Changes to AppCompatCache parser (#5025)

Author: Spferical

plaso/data/timeliner.yaml

@@ -1479,6 +1479,8 @@ attribute_mappings:
   description: 'File Last Modification Time'
 - name: 'last_update_time'
   description: 'Last Time Executed'
+- name: 'registry_last_written_time'
+  description: 'Registry Last Written Time'
 place_holder_event: true
 ---
 data_type: 'windows:registry:bagmru'

plaso/parsers/winreg_plugins/appcompatcache.py

@@ -27,7 +27,11 @@ class AppCompatCacheEventData(events.EventData):
     offset (int): offset of the Application Compatibility Cache entry relative
         to the start of the Windows Registry value data, from which the event
         data was extracted.
+    registry_last_written_time (dfdatetime.DateTimeValues): key last written
+        date and time.
     path (str): full path to the executable.
+    insertion_flags (int): Execution flag.
+    control_set (int): Control set number of AppCompatCache registry key.
   """
 
   DATA_TYPE = 'windows:registry:appcompatcache'
@@ -39,8 +43,11 @@ def __init__(self):
     self.file_entry_modification_time = None
     self.key_path = None
     self.last_update_time = None
+    self.registry_last_written_time = None
     self.offset = None
     self.path = None
+    self.insertion_flags = None
+    self.control_set = None
 
 
 class AppCompatCacheHeader(object):
@@ -649,6 +656,8 @@ def ExtractEvents(self, parser_mediator, registry_key, **kwargs):
     if not self._cached_entry_data_type_map:
       raise errors.ParseError('Unable to determine cached entry data type.')
 
+    control_set = self._ExtractControlSet(registry_key.path)
+
     parse_cached_entry_function = None
     if format_type == self._FORMAT_TYPE_XP:
       parse_cached_entry_function = self._ParseCachedEntryXP
@@ -673,6 +682,8 @@ def ExtractEvents(self, parser_mediator, registry_key, **kwargs):
       event_data.key_path = registry_key.path
       event_data.offset = cached_entry_offset
       event_data.path = cached_entry_object.path
+      event_data.control_set = control_set
+      event_data.registry_last_written_time = registry_key.last_written_time
 
       if cached_entry_object.last_modification_time:
         event_data.file_entry_modification_time = dfdatetime_filetime.Filetime(
@@ -682,6 +693,9 @@ def ExtractEvents(self, parser_mediator, registry_key, **kwargs):
         event_data.last_update_time = dfdatetime_filetime.Filetime(
             timestamp=cached_entry_object.last_update_time)
 
+      if cached_entry_object.insertion_flags is not None:
+        event_data.insertion_flags = cached_entry_object.insertion_flags
+
       parser_mediator.ProduceEventData(event_data)
 
       cached_entry_offset += cached_entry_object.cached_entry_size
@@ -691,6 +705,24 @@ def ExtractEvents(self, parser_mediator, registry_key, **kwargs):
           cached_entry_index >= header_object.number_of_cached_entries):
         break
 
+  def _ExtractControlSet(self, path):
+    """Extract control set number from key path.
+
+    Args:
+        path (str): Path
+
+    Returns:
+        Optional[int]: Control set number.
+    """
+    parts = path.split('\\')
+    for part in parts:
+      if part.upper().startswith('CONTROLSET'):
+        try:
+          return int(part[10:], 10)
+        except ValueError:
+          pass
+    return None
+
 
 winreg_parser.WinRegistryParser.RegisterPlugin(
     AppCompatCacheWindowsRegistryPlugin)

tests/parsers/winreg_plugins/appcompatcache.py

@@ -252,6 +252,17 @@ def testFilters(self):
     self._AssertFiltersOnKeyPath(plugin, 'HKEY_LOCAL_MACHINE\\System', (
         'CurrentControlSet\\Control\\Session Manager\\AppCompatCache'))
 
+    self._AssertFiltersOnKeyPath(
+        plugin,
+        'HKEY_LOCAL_MACHINE\\System',
+        'ControlSet001\\Control\\Session Manager\\AppCompatCache',
+    )
+    self._AssertFiltersOnKeyPath(
+        plugin,
+        'HKEY_LOCAL_MACHINE\\System',
+        'ControlSet47\\Control\\Session Manager\\AppCompatCache',
+    )
+
     self._AssertNotFiltersOnKeyPath(
         plugin, 'HKEY_LOCAL_MACHINE\\System', 'Bogus')
 
@@ -286,7 +297,11 @@ def testProcessWindowsXP(self):
         'file_entry_modification_time': '2004-08-04T14:00:00.0000000+00:00',
         'key_path': expected_key_path,
         'last_update_time': '2009-09-20T11:59:16.3281250+00:00',
-        'path': '\\??\\C:\\WINDOWS\\system32\\hticons.dll'}
+        'registry_last_written_time': '2015-06-15T11:53:37.0430610+00:00',
+        'path': '\\??\\C:\\WINDOWS\\system32\\hticons.dll',
+        'insertion_flags': None,
+        'control_set': 1,
+    }
 
     event_data = storage_writer.GetAttributeContainerByIndex('event_data', 0)
     self.CheckEventData(event_data, expected_event_values)
@@ -322,8 +337,13 @@ def testProcessWindows2003(self):
         'file_entry_modification_time': '2003-03-24T20:32:18.0000000+00:00',
         'key_path': expected_key_path,
         'last_update_time': None,
+        'registry_last_written_time': '2015-06-15T11:53:37.0430610+00:00',
         'path': (
-            '\\??\\C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\ngen.exe')}
+            '\\??\\C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\ngen.exe'
+        ),
+        'insertion_flags': None,
+        'control_set': 1,
+    }
 
     event_data = storage_writer.GetAttributeContainerByIndex('event_data', 0)
     self.CheckEventData(event_data, expected_event_values)
@@ -361,7 +381,11 @@ def testProcessWindowsVista(self):
         'file_entry_modification_time': '2006-11-02T12:35:24.7041218+00:00',
         'key_path': expected_key_path,
         'last_update_time': None,
-        'path': '\\??\\C:\\Windows\\SYSTEM32\\WISPTIS.EXE'}
+        'registry_last_written_time': '2015-06-15T11:53:37.0430610+00:00',
+        'path': '\\??\\C:\\Windows\\SYSTEM32\\WISPTIS.EXE',
+        'insertion_flags': None,
+        'control_set': 1,
+    }
 
     event_data = storage_writer.GetAttributeContainerByIndex('event_data', 0)
     self.CheckEventData(event_data, expected_event_values)
@@ -399,7 +423,11 @@ def testProcessWindows7(self):
         'file_entry_modification_time': '2012-04-04T01:46:37.9329644+00:00',
         'key_path': key_path,
         'last_update_time': None,
-        'path': '\\??\\C:\\Windows\\PSEXESVC.EXE'}
+        'registry_last_written_time': '2012-04-04T01:58:40.7767499+00:00',
+        'path': '\\??\\C:\\Windows\\PSEXESVC.EXE',
+        'insertion_flags': 7,
+        'control_set': 1,
+    }
 
     event_data = storage_writer.GetAttributeContainerByIndex('event_data', 9)
     self.CheckEventData(event_data, expected_event_values)
@@ -437,7 +465,11 @@ def testProcessWindows8_0(self):
         'file_entry_modification_time': '2012-02-18T05:18:23.9350000+00:00',
         'key_path': expected_key_path,
         'last_update_time': None,
-        'path': 'SYSVOL\\Windows\\System32\\wbem\\WmiPrvSE.exe'}
+        'registry_last_written_time': '2015-06-15T11:53:37.0430610+00:00',
+        'path': 'SYSVOL\\Windows\\System32\\wbem\\WmiPrvSE.exe',
+        'insertion_flags': 67,
+        'control_set': 1,
+    }
 
     event_data = storage_writer.GetAttributeContainerByIndex('event_data', 0)
     self.CheckEventData(event_data, expected_event_values)
@@ -473,7 +505,11 @@ def testProcessWindows8_1(self):
         'file_entry_modification_time': '2013-08-22T12:35:25.3750709+00:00',
         'key_path': expected_key_path,
         'last_update_time': None,
-        'path': 'SYSVOL\\Windows\\System32\\dllhost.exe'}
+        'registry_last_written_time': '2015-06-15T11:53:37.0430610+00:00',
+        'path': 'SYSVOL\\Windows\\System32\\dllhost.exe',
+        'insertion_flags': 8323072,
+        'control_set': 1,
+    }
 
     event_data = storage_writer.GetAttributeContainerByIndex('event_data', 0)
     self.CheckEventData(event_data, expected_event_values)
@@ -509,7 +545,11 @@ def testProcessWindows10(self):
         'file_entry_modification_time': '2014-09-22T06:42:39.0000000+00:00',
         'key_path': expected_key_path,
         'last_update_time': None,
-        'path': 'C:\\Windows\\system32\\MpSigStub.exe'}
+        'registry_last_written_time': '2015-06-15T11:53:37.0430610+00:00',
+        'path': 'C:\\Windows\\system32\\MpSigStub.exe',
+        'insertion_flags': None,
+        'control_set': 1,
+    }
 
     event_data = storage_writer.GetAttributeContainerByIndex('event_data', 0)
     self.CheckEventData(event_data, expected_event_values)
@@ -545,9 +585,13 @@ def testProcessWindows10Creator(self):
         'file_entry_modification_time': '2017-03-16T22:56:01.2487145+00:00',
         'key_path': expected_key_path,
         'last_update_time': None,
+        'registry_last_written_time': '2015-06-15T11:53:37.0430610+00:00',
         'path': (
             'C:\\Program Files (x86)\\NVIDIA Corporation\\3D Vision\\'
-            'nvstreg.exe')}
+            'nvstreg.exe'
+        ),
+        'insertion_flags': None,
+    }
 
     event_data = storage_writer.GetAttributeContainerByIndex('event_data', 0)
     self.CheckEventData(event_data, expected_event_values)