Meta tags:
description=random musings on DFIR topics;

Headings (most frequently used words):

searches, data, what, an, their, own, administrator, the, how, posts, mailbox, onedrive, iconcache, windows, and, on, funday, searching, can, did, find, user, someone, else, recent, copy, wiping, thinkdfir, question, about, arbitrary, values, in, usb, registry, keys, trust, but, verify, amcache, originalfilename, field, isn, always, accurate, examining, database, sometimes, pe, version, information, don, get, along, cached, screenshots, 11, sunday, for, srumday, generation, analysis, windows11, wordwheelquery, woes, be, of, webassist, ance, cpy, jmp, navigation, random, musings, dfir, topics, it, started, we, test, is, parsing, interesting, observations, was, bug, you, so, summary, follow, blog, via, email, archives, copying, between, two, drives, using, paste, uploading, to, online, server, files, transfer, disk,

Text of the page (most frequently used words):
the (315), and (106), this (75), that (67), but (59), for (55), search (49), you (43), was (43), windows (42), file (35), with (34), data (34), there (28), #amcache (27), originalfilename (27), some (26), not (25), then (25), get (23), can (23), into (23), what (21), from (20), #searches (19), how (18), have (18), here (17), 2025 (17), because (17), version (16), will (16), find (15), database (15), are (15), onedrive (15), their (14), see (14), about (14), did (14), name (13), when (13), something (13), look (13), also (13), had (13), which (13), they (13), more (12), information (12), else (12), one (12), test (12), really (12), ran (12), where (12), doesn (12), mailbox (12), other (11), phill (11), moore (11), bit (11), time (11), around (11), just (11), access (11), email (10), account (10), sometimes (10), iconcache (10), only (10), first (10), all (10), generation (10), use (9), out (9), isn (9), 2018 (9), 2019 (9), your (9), new (9), read (9), copy (9), would (9), path (9), recorded (9), didn (9), didnt (9), like (9), logged (9), administrator (9), artifact (9), parse (9), content (8), don (8), january (8), folder (8), explorer (8), nothing (8), know (8), has (8), should (8), bytes (8), disk (8), either (8), interesting (8), own (8), velociraptor (8), template (8), versioninformation (8), comments (7), june (7), screenshots (7), july (7), 2026 (7), october (7), may (7), 2020 (7), funday (7), take (7), analysis (7), haven (7), type (7), results (7), users (7), show (7), using (7), dont (7), same (7), exe (7), files (7), user (7), through (7), embedded (7), our (7), december (6), april (6), registry (6), posts (6), march (6), 2023 (6), wordwheelquery (6), searching (6), microsoft (6), next (6), definitely (6), below (6), looked (6), might (6), still (6), server (6), value (6), why (6), could (6), activity (6), two (6), sure (6), way (6), challenge (6), query (6), case (6), hypothesis (6), specific (6), format (6), filesha1 (6), regex (6), description (6), uses (5), comment (5), com (5), always (5), august (5), question (5), values (5), 2017 (5), select (5), sunday (5), track (5), unfortunately (5), week (5), added (5), research (5), though (5), string (5), key (5), simple (5), testing (5), eraser (5), apptimelineprovider (5), table (5), few (5), different (5), interestingly (5), both (5), won (5), process (5), thought (5), found (5), going (5), expect (5), want (5), ediscovery (5), delegated (5), returned (5), portal (5), well (5), couple (5), screenshot (5), say (5), stored (5), these (5), directory (5), details (5), binary (5), paths (5), mimikatz (5), 010 (5), sha1 (5), entrypath (5), hunt (5), original (5), required (4), write (4), thinkdfir (4), now (4), back (4), field (4), accurate (4), arbitrary (4), usb (4), keys (4), 2021 (4), blog (4), class (4), forensic (4), let (4), start (4), check (4), looking (4), able (4), shell (4), items (4), term (4), likely (4), seems (4), instead (4), previous (4), artefact (4), much (4), wiping (4), wiped (4), sdelete (4), gets (4), uploading (4), chrome (4), wasn (4), across (4), reason (4), srumecmd (4), per (4), showed (4), written (4), 750mb (4), shows (4), being (4), running (4), help (4), expected (4), long (4), after (4), yet (4), within (4), made (4), were (4), times (4), aedt (4), started (4), cases (4), following (4), present (4), ual (4), record (4), again (4), viewed (4), link (4), admin (4), someone (4), put (4), somewhere (4), doing (4), them (4), last (4), localappdata (4), default (4), snipping (4), tool (4), api (4), earlier (4), maybe (4), executable (4), machine (4), hunting (4), size (4), icons (4), actual (4), icon (4), lot (4), instances (4), pe_originalfilename (4), condition (4), member (4), filename (4), cookies (3), website (3), log (3), join (3), cached (3), along (3), examining (3), trust (3), verify (3), recent (3), september (3), november (3), february (3), follow (3), address (3), during (3), copied (3), operation (3), cool (3), copies (3), recently (3), online (3), post (3), need (3), local (3), records (3), timestamp (3), tracked (3), however (3), inside (3), came (3), accessed (3), investigations (3), rather (3), than (3), return (3), any (3), box (3), turn (3), tables (3), does (3), bytessent (3), srumdump (3), referenced (3), twice (3), think (3), run (3), guess (3), full (3), transfer (3), enough (3), easily (3), exactly (3), right (3), uploaded (3), upload (3), current (3), wanted (3), module (3), directly (3), since (3), copying (3), google (3), drive (3), went (3), got (3), between (3), many (3), srum (3), complete (3), logs (3), been (3), very (3), mostly (3), enabled (3), sharepoint (3), result (3), clicking (3), purview (3), evidence (3), work (3), done (3), outlook (3), anything (3), indicate (3), who (3), snips (3), metadata (3), while (3), ago (3), properties (3), another (3), copilot (3), probably (3), together (3), bug (3), part (3), images (3), databases (3), thumbcache (3), dfir (3), deeper (3), ofn (3), source (3), mismatches (3), amcacheglob (3), keypathglob (3), sha1regex (3), pathregex (3), nameregex (3), expand (3), above (3), privacy (2), site (2), bar (2), view (2), sign (2), subscribed (2), subscribe (2), already (2), wordpress (2), 2022 (2), 2024 (2), archives (2), enter (2), cpy (2), jmp (2), webassist (2), ance (2), windows11 (2), woes (2), srumday (2), update (2), associated (2), interaction (2), relates (2), teaching (2), for500 (2), exploring (2), further (2), partially (2), almost (2), menu (2), packages (2), typedpaths (2), took (2), crumb (2), location (2), performed (2), against (2), note (2), window (2), index (2), changed (2), shame (2), overall (2), basically (2), dropdown (2), populated (2), populate (2), least (2), versions (2), hive (2), nice (2), sans (2), stuff (2), consistent (2), appresourceusageinfo (2), weird (2), hard (2), networkusages (2), spike (2), computer (2), worked (2), fine (2), underlying (2), once (2), wipe (2), used (2), adx (2), whether (2), network (2), traffic (2), 13t10 (2), 00z (2), sent (2), whatever (2), great (2), filtering (2), itself (2), number (2), appresourceuseinfo (2), output (2), libese (2), dissect (2), chose (2), kape (2), manually (2), installed (2), virtual (2), click (2), change (2), section (2), close (2), most (2), created (2), drives (2), paste (2), utc (2), validate (2), document (2), play (2), understand (2), kind (2), thing (2), observed (2), makes (2), happen (2), seen (2), text (2), settings (2), although (2), web (2), txt (2), gave (2), owa (2), searched (2), actions (2), https (2), before (2), hits (2), tenancy (2), tell (2), make (2), item (2), things (2), little (2), figured (2), asked (2), thanks (2), reboot (2), try (2), pictures (2), save (2), filenames (2), come (2), open (2), allow (2), findings (2), apis (2), pulls (2), header (2), story (2), programs (2), second (2), working (2), pestudio (2), properly (2), self (2), extracting (2), cab (2), hello2 (2), works (2), binaries (2), hello (2), script (2), digging (2), according (2), lifting (2), extracted (2), parses (2), parsing (2), match (2), fact (2), useful (2), threat (2), paper (2), hash (2), possible (2), code (2), super (2), tools (2), ransomware (2), even (2), program (2), cover (2), mean (2), 0x0507 (2), win11 (2), editor (2), executables (2), called (2), leave (2), set (2), filter (2), exists (2), real (2), detection (2), authenticode (2), accessor (2), auto (2), hve (2), latest (2), exist (2), amcacheparser (2), variable (2), example (2), handful (2), random (2), musings (2), topics (2), continuing, agree, including, control, cookie, policy, loading, collapse, manage, subscriptions, reader, report, subscribers, top, powered, month, receive, notifications, via, older, navigation, discovered, automaticdestination, jumplist, singapore, ish, discovery, jumplists, newish, edge, worth, blogpost, intro, placeholder, saw, conversation, listserv, limited, brief, says, appdata, determine, place, potentially, outside, scope, displayname, 20results, 20in, 20systemindex, system, generic, 5cprogramdata, 5cmicrosoft, 5csearch, 5cdata, 5capplications, 5cwindows, 5cgatherlogs, 5csystemindex, abcdefgfedcba, depend, dialog, side, procmon, getting, queried, downloaded, conducted, pressing, querying, immediately, available, updates, ntuser, dat, forensafe, describes, article, fellow, instructors, mattia, epifani, noted, 23h2, longer, sounds, experience, relation, alone, erasing, give, sizes, granted, stand, transferring, volumes, foregroundbyteswritten, learn, summary, timestamps, breaking, mind, ones, notes, hour, checked, confusing, background, learning, potential, summarise, discrete, amounts, spikes, similar, events, 144, 883419280, column, larger, overhead, adds, simplicity, graphing, features, graph, granularity, pretty, grabbed, realise, ingest, fields, convert, tracks, separate, networkconnections, decided, firstly, free, secondly, fantastic, quick, azure, reparing, esentutl, net, collect, fork, ese, choose, erase, outcomes, lastly, command, powershell, finished, accidently, killed, pasted, vhdx, mounted, large, garbage, disks, 2gb, each, 786, 432, 000, 24h2, daily, 716, service, choice, must, relying, its, validation, counters, people, cite, collected, metrics, accurately, capture, skew, david, cowen, forensics, states, entra, kql, cloudevents, practice, regards, sense, casework, include, star, logging, occurred, event, specifically, enable, addendum2, gives, cant, elsewhere, export, addendum, operations, listviewed, page, application, display, clearly, stated, app, modern, despite, contents, test2, generated, direct, bother, mailboxownerupn, victim, figure, resources, quite, activities, retrieved, folders, clicked, inbox, listed, 23am, shared, adding, delegation, cloud, exchange, 22am, day, send, wording, testemaildelegatedaccess, couldn, 15am, weirdly, exact, reran, testkitchen, couldnt, strange, 09am, 07am, redirects, redo, proved, annoying, point, interest, containing, testkitchensearchemail, anyways, unique, 05am, step, accounts, setup, making, assigned, licenses, forget, generate, fairly, login, wait, until, filtered, entries, left, behind, scenarios, occur, asks, involves, reviewing, 365, uals, better, excuse, dev, originally, request, fell, basket, friend, generously, donated, his, zach, saves, remember, days, lasted, screensketch_8wekyb3d8bbwe, tempstate, decide, off, stop, saving, shown, talk, saved, briefly, deprecated, replaced, snip, sketch, press, shift, screen, cache, groundbreaking, share, fun, wrote, assume, wary, correct, print, extracts, grain, salt, years, combo, told, tweaking, sidebar, mirrored, reasons, pane, prompts, prints, world, compiled, gcc, embeds, theory, extra, represent, grabs, velo, excels, combining, various, artefacts, versus, manual, checking, noticed, actually, velocidex, funny, issues, updating, keep, plugging, away, dots, increased, maximum, dies, support, ever, knows, individual, based, dll, less, crc, netscan, myriad, rmm, usually, renamed, clue, circumstances, incorporate, didier, stevens, explore, execution, existence, shutdown, everything, prior, startup, guessing, upgrade, win10, recreated, unless, force, handles, formats, bothered, those, observations, said, too, downside, joining, sets, viewer, tested, looks, 0x0506, cpp, python, lowercase, onto, sift, workstations, museum, grab, documentation, heavy, identify, release, iconcache_, contains, recall, without, rebuilding, spot, special, former, coworkers, cassie, yogesh, assistance, picking, apart, year, whole, picked, standard, triage, collection, keyword, xways, over, entire, package, names, malicious, caught, eye, passing, never, bought, down, rabbit, hole, difference, unusual, moral, double, dug, compromise, randomly, word, personal, walking, logic, sensitivity, hashes, parsed, comparison, compare, originalfileaname, 31mb, limit, legitimate, currently, clean, suggested, vql, manager, bouncing, ball, vql_suggestion, notebook, entrytype, inventoryapplicationfile, parse_pe, sources, entry, sha1s, glob, hidden, root, inventory, systemroot, appcompat, parameters, www, ssi, gouv, uploads, anssi, coriin_2019, analysis_amcache, pdf, reference, helps, author, mismatch, load, wrench, artifacts, add, hit, download, prompt, client, easy, gui, perfect, platform, spin, headers, relevant, picture, discrepancy, vcredist, explored, surface, level, image, lets, anomalies, problem, covered, systems, such, empty, developers, assuming, therefore, initiating, spec, issue, aggregatorhost, retaining, putting, queue, investigation, list, throw, binaryhunter, organisation, lining, err, bad, apparently, detectraptor, due, improvements, surfaced, tldr, entirely, saying, engagement, lastdayjob, dig, call, explanation, answer, glad, discussed, myself, canberra, connection, devices, github, twitter, bluesky, linkedin, ruler, project, 4n6, awesome, bec, contact, skip,

Text of the page (random words):
es of our malicious executables and some hits caught my eye inside the users localappdata was a file called iconcache db that i had seen in passing but never really looked at before i had just bought a copy of 010 editor so down the rabbit hole we go special thanks to my former coworkers cassie and yogesh for their assistance in picking this apart what is iconcache the iconcache contains the images associated with an items icon so that windows can recall it without rebuilding it think of it like thumbcache but for icons in fact some of the databases are even in the same spot iconcache is made up of a few different files localappdata iconcache db localappdata microsoft windows explorer iconcache_ db parsing the data if you have 010 editor and want to parse the data from your iconcache db file then you can grab the template from here we were able to take the format documentation from this research paper who did most of the heavy lifting and identify how the format has changed since their release in the current database format where the version string is 0x0507 you get a lowercase version of the paths and sometimes you get shell items which is nice i ve also put up a couple of iconcache db files not the icon files databases onto the dfir artifact museum that i extracted from two sift workstations here s a python script that parses the earlier version but i haven t really tested it here s a cpp program as well but this looks like it will only parse the 0x0506 version of the db the actual icons are stored in a different database and i haven t really done much looking at the format that said there s an 010 template to parse these files and thumbcache viewer works too the downside of joining these two artifact sets together which i have not yet been able to do interesting observations windows 11 doesn t mean you ll get the format 0x0507 i m guessing once the database is there it doesn t really change format so if you upgrade win10 to win11 the database won t get recreated unless you force it either way the 010 template handles both there s earlier formats but i haven t bothered looking at those so the template doesn t cover this the database seems to get written on shutdown or reboot so data recorded will only cover everything prior to the last startup this isn t going to be an evidence of execution artefact just an evidence of existence i haven t looked into the circumstances where you get a shell item but we did incorporate didier stevens code to parse the data so you can explore that in the 010 template data the actual icon images are stored in individual databases based on the size of the icon or the referenced dll read the paper but that part was less interesting for me there s no filenames unfortunately there s a crc hash like with the thumbcache but as we ve got the paths in the other database maybe it s possible as long as the underlying code doesn t take other values i haven t figured out how to join the paths to the images but that s something that i think would be super useful in investigations tools like mimikatz netscan and the myriad of rmm tools used in ransomware investigations usually have specific icons so even if the program has been renamed it s another clue when i increased the size of the icons to the maximum size the template dies so it doesn t support that yet ever who knows this is an interesting artefact that i ll probably keep plugging away at to try and join the dots but for now maybe it might be useful for threat hunting if you find issues let me know and we can look at updating the template sometimes windows and pe version information don t get along july 28 2025 phill moore 2 comments as part of some research i m doing into amcache more on that another time i went about exploring windows pe version information and how windows see s it this came about because i thought i found a bug in the velocidex pe module when in fact it s more likely windows does funny things sometimes what was the bug while checking out the version information of a pe on my windows 11 machine i noticed that in some cases the details windows shows you and what is actually embedded in the file doesn t match here i had written a velociraptor artifact that grabs details out of amcache and then also parses the binary with the pe module something that velo excels at combining various artefacts together in the screenshot you can see the properties of the binary versus the manual parsing for some reason the file is a self extracting cab file according to the pe version information but not according to the windows details theory here is that in some cases the api is doing some extra lifting my guess is the details here represent the executable that gets extracted and installed so i wanted to do some digging what did you find well i don t know how it works or why it does it but with the help of some copilot prompts i made a couple of binaries and did some testing the first one hello exe just prints hello world and has no embedded metadata just a simple c script compiled with gcc the second hello2 exe has a rc file which embeds the metadata i gave it simple enough so here s hello2 which should have embedded information but for reasons i don t yet understand the api to pulls the information out to present it in the details pane if i parse the file with pestudio it s definitely there although sidebar pestudio didn t work properly on that self extracting cab from earlier interestingly amcache mirrored what was in the file properties so maybe uses the same apis next i got copilot to write me two other c programs the first uses the windows api to print the version information and the second manually extracts the data grain of salt here on how it s working because i took a c class 20 years ago and also dont exactly know what windows is doing it s probably a combo of these but copilot seems to have done what i told it to with a bit of tweaking so what basically dont assume the properties the windows apis return are complete and be wary of what might get put into a forensic artifact that pulls data out of a pe header ie amcache it may not always be complete or correct but that s a story for another time cached screenshots on windows 11 june 13 2025 june 14 2025 phill moore 3 comments a while ago i wrote about how windows would track screenshots in shell items and cache the content into a specific directory while this blog post won t be anything groundbreaking i thought i d share some fun findings about the new snipping tool on windows 11 snipping tool was briefly deprecated and replaced with snip and sketch on windows 10 but then come windows 11 we re back to snipping tool again if you press windows shift s or open snipping tool directly it will allow you to take a screenshot of a section of the screen the default settings show that any screenshot you take this way will be saved into the users pictures screenshots directory the filenames indicate they re a screenshot but unfortunately there s no embedded metadata inside ok so that s not really interesting why would i want to talk about this well if you decide to turn this off because you don t want windows to track your screenshots then it will stop saving them into your pictures directory and instead save them into the snips directory shown below localappdata packages microsoft screensketch_8wekyb3d8bbwe tempstate snips i m not sure how long these last for but definitely last a reboot i ll try remember to check back in a few days and see whether they lasted something else to note it s one or the other it either saves them in your screenshots folder or the snips folder but not both sunday funday searching for searching march 8 2025 march 8 2025 phill moore 2 comments this week s sunday funday challenge involves reviewing microsoft 365 uals so i figured what better excuse to get access to a dev tenancy originally i looked at how to request one of these from microsoft and then that fell into the just hard enough basket so i asked a friend who generously donated access to his thanks zach this week s challenge asks the following question what log entries are left behind when the following scenarios occur a user searches their own mailbox a user searches their own onedrive an administrator searches their own mailbox an administrator searches their own one drive an administrator searches someone else s mailbox an administrator searches someone else s onedrive the first step was to get a couple accounts setup and after making sure i assigned licenses which i definitely didnt forget for the first little bit generate some data this was fairly simple login to an account and do some really specific searches and then wait until the results filtered into the ual first things first make sure the ual is enabled i only did this after i did the data generation so i guess we re doing all of this data generation again 1 a user searches their own mailbox hypothesis there should be a search query recorded but it won t tell me what it is data generation for this test i sent an email containing the term testkitchensearchemail the mailbox only had one email anyways but may as well make the term unique this returned my item and i didnt access it i ran the search around 7 05am aedt result there was nothing in the logs to indicate a search other point of interest i had to redo all this testing because the ual wasn t enabled and proved to be annoying to turn on when i went into the user account to do the search it had all the previous searches so they are stored somewhere in outlook com 2 a user searches their own onedrive hypothesis there should be a search query recorded but it won t tell me what it is data generation for this i uploaded a couple of files and then ran a search in the address bar for the term that i put in test txt i ran the search around 7 07am aedt i accessed onedrive com which redirects to sharepoint for this rather than going through the outlook portal results nothing in the logs to indicate a search 3 an administrator searches their own mailbox hypothesis i expect this to say a search was run doesn t say what it was data generation as per the previous but i ran the search logged in as my ga account around 7 09am aedt results nothing returned 4 an administrator searches their own onedrive hypothesis i expect this to say a search was run doesn t say what it was data generation as per the previous but i ran the search logged in as my ga account around 7 15am weirdly i ran the search for the exact string and the file wasn t found i reran a search for testkitchen and it couldnt find it either strange there was this interesting link though since it couldn t find it but clicking on that didnt find anything it seems that it searched across sharepoint and the hits in this tenancy would only be in onedrive results nothing returned 5 an administrator searches someone else s mailbox hypothesis i expect the content search will get logged but not the search through delegated access data generation i ran a content search through the ediscovery portal in purview around 7 22am the screenshot was from the first time i did this the day before so the search name is now different and then also added delegated access to the users account we can look in outlook web access i also made sure to send an email with specific wording to search for testemaildelegatedaccess this returned one result as expected adding mailbox delegation is done through https admin cloud microsoft exchange i added my administrator account to my user account to have full access i then added the mailbox to owa as a shared folder i ran the search twice because it didnt find it the first time all folders when i clicked into the inbox then ran the search it listed it as the search location so there could be a couple of searches around 7 23am results the ediscovery actions were quite well logged with activities like viewed ediscovery case viewed purview search retrieved all actions for search started content search and more started content search shows us the search text but we d have to do a bit more work to figure out what resources they searched in searching in owa didnt get logged at all i accessed some email in the other mailbox and that was logged the evidence showed that the mailboxownerupn was my victim mailbox 6 an administrator searches someone else s onedrive hypothesis i expect the delegated access search to get logged data generation i didnt bother running a content search through the ediscovery portal in purview again because it should be logged the same way as the email search and then also added delegated access through the admin portal i was able to get access by clicking this link in the admin portal the link generated gave me direct access to the users onedrive and i ran my search from the search box which for some reason didnt return a result despite definitely being in the contents of test2 txt weird results nothing returned again i could see the operations that i had viewed the other users onedrive although it showed up as a sharepoint link as either listviewed or viewed page the application display name clearly stated onedrive web app modern though addendum something else that was interesting if you go into the users settings per account i cant see a way to do this elsewhere or against a delegated mailbox you can export the user searches this gives you a file that had my searches addendum2 for some reason logging that a search occurred is an event you have to specifically enable you can see how to here why is it not just enabled overall this test was very interesting mostly because nothing showed up i very much expected to get a performed search query activity but that didn t see to happen i have seen searches in casework but mostly they dont include the text or they just have a star the only thing that really was observed in the logs with regards to searching was the ediscovery case which makes sense to have been logged i want to play more with entra and i still dont understand why we can t use kql to query the ual directly you can kind of use the cloudevents table but in practice this isn t a complete record srumday funday january 13 2025 phill moore 3 comments this week s sunday funday challenge by david cowen is on srum forensics the challenge states the challenge with so many of us relying on srum for so many different uses its time to do some validation on the counters so many people cite for this challenge you will test and validate the following srum collected metrics and document if they accurately capture the data or if there is a skew present use cases to test and validate on windows 11 or windows 10 but you must document which 1 copying data between two drives using copy and paste look for disk read and write activity 2 uploading data to an online service of your choice look for process network traffic 3 wiping files look for disk read and write activity daily blog 716 sunday funday 1 12 25 so let s get started...