Skip to content

Commit 0059aff

Browse files
AndrewRathbunAndrewRathbun
authored
Merge pull request #12 from EricZimmerman/master
update repo
2 parents 02ce284 + 3c4ee66 commit 0059aff

7 files changed

+172
-7
lines changed

‎evtx/Maps/Microsoft-Windows-DeviceSetupManager-Admin_Microsoft-Windows-DeviceSetupManager_112.map

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ Maps:
2828

2929
# Documentation:
3030
# https://cyberforensicator.com/wp-content/uploads/2017/09/USB-Storage-Device-Forensics-for-Windows-10.pdf
31+
# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
3132
#
3233
# Example Event Data:
3334
# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

‎evtx/Maps/Microsoft-Windows-DriverFrameworks-UserMode_Operational_2100.map ‎evtx/Maps/Microsoft-Windows-DriverFrameworks-UserMode-Operational_Microsoft-Windows-DriverFrameworks-UserMode_2100.map

+1
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ Maps:
2222
# Documentation:
2323
# https://nxlog.co/documentation/nxlog-user-guide/windows-usb-auditing.html
2424
# https://www.reddit.com/r/sysadmin/comments/4dr2t2/security_guy_wants_to_log_usb_storage_devices_on/
25+
# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
2526
# Windows Vista, 7 : enable (default)
2627
# Windows 8~ : disable (default)
2728
#

‎evtx/Maps/Microsoft-Windows-Ntfs-Operational_Microsoft-Windows-Ntfs_146.map

+1
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ Lookups:
7373

7474
# Documentation:
7575
# https://docs.microsoft.com/en-us/previous-versions/windows/desktop/stormgmt/msft-physicaldisk (BusType)
76+
# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
7677
#
7778
# Example Event Data:
7879
# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

‎evtx/Maps/Microsoft-Windows-Partition-Diagnostic_Microsoft-Windows-Partition_1006.map

+1
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ Maps:
5252
# https://df-stream.com/2018/05/partition-diagnostic-event-log-and-usb-device-tracking-p1/
5353
# https://df-stream.com/2018/07/partition-diagnostic-event-log-and-usb-device-tracking-p2/
5454
# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
55+
# https://docs.microsoft.com/en-us/previous-versions/windows/desktop/stormgmt/msft-physicaldisk (BusType)
5556
# Frankly, there is too much data to fit within 6 PayloadData columns. As always, all data is in the Payload column but there isn't enough room to map out all the information cleanly.
5657
#
5758
# Example Event Data:

‎evtx/Maps/Microsoft-Windows-Storage-Storport-Operational_Microsoft-Windows-StorPort_504.map

-7
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,6 @@ Maps:
2727
Value: "/Event/EventData/Data[@Name=\"SerialNumber\"]"
2828
-
2929
Property: PayloadData4
30-
PropertyValue: "BootDevice: %BootDevice%"
31-
Values:
32-
-
33-
Name: BootDevice
34-
Value: "/Event/EventData/Data[@Name=\"BootDevice\"]"
35-
-
36-
Property: PayloadData5
3730
PropertyValue: "BusType: %BusType%"
3831
Values:
3932
-

‎evtx/Maps/Microsoft-Windows-StorageSpaces-Driver-Operational_Microsoft-Windows-StorageSpaces-Driver_207.map

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
Author: Hyun Yi @hyuunnn
2+
Description: USB Connection
3+
EventId: 207
4+
Channel: "Microsoft-Windows-StorageSpaces-Driver/Operational"
5+
Provider: "Microsoft-Windows-StorageSpaces-Driver"
6+
Maps:
7+
-
8+
Property: PayloadData1
9+
PropertyValue: "DriveManufacturer: %DriveManufacturer%"
10+
Values:
11+
-
12+
Name: DriveManufacturer
13+
Value: "/Event/EventData/Data[@Name=\"DriveManufacturer\"]"
14+
-
15+
Property: PayloadData2
16+
PropertyValue: "DriveModel: %DriveModel%"
17+
Values:
18+
-
19+
Name: DriveModel
20+
Value: "/Event/EventData/Data[@Name=\"DriveModel\"]"
21+
-
22+
Property: PayloadData3
23+
PropertyValue: "DriveSerial: %DriveSerial%"
24+
Values:
25+
-
26+
Name: DriveSerial
27+
Value: "/Event/EventData/Data[@Name=\"DriveSerial\"]"
28+
29+
# Documentation:
30+
# N/A
31+
#
32+
# Example Event Data:
33+
# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
34+
# <System>
35+
# <Provider Name="Microsoft-Windows-StorageSpaces-Driver" Guid="{GUID}" />
36+
# <EventID>207</EventID>
37+
# <Version>0</Version>
38+
# <Level>4</Level>
39+
# <Task>0</Task>
40+
# <Opcode>0</Opcode>
41+
# <Keywords>0x8000000000000000</Keywords>
42+
# <TimeCreated SystemTime="2020-12-30T03:22:01.1630740Z" />
43+
# <EventRecordID>21036</EventRecordID>
44+
# <Correlation />
45+
# <Execution ProcessID="4" ThreadID="232" />
46+
# <Channel>Microsoft-Windows-StorageSpaces-Driver/Operational</Channel>
47+
# <Computer>ComputerName</Computer>
48+
# <Security UserID="{UserID}" />
49+
# </System>
50+
# <EventData>
51+
# <Data Name="DriveId">{a0d9d718-f9a2-319a-d91a-87f51e15fb49}</Data>
52+
# <Data Name="PoolId">{00000000-0000-0000-0000-000000000000}</Data>
53+
# <Data Name="DeviceNumber">1</Data>
54+
# <Data Name="DriveManufacturer">WD</Data>
55+
# <Data Name="DriveModel">My Passport 25E2</Data>
56+
# <Data Name="DriveSerial">WX41D69CD7D1</Data>
57+
# </EventData>
58+
# </Event>

‎evtx/Maps/Microsoft-Windows-Storsvc-Diagnostic_Microsoft-Windows-Storsvc_1001.map

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
Author: Hyun Yi @hyuunnn
2+
Description: USB Connection
3+
EventId: 1001
4+
Channel: "Microsoft-Windows-Storsvc/Diagnostic"
5+
Provider: "Microsoft-Windows-Storsvc"
6+
Maps:
7+
-
8+
Property: PayloadData1
9+
PropertyValue: "VendorId: %VendorId%"
10+
Values:
11+
-
12+
Name: VendorId
13+
Value: "/Event/EventData/Data[@Name=\"VendorId\"]"
14+
-
15+
Property: PayloadData2
16+
PropertyValue: "ProductId: %ProductId%"
17+
Values:
18+
-
19+
Name: ProductId
20+
Value: "/Event/EventData/Data[@Name=\"ProductId\"]"
21+
-
22+
Property: PayloadData3
23+
PropertyValue: "SerialNumber: %SerialNumber%"
24+
Values:
25+
-
26+
Name: SerialNumber
27+
Value: "/Event/EventData/Data[@Name=\"SerialNumber\"]"
28+
-
29+
Property: PayloadData4
30+
PropertyValue: "Size: %Size% Bytes"
31+
Values:
32+
-
33+
Name: Size
34+
Value: "/Event/EventData/Data[@Name=\"Size\"]"
35+
-
36+
Property: PayloadData5
37+
PropertyValue: "FileSystem: %FileSystem%"
38+
Values:
39+
-
40+
Name: FileSystem
41+
Value: "/Event/EventData/Data[@Name=\"FileSystem\"]"
42+
-
43+
Property: PayloadData6
44+
PropertyValue: "BusType: %BusType%"
45+
Values:
46+
-
47+
Name: BusType
48+
Value: "/Event/EventData/Data[@Name=\"BusType\"]"
49+
Lookups:
50+
-
51+
Name: BusType
52+
Default: Unknown code
53+
Values:
54+
0: The bus type is unknown.
55+
1: SCSI
56+
2: ATAPI
57+
3: ATA
58+
4: IEEE 1394
59+
5: SSA
60+
6: Fibre Channel
61+
7: USB
62+
8: RAID
63+
9: iSCSI
64+
10: Serial Attached SCSI (SAS)
65+
11: Serial ATA (SATA)
66+
12: Secure Digital (SD)
67+
13: Multimedia Card (MMC)
68+
14: This value is reserved for system use.
69+
15: File-Backed Virtual
70+
16: Storage Spaces
71+
17: NVMe
72+
18: This value is reserved for system use.
73+
74+
# Documentation:
75+
# https://forensixchange.com/posts/19_08_03_usb_storage_forensics_1/
76+
#
77+
# Example Event Data:
78+
# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
79+
# <System>
80+
# <Provider Name="Microsoft-Windows-Storsvc" Guid="{GUID}" />
81+
# <EventID>1001</EventID>
82+
# <Version>0</Version>
83+
# <Level>4</Level>
84+
# <Task>0</Task>
85+
# <Opcode>0</Opcode>
86+
# <Keywords>0x8000000000000000</Keywords>
87+
# <TimeCreated SystemTime="2020-12-08T01:03:35.5243959Z" />
88+
# <EventRecordID>220</EventRecordID>
89+
# <Correlation ActivityID="{ActivityID}" />
90+
# <Execution ProcessID="7796" ThreadID="12988" />
91+
# <Channel>Microsoft-Windows-Storsvc/Diagnostic</Channel>
92+
# <Computer>ComputerName</Computer>
93+
# <Security UserID="{UserID}" />
94+
# </System>
95+
# <EventData>
96+
# <Data Name="Version">2</Data>
97+
# <Data Name="DiskNumber">1</Data>
98+
# <Data Name="VendorId">WD</Data>
99+
# <Data Name="ProductId">My Passport 25E2</Data>
100+
# <Data Name="ProductRevision">4005</Data>
101+
# <Data Name="SerialNumber">WX41D69CD7D1</Data>
102+
# <Data Name="ParentId">USB\VID_1058&PID_25E2\575834314436394344374431</Data>
103+
# <Data Name="FileSystem">NTFS</Data>
104+
# <Data Name="BusType">7</Data>
105+
# <Data Name="PartitionStyle">1</Data>
106+
# <Data Name="VolumeCount">1</Data>
107+
# <Data Name="ContainsRawVolumes">false</Data>
108+
# <Data Name="Size">4000752599040</Data>
109+
# </EventData>
110+
# </Event>

0 commit comments

Comments
 (0)