Installed Software

A subject can install unapproved browser extensions.

A subject can install unapproved browser with features that frustrate or prevent preventions or detections. Such as built-in VPN, Tor access or automatic browser artifact destruction.

A subject can install an unapproved cloud storage application.

A subject can access or install an File Transfer Protocol (FTP) client which can be used to access FTP servers across the Internet.

A subject can install an unapproved messenger application with the ability to transmit data and/or files across the Internet.

A subject can install an unapproved note taking application (Such as Evernote and Obsidian) with the ability to sync notes across the Internet.

A subject can access or install an Remote Desktop Protocol (RDP) client which can be used to access RDP servers across the Internet.

A subject has access to or can install screen sharing software which can be used to capture images or other information from a target system.

A subject can access or install an Secure Shell (SSH) client which can be used to access SSH servers across the Internet.

A subject has access to a virtual environment on a device.

A subject has access to a VPN application.

By only allowing pre-approved software to be installed and run on corporate devices, the subject is unable to install software themselves.

An agent capable of Endpoint Detection and Response (EDR) is a software agent installed on organization endpoints (such as laptops and servers) that (at a minimum) records the Operating System, application, and network activity on an endpoint.

Typically EDR operates in an agent/server model, where agents automatically send logs to a server, where the server correlates those logs based on a rule set. This rule set is then used to surface potential security-related events, that can then be analyzed.

An EDR agent typically also has some form of remote shell capability, where a user of the EDR platform can gain a remote shell session on a target endpoint, for incident response purposes. An EDR agent will typically have the ability to remotely isolate an endpoint, where all network activity is blocked on the target endpoint (other than the network activity required for the EDR platform to operate).

This detection is not enabled by default and requires additional configuration.

System Monitor (Sysmon) Event ID 1 is used to record process execution. Reviewing these logs can determine what software has been run on a system.

Windows Jump Lists are a feature that provides quick access to recently or frequently used files.

LNK files or Shortcut files are stored in the location C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent Items and have the “.lnk” file extension.

These files are automatically created when a user account accesses a file through Windows Explorer.

This artifact can provide information as to when a file was accessed, modified, and created, the file path and name, and the file size. .LNK files persist even if the actual file has been deleted, helping to uncover if a file has been accessed then subsequently deleted or moved as it is no longer present in the recorded full file path.

In modern versions of the Windows operating system, the prefetch feature serves an important function in speeding up the run time of applications. It does this by creating a cache of information on an application on its first run that is is stored for later reference in c:\windows\prefetch, these files are created with the extension .pf and have the following format <EXECUTABLE>-<HASH>.pf.

These created files contain the created and modified timestamps of the respective file, the file size, process path, how many times it has been run, the last time it was run, and resources it references in the first 10 seconds of execution.

Since every executable that is run will have a prefetch file created when the feature is enabled, the prefetch directory and the contents within it can offer new and valuable insights during an investigation, particularly when the original executable no longer exists.