔋 Live System:
- `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing`

🔌 Offline system:
- File: `%SystemRoot%\System32\Config\SOFTWARE`
- Key: `SOFTWARE\Microsoft\Tracing`

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
Within the `SOFTWARE\Microsoft\Tracing` key, there may be multiple subkeys with the following name formats of interest:

 - `{EXECUTABLE_FILENAME}_RASMANCS`
 - `{EXECUTABLE_FILENAME}_RASAPI32`

These filenames will not include the executable extension `.exe`.

The Last Write Timestamp of the registry key provides the first time an executable has loaded `rasapi32.dll` and `rasman.dll` in order to establish a remote network connection, typically to download a file. 

> [!IMPORTANT]
> Subsequent activity of this nature will not update the Last Write Timestamp of the registry key.
Windows Forensic Artifact Reference: evtx 4778 session reconnected

# Security/4778: Session reconnected
This event, logged to the Security channel, is logged when an existing RDP terminal session is connected to, but it may also be logged as a result of Fast User Switching. Fast User Switching is a feature in newer versions of Windows (Vista+) that allows multiple users to be logged in to a single system concurrently. 

> [!IMPORTANT]  
> This event is logged on the **destination** endpoint. 

> [!NOTE]
> In windows XP, the corresponding Event ID is `682`.

### Behavioral Indications
 - [x] Behavioral - Lateral Movement (TA0008)

### Analysis Value
 - [x] Account - Login History
 - [x] Account - Logon ID
 - [x] Network Activity - Source Identification

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2
 - [x] Windows Server 2008

## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Security.evtx`

## Artifact Interpretation
This artifact can provide the **source** client name and IP address of the connecting endpoint. 

The fields may be interpreted as follows:

| Field Name | Interpretation |
| - | - |
| Subject / Account Name | The name of the account for this RDP session |
| Subject / Logon ID | [Logon ID](/README.md/#account---logon-id) for this session that can be used to correlate with other events |
| Additional Information / Client Name | The name of the source host |
| Additional Information / Client Address | The IP address of the source host |

## Caveats
This event is not unique to RDP sessions. During Fast User Switching events, this event will be logged with the session name set to `Console` and the Client Address set to `LOCAL`. For RDP sessions, the session name will look like: `RDP-Tcp#1`.
Windows Forensic Artifact Reference: evtx 2071 firewall windows 11

# Microsoft-Windows-Windows Firewall With Advanced Security/Firewall/2071: Firewall Rule Added
This event indicates that a new firewall rule has been added to the Windows Firewall. While currently unique to newer versions of Windows 11, it is functionally similar to [Microsoft-Windows-Windows Firewall With Advanced Security/Firewall/2004: Firewall Rule Added](/network/evtx-2004-firewall.md).
Windows Forensic Artifact Reference: evtx 2073 firewall windows 11

# Microsoft-Windows-Windows Firewall With Advanced Security/Firewall/2073: Firewall Rule Modified
This event indicates that a Windows Defender Firewall rule has been modified. While currently unique to newer versions of Windows 11, it is functionally similar to [Microsoft-Windows-Windows Firewall With Advanced Security/Firewall/2005: Firewall Rule Modified](/network/evtx-2005-firewall.md).
Windows Forensic Artifact Reference: evtx 8003 wlan disconnect

# Microsoft-Windows-WLAN-AutoConfig/Operational/8003: Successfully Disconnected from a Wireless Network
This event indicates that the system has disconnected from a wireless area network.

### Analysis Value
 - [x] Network - Evidence of Network Activity
 - [x] Network - Wireless Activity

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista


## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx`

## Artifact Interpretation
When logged, this event indicates that the system has successfully disconnected from a wireless area network. This event provides the following additional information regarding the connection:

| XML Path                              | Interpretation  |
| ------------------------------------- | --------------- |
| EventData/InterfaceGuid               | The wireless adapter's [Interface GUID](/enumeration/network-cards.md) |
| EventData/InterfaceDescription        | The name of the wireless adapter |
| EventData/SSID                        | The SSID of the network that was connected to |
| EventData/Reason              | Provides the reason this network was disconnected from |

Together with the event [Microsoft-Windows-WLAN-AutoConfig/Operational/8001: Successfully Connected to a Wireless Network](network/evtx-8001-wlan-connect), this can be used to determine a timespan during which a system was connected to a wireless area network.

## Example
```
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580d7dd-0379-4658-9870-d5be7d52d6de}" /> 
  <EventID>8003</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>24010</Task> 
  <Opcode>192</Opcode> 
  <Keywords>0x[PII_REDACTED]000600</Keywords> 
  <TimeCreated SystemTime="2023-06-16T03:05:19.9479495Z" /> 
  <EventRecordID>1321</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4276" ThreadID="5544" /> 
  <Channel>Microsoft-Windows-WLAN-AutoConfig/Operational</Channel> 
  <Computer>HLPC01</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="InterfaceGuid">{a7d8885d-10c1-43d4-9e1e-0a7b2678f020}</Data> 
  <Data Name="InterfaceDescription">Intel(R) Wi-Fi 6 AX200 160MHz</Data> 
  <Data Name="ConnectionMode">Automatic connection with a profile</Data> 
  <Data Name="ProfileName">SSID_TEST</Data> 
  <Data Name="SSID">SSID_TEST</Data> 
  <Data Name="BSSType">Infrastructure</Data> 
  <Data Name="Reason">The network is disconnected due to a policy disabling auto connect on this interface.</Data> 
  <Data Name="ConnectionId">0x1</Data> 
  <Data Name="ReasonCode">5</Data> 
  </EventData>
  </Event>
```

<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>