deardaniel/secdata-raw huggingface dataset:
Windows Forensic Artifact Reference: rdp bitmap cache

# RDP Persistent Bitmap Cache
The persistent bitmap cache is a feature of Microsoft Remote Desktop's GDI Acceleration Extension that stores small chunks of images that were present during an RDP session. The goal is to reduce the bandwidth used by a remote desktop connection to increase performance at the cost of storage. As a forensic artifact, these bitmaps are valuable as they provide, to some extent, visual history of RDP sessions that have taken place from a system.

### Behavioral Indications
 - [x] Behavioral - Lateral Movement (TA0008)

### Analysis Value
 - [x] Network - Evidence of Network Activity

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP

## Artifact Location(s)
 - `%UserProfile%\AppData\Local\Microsoft\Terminal Server Client\Cache` (Windows Vista and later)
 - `C:\Documents and Settings\{USERNAME}\Local Settings\Application Data\Microsoft\Terminal Server Client\Cache` (Windows XP)

## Artifact Parsers
 - [bmc-tools](https://github.com/ANSSI-FR/bmc-tools)

## Artifact Interpretation
In this artifact's directory, you will find two types of files, each serving a similar purpose, `.bmc` and `.bin`. The `.bmc` files are typically observed on older versions of Microsoft Remote Desktop client, whereas newer versions will store data in the `.bin` files. The [bmc-tools](https://github.com/ANSSI-FR/bmc-tools) utility is able to parse both of these filetypes.

When the bitmap data is extracted, it will provide tiles containing snapshots of activity that has taken place interactively through an RDP session. They will be scrambled in no particular order, so it may take some work to stitch these images back together in a coherent manner.

The presence of these `.bmc` and `.bin` files indicates that the system on which they were found established an RDP connection to another system through RDP.

In modern versions of Microsoft Remote Desktop Client, the `.bmc` file is created when and RDP connection is established, and the `.bin` files are created or modified when that RDP connection is closed. As such, the most recent modification timestamp among these files indicates the last time an RDP connection was established from the system, assuming that `Persistent Bitmap Caching` was enabled for that session. In the case that it was not enabled, neither the `.bmc` nor the `.bin` files will be created.
Windows Forensic Artifact Reference: evtx 2052 firewall windows 11

# Microsoft-Windows-Windows Firewall With Advanced Security/Firewall/2052: Firewall Rule Deleted
This event indicates that a firewall rule has been deleted from the Windows Firewall. While currently unique to newer versions of Windows 11, it is functionally similar to [Microsoft-Windows-Windows Firewall With Advanced Security/Firewall/2006: Firewall Rule Deleted](/network/evtx-2006-firewall.md).
Windows Forensic Artifact Reference: current version

# CurrentVersion Registry Key
The `CurrentVersion` registry key will provide you with the current operating system's version, service pack, and date of installation.

### Analysis Value
 - [x] Endpoint - Enumeration

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2
 - [x] Windows Server 2008
 - [x] Windows Server 2003 R2
 - [x] Windows Server 2003

## Artifact Location(s)
🔋 Live System:
- `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion`

🔌 Offline system:
- File: `%SystemRoot%\System32\config\SOFTWARE`
- Key: `SOFTWARE\Microsoft\Windows NT\CurrentVersion`

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
The `ProductName` value will provide the OS, such as `Windows Server 2019`.

The `ReleaseId` value will provide the version of the specified OS. 

The `InstallDate` is an Epoch timestamp of when the OS was either first installed or received a major update, or was reset. 

## Example
```
PS> Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name *

SystemRoot                : C:\Windows
BaseBuildRevisionNumber   : 1
BuildBranch               : vb_release
BuildGUID                 : ffffffff-ffff-ffff-ffff-ffffffffffff
BuildLab                  : 19041.vb_release[PII_REDACTED]
BuildLabEx                : 19041.1.amd64fre.vb_release[PII_REDACTED]
CompositionEditionID      : Enterprise
CurrentBuild              : 19044
CurrentBuildNumber        : 19044
CurrentMajorVersionNumber : 10
CurrentMinorVersionNumber : 0
CurrentType               : Multiprocessor Free
CurrentVersion            : 6.3
EditionID                 : Professional
EditionSubManufacturer    :
EditionSubstring          :
EditionSubVersion         :
InstallationType          : Client
InstallDate               :[PII_REDACTED]
ProductName               : Windows 10 Pro
ReleaseId                 : 2009
SoftwareType              : System
UBR                       : 3086
PathName                  : C:\Windows
ProductId                 : 00330-80000-00000-AA949
DisplayVersion            : 21H2
RegisteredOwner           : user1
RegisteredOrganization    :
InstallTime               :[PII_REDACTED]29018501
```
<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: network cards

# NetworkCards Registry Key
The `NetworkCards` registry key will provide the name and interface GUID of the system's attached network interface adatpers.

### Analysis Value
 - [x] Endpoint - Enumeration

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2
 - [x] Windows Server 2008
 - [x] Windows Server 2003 R2
 - [x] Windows Server 2003

## Artifact Location(s)
🔋 Live System:
- `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\*`

🔌 Offline system:
- File: `%SystemRoot%\System32\config\SOFTWARE`
- Key: `SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\*`


## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
Each network interface adapter will have its own subkey with the following values:

 - `Description`: The name of the network adapter
 - `ServiceName`: The GUID of the network adapter

## Examples

```
Description     REG_SZ      Microsoft Hyper-V Network Adapter
ServiceName     REG_SZ      {4C7FB48D-33EB-4277-A3FB-37D5EF39C990}
```

<sup><sub>This example was produced on Windows Server 2019 Standard, Version 10.0.17763 Build 17763</sub></sup>


```
Description     REG_SZ      Realtek USB GbE Family Controller
ServiceName     REG_SZ      {737FB1FE-88FF-4F5E-943A-A46C057E68B9}
```

<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: select

# Select Registry Key
The `Select` registry key provides the number of the system's `CurrentControlSet`. The `CurrentControlSet` contains important configuration for the Windows operating system, and several different Control Sets may be available within a system's registry. 

In general, `ControlSet001` will be the most recent Control Set that has been booted under, whereas `ControlSet002` functions as a backup of a known-good state for the Control Set. 

### Analysis Value
 - [x] Endpoint - Enumeration

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2
 - [x] Windows Server 2008
 - [x] Windows Server 2003 R2
 - [x] Windows Server 2003

## Artifact Location(s)
🔋 Live System:
- `HKEY_LOCAL_MACHINE\SYSTEM\Select`

🔌 Offline system:
- File: `%SystemRoot%\System32\config\SYSTEM`
- Key: `SYSTEM\Select`

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
Within the `Select` key, the value named `Current` identifies the `CurrentControlSet` by an integer. If the value is `1` for instance, that means that the `CurrentControlSet` on a live system will point to `ControlSet001`. 

## Example
In the following example, the `Select` value's data is `1`, indicating that the CurrentControlSet is `ControlSet001`.
```
PS> Get-ItemProperty -Path "HKLM:\SYSTEM\Select" -Name *

Current       : 1
Default       : 1
Failed        : 0
LastKnownGood : 1
```
<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: time zone information

# TimeZoneInformation Registry Key
The `TimeZoneInformation` registry key provides the current system time zone. This is useful for consolidating separate artifacts found on a system to align with one time zone, such as UTC. 

### Analysis Value
 - [x] Endpoint - Enumeration

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2
 - [x] Windows Server 2008
 - [x] Windows Server 2003 R2
 - [x] Windows Server 2003

## Artifact Location(s)
🔋 Live System:
- `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation`

🔌 Offline system:
- File: `%SystemRoot%\System32\config\SYSTEM`
- Key: `SYSTEM\{CURRENT_CONTROL_SET}\Control\TimeZoneInformation`

> [!NOTE]
> More information on [{CURRENT_CONTROL_SET}](/enumeration/select.md)

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
Within the `TimeZoneInformation` registry key, the value name `TimeZoneKeyName` will contain the current system time zone. 

For examples of what this may look like, execute the command `Get-TimeZone -ListAvailable` in PowerShell and look at the `Id` key. 

The `Bias` key contains the numer of minutes between UTC and the system's selected time zone, such that `UTC = Local System Time + Bias`.

## Example
```
PS> Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" -Name *

Bias                        : 360
DaylightBias                :[PII_REDACTED]
DaylightName                : @tzres.dll,-161
DaylightStart               : {0, 0, 3, 0...}
StandardBias                : 0
StandardName                : @tzres.dll,-162
StandardStart               : {0, 0, 11, 0...}
TimeZoneKeyName             : Central Standard Time
DynamicDaylightTimeDisabled : 0
ActiveTimeBias              : 300
```
<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: computer name

# ComputerName Registry Key
The `ComputerName` registry key will provide the Computer Name of the endpoint. 

### Analysis Value
 - [x] Endpoint - Enumeration

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2
 - [x] Windows Server 2008
 - [x] Windows Server 2003 R2
 - [x] Windows Server 2003

## Artifact Location(s)
🔋 Live System:
- `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName`

🔌 Offline system:
- File: `%SystemRoot%\System32\config\SYSTEM`
- Key: `SYSTEM\{CURRENT_CONTROL_SET}\Control\ComputerName\ComputerName`

> [!NOTE]
> More information on [{CURRENT_CONTROL_SET}](/enumeration/select.md)

## Artifact Parsers
 - RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation
The `ComputerName` value's data field will provide the system's configured Computer Name. 

## Example
```
PS> Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" -Name *

ComputerName : HLPC01
```
<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: evtx 4104 script block logging

# Microsoft-Windows-PowerShell/Operational/4104: PowerShell Script Block Logging
Now enabled by default, this event is logged whenever a script is run through PowerShell. 

### Behavioral Indications
 - [x] Behavioral - Execution (TA0002)

### Analysis Value
 - [x] Execution - Process Tree
 - [x] Execution - First Executed
 - [x] File - Path
 - [x] Account - Security Identifier (SID)
 
## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7

## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx`

## Artifact Interpretation

The `Level` field (available in PowerShell5.0) may indicate a suspicious script. If its value is `Warning` this indicates the script was flagged as suspicious based on its contents. 

The `ScriptBlock ID` is used to uniquely identify a script across multiple `4104` events. Large scripts may be split across multiple events, to reconstruct the full script, concatenate all the events with this unique ID together. 

The `Path` field indicates the full path to the executed script. 

The `ProcessID` field indicates the parent process ID (PID) that executed the script. 

The `UserID` field contains the SID of the user that executed the script. 

### Time of Execution
The timestamp of the event indicates the time at which the script, identified by the field `ScriptBlock ID` was executed for the first time. 

### Process Genealogy
The `Creator Process ID` field may be cross-referenced with [Security/4688: A new process has been created](execution/evtx-4688-process-created.md).

## Caveats
This event is only logged the first time that a script is executed.

This event will not capture the resultant output of an executed script as module logging does. 

## Example

```
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-PowerShell" Guid="{a0c1853b-5c40-4b15-8766-3cf1c58f985a}" /> 
  <EventID>4104</EventID> 
  <Version>1</Version> 
  <Level>5</Level> 
  <Task>2</Task> 
  <Opcode>15</Opcode> 
  <Keywords>0x0</Keywords> 
  <TimeCreated SystemTime="2023-11-06T20:24:01.8911267Z" /> 
  <EventRecordID>194</EventRecordID> 
  <Correlation ActivityID="{7af08a74-10ed-0003-e08b-f07aed10da01}" /> 
  <Execution ProcessID="4328" ThreadID="4600" /> 
  <Channel>Microsoft-Windows-PowerShell/Operational</Channel> 
  <Computer>DESKTOP-TUMSOE7</Computer> 
  <Security UserID="S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1001" /> 
  </System>
- <EventData>
  <Data Name="MessageNumber">1</Data> 
  <Data Name="MessageTotal">1</Data> 
  <Data Name="ScriptBlockText">Invoke-WebRequest -Uri "https://example.com" -OutFile "C:\Temp\test.exe"</Data> 
  <Data Name="ScriptBlockId">808e4d85-977e-4418-9218-59dd2aa1b0ef</Data> 
  <Data Name="Path" /> 
  </EventData>
  </Event>
```
Windows Forensic Artifact Reference: program compatibility assistant

# Program Compatibility Assistant (PCA) - PcaAppLaunchDic.txt
Program Compatibility Assistant (PCA) is a feature introduced since Windows 8 intended for application compatibility purposes. New to Windows 11 (22H2 Update) is the ability to extract detailed evidence of execution from it. 

### Behavioral Indications
 - [x] Behavioral - Execution (TA0002)

### Analysis Value
 - [x] Execution - Evidence of Execution
 - [x] Execution - Last Executed
 - [x] File - Path

## Operating System Availability
 - [x] Windows 11 (⚠️ Recent builds only)

## Artifact Location(s)
- `%SystemRoot%\AppCompat\pca\PcaAppLaunchDic.txt`

## Artifact Interpretation - PcaAppLaunchDic.txt
This is a pipe-delimited text file that contains the following information:

`{Executable Full Path}|{Most Recent Execution Timestamp}`

The `{Executable Full Path}` provides the full path to the executable that was run. 

The `{Most Recent Execution Timestamp}` execution timestamp is in UTC and represents the last time the specified executable was run.

Any executable format, such as `.scr` and `.exe` may be logged in this location. This artifact will also log executables run from file shares and USB devices.

## Examples

```
\\NAS01-WS2K19\sysinternals\accesschk.exe|2023-05-03 01:55:27.884
C:\Users\user1.domain\Desktop\accesschk.exe|2023-05-03 01:56:00.799
```

<sup><sub>This example was produced on Windows 11 Pro, Version 10.0.22621 Build 22621</sub></sup>

## Caveats
Based on testing on Windows 11 Pro Build 22621, it seems that executions from the command line are not logged to this artifact.
Windows Forensic Artifact Reference: evtx 9707 shell core

# Microsoft-Windows-Shell-Core/Operational/9707: Command Execution Started
This event indicates that a logon task, found in [Run/RunOnce Keys](/persistence/reg-run-runonce.md) has executed.

### Behavioral Indications
 - [x] Behavioral - Execution (TA0002)
 - [x] Behavioral - Persistence (TA0003)

### Analysis Value
 - [x] Account - Security Identifier (SID)
 - [x] Execution - Command Line Options
 - [x] Execution - Permissions / Account
 - [x] Execution - Process Tree
 - [x] Execution - Evidence of Execution
 - [x] Execution - Time

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista


## Artifact Location(s)
- `%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx`

## Artifact Interpretation

### Account - Security Identifier (SID)
The `System/Security/UserID` field of this command provides the [Security Identifier (SID)](/README.md/#account---security-identifier-sid) of the account that triggered the command to run.

### Execution - Command Line Options
The full command line options for the command that was run will be available in the `EventData/Command` field of this event. 

### Execution - Process Tree
The Process and Thread ID of the command that was run will be available in the `System/Execution/ProcessID` and `System/Execution/ThreadID` fields of this event, respectively. 

### Execution - Evidence of Execution
The presence of this event indicates that the given command was run and that an entry either exists as a [Run Key](/persistence/reg-run-runonce.md) or existed as a [RunOnce Key](/persistence/reg-run-runonce.md).

### Execution - Time
The timestamp of the event indicates the time at which the command was run.

## Example
On an example system, the following registry key exists:

```
Path: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\exampletask
Value: "C:\Temp\example.exe" -silent
```

During a user logon, the following `Microsoft-Windows-Shell-Core/Operational/9707` event is logged:

```
- 
<Event
	xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
-   <System>
		<Provider Name="Microsoft-Windows-Shell-Core" Guid="{30336ed4-e327-447c-9de0-51b652c86108}" />
		<EventID>9707</EventID>
		<Version>0</Version>
		<Level>4</Level>
		<Task>9707</Task>
		<Opcode>1</Opcode>
		<Keywords>0x[PII_REDACTED]010000</Keywords>
		<TimeCreated SystemTime="2023-04-30T15:57:41.0345751Z" />
		<EventRecordID>21933</EventRecordID>
		<Correlation />
		<Execution ProcessID="5072" ThreadID="11548" />
		<Channel>Microsoft-Windows-Shell-Core/Operational</Channel>
		<Computer>HLPC01</Computer>
		<Security UserID="S-1-5-2[PII_REDACTED][PII_REDACTED][PII_REDACTED]-1001" />
	</System>
-   <EventData>
		<Data Name="Command">example.exe" -silent</Data>
	</EventData>
</Event>
```

<sup><sub>This example was produced on Windows 10, Version 10.0.19044 Build 19044</sub></sup>
Windows Forensic Artifact Reference: shimcache

# ShimCache / Application Compatibility Cache
ShimCache is a registry artifact of the application compatibility database to provide backwards-compatibility between operating system versions. It may provide forensic evidence of execution on a system.

### Behavioral Indications
 - [x] Behavioral - Execution (TA0002)

### Analysis Value
 - [x] Execution - Evidence of Execution
 - [x] File - Last Modified
 - [x] File - Path
 - [x] File - Size

## Operating System Availability
 - [x] Windows 11
 - [x] Windows 10
 - [x] Windows 8
 - [x] Windows 7
 - [x] Windows Vista
 - [x] Windows XP
 - [x] Windows Server 2019
 - [x] Windows Server 2016
 - [x] Windows Server 2012 R2
 - [x] Windows Server 2012
 - [x] Windows Server 2008 R2
 - [x] Windows Server 2008
 - [x] Windows Server 2003 R2
 - [x] Windows Server 2003

## Artifact Location(s)
🔋 Live System:
 - Windows XP: `SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatibility\AppCompatCache`
 - Windows Vista/7/8/10/11: `SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache`

🔌 Offline system:
 - File: `%SystemRoot%\System32\config\SYSTEM`
 - Windows XP: `SYSTEM\{CURRENT_CONTROL_SET}\Control\SessionManager\AppCompatibility\AppCompatCache`
 - Windows Vista/7/8/10: `SYSTEM\{CURRENT_CONTROL_SET}\Control\Session Manager\AppCompatCache\AppCompatCache`

> [!NOTE]
> More information on [{CURRENT_CONTROL_SET}](/enumeration/select.md)

## Artifact Parsers
 - [ShimCacheParser.py](https://github.com/mandiant/ShimCacheParser)
 - Volatility's shimcachemem plugin

## Caveats
An entry into the ShimCache alone is not conclusive enough to prove execution, and this artifact should be cross-referenced with other similar artifacts to be certain of execution.

The ShimCache registry data is written on system shutdown only and the data extracted directly from the registry may be incomplete. Under these circumstances it is necessary to procure a memory dump to exctract a complete dataset from this forensic artifact.
Windows Forensic Artifact Reference: mft

# Master File Table
The Mast File Table (MFT) is a forensic artifact present on NTFS volumes that maintains a record of every file on the volume (inlcuding itself), providing detailed timestamps, size information, alternate data streams, access control lists, and more. In some cases, the MFT may even include "resident" files that can be extracted directly from the MFT without having the rest of the volume. 

### Analysis Value
 - [x] File - Creation
 - [x] File - Last Modified
 - [x] File - Path
 - [x] File - Size

## Operating System Availability
 - NTFS Volumes

## Artifact Location(s)
 - `$MFT`

## Artifact Parsers
 - Velociraptor
 - jp (TZWorks)
 - MFTEcmd (Eric Zimmerman)
 - KAPE can be used to extract

## Artifact Interpretation

WIP

### Resident Files
Depending on certain filesystem variables, some files may be "resident" within the MFT, meaning the entire file's contents are contained in its MFT entry. The maximum size limit is typically around 600 bytes. 

## Caveats
The MFT when extracted may not show deleted (deallocated) files. Consider searching MFTs located in Volume Shadow Copies for evidence of deleted files, or the USN Journal if the time range is appropriate.