# Local persistence

**Windows DFIR notes are no longer maintained on InfoSec-Notes. Updated versions can be found on:** [**artefacts.help**](https://artefacts.help/)**.**

### Sysinternals' Autoruns

The `Autoruns` utility of the `Sysinternals` suite has the most comprehensive knowledge of auto-starting locations on Windows hosts.

The following ASEP are notably listed:

* Startup folders
* ASEP registries
* Services
* Scheduled tasks
* Drivers
* WMI providers
* Internet explorer extensions

`Autoruns` verifies the digital signatures of the files and white list the files signed by known editors. The files appearing in yellow are usually missing and the files appearing in red are usually not digitally signed or not by a known editor.

Note that `Autoruns` **DOES NOT check the loaded DLL** by the programs that are run from ASEP.

**CLI AutorunsC**

The `AutorunsC` utility can be used to run `Autoruns` in CLI mode either on live host **or on read-write partition mounted from a disk image**.

The `Arsenal-Image-Mounter` open source utility can be used to mount disk images to a partition for offline ASEP analysis. However, the verification of files signature from trusted providers does not work as well as on live hosts.

```
# All ASEP (-a) exported to CSV (-c) format with VirusTotal digital signature verification (-v), exclusion of digitally signed Microsoft entries (-m) and files hashes.

# Live hosts
Autorunsc.exe -a * -c -v -m -s -h

# From a mounted partition
Autorunsc.exe -a * -c -v -m -s -h -z <PARTITION_DRIVE_LETTER>
```

### Local accounts

_This section only covers local accounts / groups and does not include persistence through Active Directory domain accounts / groups._

While not directly allowing remote code execution, local accounts may be used as a mean of persistence, notably on machine exposing remote access services, such as `SMB` or `Terminal Services`, on the Internet.

**Live forensics**

The Windows built-in `net` utility can be used to enumerate local users and local groups:

```
# Enumerates the local users and the specified user attributes (including the accounts' password last set timestamp).
net user
net user "<Administrator | USERNAME>"

# Enumerates the local groups and the specified group members.
net localgroup
net localgroup "<Administrators | GROUP>"
```

**Registry**

The local users are stored in the `Securiry Account Manager (SAM)` registry database, located at: `%WinDir%\System32\config\SAM`, under the following registry keys:

* `SAM\Domains\Account\Users`

The user's attributes (username, `RID`, Last Password Change, group memberships, etc.) are stored in the `SAM`.

**Windows EVTX logs**

The following events could be indicators of persistence on the machine through local accounts and / or groups:

| Hive            | Event ID | Conditions                                                                                                                                                                                                                                                                                                                                      | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Information yield                                                                                                                                  |
| --------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Security.evtx` | 4720     | <p>Default configuration.<br><br>Logged whenever a local account is created.</p>                                                                                                                                                                                                                                                                | <p>Event <code>4720: A user account was created</code>.<br><br>Legacy:<br>Event <code>624: User Account Created</code>.</p>                                                                                                                                                                                                                                                                                                                                                                                    | <p>Creator's domain, username and <code>Logon ID</code>.<br><br>Created user's domaine and username.</p>                                           |
| `Security.evtx` | 4722     | <p>Default configuration.<br><br>Always logged after a Security event <code>4720 - user account creation</code>.</p>                                                                                                                                                                                                                            | <p>Event <code>4722: A user account enabled</code><br><br>Legacy:<br>Event <code>626: User Account Enabled</code>.</p>                                                                                                                                                                                                                                                                                                                                                                                         |                                                                                                                                                    |
| `Security.evtx` | 4723     | <p>By default, only logged whenever an user successfully change their own password.<br><br>Failures logged if <code>Audit User Account Management</code> is set to <code>(Success), Failure</code>.</p>                                                                                                                                         | <p>Event <code>4723: An attempt was made to change an account's password</code>.<br><br>Logged as a success (<code>Audit Success</code>) if the user did change their password (which requires to enter the current correct password).<br><br>Otherwise reported as a failure (<code>Audit Failure</code>) if failures are logged and an error occurred (wrong current password given, new password fails to meet the password policy).<br><br>Legacy:<br>Event <code>627: Change Password Attempt</code>.</p> | <p>Domain, username and <code>Logon ID</code> of the user that performed the password change.<br><br>Target user's domain and username.</p>        |
| `Security.evtx` | 4724     | <p>By default, only logged whenever an user successfully reset the specified user's password.<br><br>Failures logged if <code>Audit User Account Management</code> is set to <code>(Success), Failure</code>.<br>A Failure event is NOT generated if the user gets an <code>Access Denied</code> error while attempting the password reset.</p> | <p>Event <code>4724: An attempt was made to reset an accounts password</code>.<br><br>Logged as a success (<code>Audit Success</code>) if the user did reset the specified user password (which requires elevated rights for local accounts).<br><br>Otherwise reported as a failure (<code>Audit Failure</code>) if failures are logged and the new password failed to meet the password policy.<br><br>Legacy:<br>Event <code>628: User Account password set</code>.</p>                                     | <p>Domain, username and <code>Logon ID</code> of the user that performed the password change.<br><br>Target user's domain and username.</p>        |
| `Security.evtx` | 4738     | <p>Default configuration.<br><br>Logged when an user object attributes are modified (for password change, a successful update / reset).</p>                                                                                                                                                                                                     | <p>Event <code>4738: A user account was changed</code>.<br><br>For password change, update to the <code>Password Last Set</code> field.<br><br>Legacy:<br>Event <code>642: User Account Changed</code>.</p>                                                                                                                                                                                                                                                                                                    | <p>Domain, username and <code>Logon ID</code> of the user that performed the password change.<br><br>Target user's domain and username.</p>        |
| `Security.evtx` | 4732     | <p>Default configuration.<br><br>Logged whenever an account is added to a local security group.</p>                                                                                                                                                                                                                                             | <p>Event <code>4732: A member was added to a security-enabled local group</code>.<br><br>Legacy:<br>Event <code>636: Security Enabled Local Group Member Added</code>.</p>                                                                                                                                                                                                                                                                                                                                     | <p>Domain, username and <code>Logon ID</code> of the user that performed the action.<br><br>Target group and added user's domain and username.</p> |

### Windows startup folders

The Windows startup folders contains shortcut links (`.lnk`) that will be executed upon any user log in (`All Users` start up folder) or when the associated user logs in (`Current Users` start up folders).

**Filesystem**

```
# All Users startup folder.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

# Current Users startup folders.
C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
```

The `Everything` tab of the `Sysinternals`' `Autoruns` utility can be used to enumerate the programs starting through Windows startup folders on a live system or on a partition mounted from a disk image.

In addition to the `Sysinternals`' `Autoruns` utility, the following PowerShell script may be used as well:

```
. .\Get-StartupFoldersLnkTargets.ps1

Get-StartupFoldersLnkTargets
Get-StartupFoldersLnkTargets -Drive "F:"
```

```
<#
    .SYNOPSIS
        Get all the starting programs through start up folders

    .DESCRIPTION
      Enumerate all the startup folders lnk using Get-ChildItem and retrieve the lnk targets

    .EXAMPLE
        Get-StartupFoldersLnk -Drive D:
#>

function Get-StartupFoldersLnkTargets {

    param (
        [Parameter(Mandatory=$false)]
        [string]$Drive = "C:"
    )

    $Shell = New-Object -ComObject WScript.Shell

    Get-ChildItem -Force "$Drive\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk" -ErrorAction SilentlyContinue | ForEach-Object {
        [pscustomobject]@{
            LnkFullPath = $_.FullName
            LnkTarget = $Shell.CreateShortcut($_).TargetPath
        }
    }

    $Usernames = Get-ChildItem -Force "$Drive\Users" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty  Name

    foreach ($Username in $Usernames) {
	    Get-ChildItem -ErrorAction SilentlyContinue -Force "$Drive\Users\$Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk" | ForEach-Object {
            [pscustomobject]@{
                LnkFullPath = $_.FullName
                LnkTarget = $Shell.CreateShortcut($_).TargetPath
            }
        }
    }
}
```

### ASEP registry keys

A number of registry keys, known as `Auto-Start Extensibility Points (ASEP)` registry keys, are run whenever the system is booted or a specific user logs in. The `ASEP` keys under `HKEY_LOCAL_MACHINE (HKLM)` are run every time the system is started, while the `ASEP` keys under `HKEY_CURRENT_USER (HKCU)` are only executed when the user associated with the keys logs on to the system.

Indeed, each user with a configured profile has an associated `HKCU\<USERNAME>` sub key, which contains the registries keys of the user. The `HKCU` keys are stored in the `%SystemDrive%\Users\<USERNAME\NTUSER.DAT` file.

Each entry is composed of a key and an associated value that may contain a program, and the program arguments if any, to be run.

The `RegistryExplorer.exe` / `RECmd.exe` utilities leverage transaction log files, for example `ntuser.dat.LOG1`, to identify and recover deleted keys / values. The transaction log files must be present in the same directory as the analyzed hive.

The most commons ASEP keys can be automatically checked using the `SysInternals`' GUI `Autoruns` and CLI `AutorunsC` utilities. The `RECmd` CLI utility can also be used to access a predefined list of ASEP registries keys. The `RegistryASEPs.reb` enumerate a comprehensive list of nearly ASEP 500 registry keys and 400 values. The results of `RECmd` can be analyzed using `Timeline Explorer`.

Alternatively, `RegistryExplorer.exe` implements a number of `bookmarks` which are well-known key / value pairs. The `bookmarks` include a number of `ASEP` registry entries.

```
RECmd.exe -d <NTFS_VOLUME | FOLDER_CONTAINING_REGISTRY_HIVES> --bn .\BatchExamples\RegistryASEPs.reb --csv <OUTPUT_FOLDER>
```

The following run keys are commonly used for persistence:

```
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKLM\System\CurrentControlSet\Services

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKCU\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup
HKCU\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Logon
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
```

**Windows EVTX logs**

The following events could be indicators of execution on the machine of persistence through ASEP registry keys:

| Hive                                             | Event ID                | Conditions                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Description                                                                                                                                                    | Information yield                                                                                                                                  |
| ------------------------------------------------ | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Microsoft-Windows-Shell-Core%4Operational.evtx` | <p>9707<br><br>9708</p> | <p>Default configuration.<br><br>Introduced in Windows 10 and Windows Server 2016.<br><br>Logged whenever a program is executed through the <code>Run</code> / <code>RunOnce</code> registry keys.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | <p>Event <code>9707: Started execution of command '&#x3C;COMMAND>'</code>.<br><br>Event <code>9708: Finished execution of command '&#x3C;COMMAND>'</code>.</p> | <p>Username and domain of the user responsible for the execution.<br><br>Program / command executed.</p>                                           |
| `Security.evtx`                                  | 4657                    | <p>Logged whenever an user modify a registry key for which the audit policy is set to audit usage of the <code>Set Value</code> rights (by the user.)<br><br>Requires:<br><br>- <code>Audit: Force audit policy subcategory settings</code> to be enabled.<br><br>- <code>Audit object access</code> set to <code>Success(, Failure)</code>.<br><br>- The <code>SACL</code> on the ASEP registry keys to define audit on the rights <code>Create Subkey</code>, <code>Set Value</code>, <code>Create Link</code>, <code>Write DAC</code>, and <code>Delete</code> for the user conducting the action (possibly through identity / group membership, such as, for example, <code>Everyone</code>).<br><br><strong>-> very likely not logged.</strong></p> | Event `4657: A registry value was modified`.                                                                                                                   | <p>Username, domain, and <code>LogonID</code> of the user conducting the modification.<br><br>Registry key modified and the new value defined.</p> |

### Windows scheduled tasks

Scheduled tasks are used to automatically perform a task on the system whenever the criteria associated to the scheduled task occurs. The scheduled tasks can either be run at a defined time, on repeat at set intervals, or when a specific event occurs, such as the system boot.

Note that a scheduled task can continue to run even if its associated elements in the registry and / or on disk (`XML` files) are deleted. The scheduled task will be fully hidden but will persist until the system is rebooted or the `svchost.exe` process associated with that task is terminated. The `ETW` events generated by the task execution will however still be generated.

**Live forensics**

The `Scheduled Tasks` tab of the `Sysinternals`' `Autoruns` utility can be used to enumerate the programs starting through Windows scheduled tasks. The following DOS and PowerShell utilities may be used as well.

```
# Verbose - includes task name, task to run, status, hostname & logon mode, last run time, running user, periodicity, etc.
schtasks /query /fo LIST /v

# List scheduled task - minimal information
Get-ScheduledTask

# Retrieve information - task name, task to run, next and last run time
Get-ScheduledTaskInfo -TaskName "<TASK_NAME>"
```

The following PowerShell cmdlet can be used to export the configured scheduled tasks to the specified csv file.

Usage:

```
. .\Export_ScheduledTasks.ps1

Export-ScheduledTasksToCsv -OutCsv <CSV_PATH>
```

```
function Export-ScheduledTasksToCsv {

    <#
    .SYNOPSIS
      Export the configured scheduled tasks to a csv using Get-ScheduledTask and Get-ScheduledTaskInfo

    .PARAMETER OutCsv
      File to export the CSV

    #>

    Param(
    [Parameter(Mandatory=$true)]
    [string] $OutCsv
    )

    Get-ScheduledTask |
        ForEach-Object { [pscustomobject]@{
            Server = $env:COMPUTERNAME
            Name = $_.TaskName
            Path = $_.TaskPath
            Description = $_.Description
            Author = $_.Author
            RunAsUser = $_.Principal.userid
            LastRunTime = $(($_ | Get-ScheduledTaskInfo).LastRunTime)
            LastResult = $(($_ | Get-ScheduledTaskInfo).LastTaskResult)
            NextRun = $(($_ | Get-ScheduledTaskInfo).NextRunTime)
            Status = $_.State
            Command = $_.Actions.execute
            Arguments = $_.Actions.Arguments }
     } | Export-Csv -Path $OutCsv -NoTypeInformation
}
```

**Filesystem**

The scheduled tasks are stored in human readable `XML` file on the following location, depending on the Windows Operating System in use:

* <= `Windows XP` / `Windows Server 2003` (`Task Scheduler 1.0`): `C:\Windows\Tasks`
* Starting from `Windows 7` / `Windows Server 2008` (`Task Scheduler 2.0`): `C:\Windows\System32\Tasks`

**Registry**

The scheduled tasks are stored under the following registry keys (as listed in the `ASEP registry keys` section), located at `%WinDir%\System32\config\SOFTWARE`:

* `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks`
* `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tree`

**Windows EVTX logs**

The following events could be indicators of persistence on the machine through scheduled tasks:

| Hive                                                | Event ID                                                    | Conditions                                                                                                                                                                                | Description                                                                                                                                                                                                                                                                                                                                                                                     | Information yield                                                                                                                                                                   |
| --------------------------------------------------- | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Microsoft-Windows-TaskScheduler%4Operational.evtx` | 106                                                         | <p>Introduced in <code>Windows 7</code> / <code>Windows 2008</code>.<br><br>Logged whenever a scheduled task is registered.</p>                                                           | <p>Event <code>106: User "&#x3C;DOMAIN | WORKGROUP>\&#x3C;USERNAME>" registered Task Scheduler task "\&#x3C;TASK_NAME>"</code>.<br><br>Can be correlated, after execution of the task, with an event <code>200</code> / <code>201</code> to determine the scheduled task's executable full path.</p>                                                                                            | <p>Registering user's domain and username.<br><br>Task name.</p>                                                                                                                    |
| `Microsoft-Windows-TaskScheduler%4Operational.evtx` | 200                                                         | <p>Introduced in <code>Windows 7</code> / <code>Windows 2008</code>.<br><br>Logged whenever a scheduled task is executed.</p>                                                             | <p>Event <code>200: Task Scheduler launched action "&#x3C;EXECUTABLE>" in instance "&#x3C;GUID>" of task "&#x3C;TASKNAME>"</code>.<br><br>The task name can be used to correlate the executed task with an event <code>106</code> to identify the user that registered the task.</p>                                                                                                            | Executed task's name and executable full path.                                                                                                                                      |
| `Microsoft-Windows-TaskScheduler%4Operational.evtx` | 201                                                         | <p>Introduced in <code>Windows 7</code> / <code>Windows 2008</code>.<br><br>Logged whenever a scheduled task finish its execution.</p>                                                    | <p>Event <code>201: Task Scheduler successfully completed task "&#x3C;TASKNAME>" , instance "&#x3C;GUID>" , action "&#x3C;EXECUTABLE>" with return code &#x3C;INT>"</code>.<br><br>Similarly to event <code>200</code>, the task name can be used to correlate the executed task with an event <code>106</code> to identify the user that registered the task.</p>                              | Executed task's name, executable full path and execution return code.                                                                                                               |
| `Microsoft-Windows-TaskScheduler%4Operational.evtx` | 140                                                         | <p>Introduced in <code>Windows 7</code> / <code>Windows 2008</code>.<br><br>Logged whenever a scheduled task is updated.</p>                                                              | Event `140: User "<DOMAIN \| WORKGROUP>\<USERNAME>" updated Task Scheduler task "<TASKNAME>"`.                                                                                                                                                                                                                                                                                                  | Domain and username of the user that conducted the update.                                                                                                                          |
| `Microsoft-Windows-TaskScheduler%4Operational.evtx` | 141                                                         | <p>Introduced in <code>Windows 7</code> / <code>Windows 2008</code>.<br><br>Logged whenever a scheduled task is deleted.</p>                                                              | Event `141: User "<DOMAIN \| WORKGROUP>\<USERNAME>" deleted Task Scheduler task "<TASKNAME>"`.                                                                                                                                                                                                                                                                                                  | Domain and username of the user that deleted the task.                                                                                                                              |
| `Security.evtx`                                     | <p>4698<br><br>4700<br><br>4701<br><br>4702<br><br>4699</p> | <p>Requires:<br><br><code>Audit: Force audit policy subcategory settings</code> to be enabled.<br>And <code>Other Object Access Events</code> set to <code>Success(, Failure)</code>.</p> | <p>Event <code>4698: A scheduled task was created</code>.<br><br>Event <code>4700: A scheduled task was enabled</code>.<br><br>Event <code>4701: A scheduled task was disabled</code>.<br><br>Event <code>4702: A scheduled task was updated</code>.<br><br>Event <code>4699: A scheduled task was deleted</code>.<br><br>Legacy:<br>(Only) event <code>602: Scheduled Task created</code>.</p> | <p>Domain, username and Logon ID of the user that performed the action.<br><br>Impacted scheduled task detailed information: task name, action(s), trigger(s), privileges, etc.</p> |

### Windows services

In Windows NT operating systems, a Windows service is a computer program that operates in the background, similarly in concept to a Unix daemon.

A Windows service must conform to the interface rules and protocols of the `Service Control Manager (SCM)`, the component responsible for managing Windows services. Windows services can be configured to start with the operating system, manually or when an event occur.

**Live forensics**

The `Services` tab of the `Sysinternals`' `Autoruns` utility can be used to detect and delete service-related persistence. Information about the configured services can also be retrieved using `WMI`:

```
Get-WmiObject -Class win32_service | Select-Object Name, DisplayName, PathName, StartName, StartMode, State, TotalSessions, Description

wmic service list config
```

**Registry**

The Windows services are stored under the following registry keys (as listed in the `ASEP registry keys` section), located at `%WinDir%\System32\config\SYSTEM`:

* `HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>`

The registry keys hold the configuration information of the Windows services: name, display name, start mode, service type, image path, required privileges if any, etc.

The last written timestamp of the service sub key indicates the service creation or last modification time.

**Windows EVTX logs**

The following events could be indicators of persistence on the machine through Windows services:

| Hive            | Event ID | Conditions                                                                                                                                                                                                                                                                                                             | Description                                                                                                                                                                       | Information yield                                                                                                                                                                                                            |
| --------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `System.evtx`   | 7045     | <p>Default configuration.<br><br>Logged whenever a Windows service is created on the machine.</p>                                                                                                                                                                                                                      | Event `7045: A service was installed in the system`.                                                                                                                              | <p>Domain and username of the user that installed the service.<br><br>Information on the installed service: name, file name, type, start type and executing account.</p>                                                     |
| `Security.evtx` | 4697     | <p>Introduced in Windows Server 2016 and Windows 10.<br><br>Requires:<br><br><code>Audit: Force audit policy subcategory settings</code> to be enabled.<br>And <code>Other Object Access Events</code> set to <code>Success(, Failure)</code>.<br><br>Logged whenever a Windows service is created on the machine.</p> | <p>Event <code>4697: A service was installed in the system</code>.<br><br>Legacy (Windows Server 2003 and Windows XP):<br>Event <code>601: Attempt to install service</code>.</p> | <p>Domain, username and Logon ID of the user that performed the action.<br>-> Often marked as <code>SYSTEM</code>.<br><br>Information on the installed service: name, file name, type, start type and executing account.</p> |
| `System.evtx`   | 7036     | <p>Default configuration.<br><br>Logged whenever a Windows service is effectively running / stopped.</p>                                                                                                                                                                                                               | Event `7036: The <SERVICE_NAME> service entered the <running/stopped> state`.                                                                                                     | The name of the concerned service and the account used to execute the service (which may not be the account that instructed the service to start / stop).                                                                    |
| `System.evtx`   | 7035     | <p>Logged only on &#x3C;= <code>Windows XP</code> and <code>Windows Server 2003</code>.<br><br>Logged whenever a Windows service is instructed to start / stop.</p>                                                                                                                                                    | Event `7035: The <SERVICE_NAME> service was successfully sent a <start/stop> control`.                                                                                            | The name of the concerned service and the account that instructed the service to start / stop (which is likely different that the account under which the service is executed).                                              |
| `System.evtx`   | 7040     | <p>Default configuration.<br><br>Logged whenever there is a change to a service start type.</p>                                                                                                                                                                                                                        | Event `7040: The start type of the <SERVICE_NAME> service was changed from demand <OLD_START_TYPE> to <NEW_START_TYPE>`.                                                          | The name of the concerned service and the account that modified the service.                                                                                                                                                 |
| `System.evtx`   | 7030     | <p>Introduced in Windows Vista and Windows Server 2008.<br><br>Logged whenever a service is configured as an interactive service, which is not supported since Windows Vista and Windows Server 2008 (du to security risks posed by interactive services).</p>                                                         | Event `7030: The <SERVICE_NAME> service is marked as an interactive service`.                                                                                                     |                                                                                                                                                                                                                              |

### WMI event subscriptions

`Windows Management Instrumentation (WMI)` allows, through `Event Subscription`, to maintain persistence on a Windows system. Permanent `WMI` event subscriptions can be configured to persist across reboots.

Permanent event subscriptions are composed of:

* An `event filter`, which is the event of interest that will trigger the consumer. Such event can be, for example, a logon success or system startup.
* An `event consumer`, which is the action to perform upon trigger of the event filter.\
  Five Consumer classes are available:
  * The `ActiveScriptEventConsumer` class that run arbitrary `VBScript` or `JScript` code.
  * The `CommandLineEventConsumer` class that run an arbitrary system command.
  * The `LogFileEventConsumer` class that write an arbitrary string to a text-based log file.
  * The `NtEventLogEventConsumer` class that write an arbitrary Windows `ETW` event.
  * The `SMTPEventConsumer` class that send an email.
* A `filter to consumer binding` (`FilterToConsumerBinding`) which is the registration mechanism binding an event filter to an event consumer.

**Live forensics**

The `WMI` tab of the `Sysinternals`' `Autoruns` utility can be used to detect and delete WMI-related persistence. The WMI event subscriptions can also be enumerated with the PowerShell cmdlet `Get-WMIObject`:

```powershell
# From PowerShell forensic framework Kansa
ForEach ($NameSpace in "root\subscription","root\default") { Get-WMIObject -Namespace $Namespace -Query "SELECT * FROM __EventFilter" }
ForEach ($NameSpace in "root\subscription","root\default") { Get-WMIObject -Namespace $Namespace -Query "SELECT * FROM __EventConsumer" }
ForEach ($NameSpace in "root\subscription","root\default") { Get-WMIObject -Namespace $Namespace -Query "SELECT * FROM __FilterToConsumerBinding" }
```

**Process execution**

The following process are related to `WMI` activity:

* `wmic.exe`: command line utility to interact with `WMI` (locally or on a remote computer). The `process call` can indicate that process creation is done using `WMI` and `/node` can be used to specify a remote computer.
* `WmiPrvSE.exe`: `WMI Provider Host` process spawn as a result of `WMI Event Subscription` execution. Suspicious child process of `WmiPrvSE.exe` (such as `powershell.exe` or `cmd.exe`) can be an indicator of persistence through `WMI`.
* `scrcons.exe`: `WMI Standard Event Consumer` process that spawn for `ActiveScriptEventConsumer` execution.
* `wsmprovhost.exe`: indicator of PowerShell remoting activity (not particularly relevant to detect local persistence).

As `WMI` can be used legitimately in the environment, the execution of a `WMI` related program may not necessarily be an indicator of malicious activity.

**Filesystem**

The persistent `WMI Event Subscription` are written to disk in the (undocumented) `WMI` Repository files at `%WINDIR%\System32\wbem\Repository\` / `%WINDIR%\System32\wbem\Repository\FS\`:

* `OBJECTS.DATA`: contains the `CIM objects` with, among other things, the event subscriptions data (event consumer, filter, and filter to consumer binding).
* `INDEX.BTR`: paged file in B-tree struct, "used to efficiently lookup CIM entities in the objects.data file". May contain
* `MAPPING<1-3>.MAP`: correlate / map pages from `OBJECTS.DATA` and `INDEX.BTR`.

All three files are required to properly conduct forensics analysis on WMI persistence.

`WMI Event Subscription` data can be extracted from `OBJECTS.DATA` files using the [`PyWMIPersistenceFinder`](https://github.com/davidpany/WMI_Forensics) Python script (that rely on regexes to extract the data):

```bash
PyWMIPersistenceFinder.py <OBJECTS.DATA_FILE>
```

If a deeper analysis is required, for example if a consumer reference other `WMI` objects, [`python-cim`](https://github.com/mandiant/flare-wmi) can be leveraged to extract data from the `WMI` repository:

```
python3 samples/dump_class_layout.py win7 "<WMI_REPOSITORY_FOLDER>" "<ROOT\cimv2 | WMI_NAMESPACE>" "<WMI_CLASS_NAME>"
```

**Windows EVTX / text logs**

| Hive                                                                      | Event ID                                                                                 | Conditions                                                                                                                                                                                              | Description                                                                                                                                                                   | Information yield                                                                                                                                   |
| ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Security`                                                                | 4688                                                                                     | <p>Requires <code>Audit process tracking</code> to be enabled.<br><br>For the process arguments to be logged, <code>Include command line in process creation events</code> must be enabled as well.</p> | <p>Event <code>4688: A new process has been created</code>.<br><br>Can be used to track the execution of the aforementioned process related to <code>WMI</code> activity.</p> | <p>Current logged-on user's domain, username and <code>LogonID</code>.<br><br>Parent and child process.<br><br>Process command line if enabled.</p> |
| `Microsoft-Windows-WMI-Activity/Operational`                              | 5858                                                                                     |                                                                                                                                                                                                         | <p>Event <code>5858: Operation_ClientFailure</code>.<br><br></p>                                                                                                              | Client machine hostname, domain and username of the user, and details about the failed operation.                                                   |
| `Microsoft-Windows-WMI-Activity/Operational`                              | 5859                                                                                     |                                                                                                                                                                                                         | Event `5859: Operation_EssStarted:` .                                                                                                                                         |                                                                                                                                                     |
| `Microsoft-Windows-WMI-Activity/Operational`                              | 5860                                                                                     |                                                                                                                                                                                                         | Event `5860: Operation_TemporaryEssStarted`.                                                                                                                                  |                                                                                                                                                     |
| `Microsoft-Windows-WMI-Activity/Operational`                              | 5861                                                                                     |                                                                                                                                                                                                         | Event `5861: Operation_ESStoConsumerBinding`.                                                                                                                                 |                                                                                                                                                     |
| <p>Shimcache<br><br>Amcache<br><br>Other process execution artefacts.</p> | <p><code>HKLM\SYSTEM</code> registry hive<br><br><code>Amcache.hve</code><br><br>...</p> |                                                                                                                                                                                                         | <p>Programs execution Windows artefacts.<br><br>Can be used to track the execution of the aforementioned binaries.</p>                                                        | The information yield will depend on the given artifact, but will generally be limited.                                                             |

### Legitimate startup PE hooking

One of the most covert technique to implement persistence on a system is through the hooking of a legitimate `Portable Executable (PE)` (executable and DLL) that normally starts up after boot time or whenever an user logs in.

For example, malicious code can be injected into a legitimate binary using a PE infector such as `Shellter`. If done correctly, the injection will not alter the normal functioning of the legitimate binary and is likely to evade anti-virus detection. For even more stealthiness, the injection can be conducted in a DLL loaded by a legitimate program, as loaded DLL are not enumerated by the `Sysinternals`' `Autoruns` utility. An actually loaded DLL can be modified or the path of a loaded DLL may be hijacked.

While PE injection invalidates the digital signature of the file, many legitimates PE are not digitally signed, or are signed by an unrecognized authority, and verifications of digital signatures are bound to raise an important volume of false-positives.

**Filesystem**

Detecting PE hooking is a **difficult and fallible process**. An analysis of the NTFS partition's `$MFT` and `$UsnJrnl` entries can give information about the creation and modification of legitimate PE on the system. Refer to the `DFIR - Filesystem history` note for more information. Additionally, if the malware strain could be retrieved, a reverse engineering of its functionalities may permit the identification of `Indice of Compromise (IoC)` for later detection.

***

### References

https://www.mandiant.com/resources/windows-management-instrumentation-wmi-offense-defense-and-forensics

https://netsecninja.github.io/dfir-notes/wmi-forensics/

https://www.mandiant.com/sites/default/files/2021-09/wp-windows-management-instrumentation.pdf

https://www.youtube.com/watch?v=xrd0w505aS8
