Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

SRUM Forensics

Avatar for Veronica Schmitt Veronica Schmitt
October 26, 2018
Technology
750
0

SRUM Forensics

Delving into the world of SRUM forensics.

Avatar for Veronica Schmitt

Veronica Schmitt

October 26, 2018

More Decks by Veronica Schmitt

See All by Veronica Schmitt
The Autopsy of the PHOENIX X36 Hemodialysis System
Avatar for Veronica Schmitt velandra666
2
1.2k

Other Decks in Technology

See All in Technology
AIに賢く動いてもらうためのコンテキスト〜Snowflake女子会 vol.8
Avatar for SnowflakeLadiesGroup snowwmn0824
0
200
AWS DevOps Agent スキルをつかいこなそう / Master AWS DevOps Agent Skills
Avatar for Masanori Yamaguchi kinunori
2
640
地方移住と都心キャリアの両立は「金・時間・人」のリソースをフル活用すれば実現できる！〜Snowflake女子会 vol.8
Avatar for SnowflakeLadiesGroup snowwmn0824
0
140
顧客の成果創出とプロダクトの成長を 両立するためのFDE
Avatar for SansanTech sansantech
PRO
0
520
Confitura 2026
Avatar for Akihiro Nishikawa logico_jp
0
110
大阪オフィスに Unitree Go2 がやってきたので Physical AI やってみた
Avatar for dafujii dafujii
0
150
行動するAIのためのオントロジー ｜ DevRev — Encraft #26.pdf
Avatar for Takanori Suzuki dvrv_tknrszk
1
610
The seven pitfalls of AI (revised version)
Avatar for Uwe Friedrichsen ufried
0
120
AIエージェント時代のPlatform as a Product —— テックリードがPdMとして回す発見・導入・計測 / Platform as a Product in the AI Agent Era
Avatar for Toshinori Sugita toshi0607
1
530
ボードゲームの遊び相手をFoundation Modelsで作る / iOSDC Japan 2026
Avatar for GENDA genda
0
240
企業の現実世界をグラフで写し取る
Avatar for SansanTech sansantech
PRO
0
210
20260929_AmazonGuardDutyの検出通知メールにAWS DevOpsAgentの調査結果を追加する
Avatar for yhana yhana
1
380

Featured

See All Featured
DevOps and Value Stream Thinking: Enabling flow, efficiency and business value
Avatar for Helen Beal helenjbeal
1
390
The SEO Collaboration Effect
Avatar for Kristina Bergwall kristinabergwall1
1
580
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
128
56k
Optimising Largest Contentful Paint
Avatar for Harry Roberts csswizardry
37
4k
Ethics towards AI in product and experience design
Avatar for Skipper Chong Warson skipperchong
2
400
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1369
210k
B2B Lead Gen: Tactics, Traps & Triumph
Avatar for Sophie Logan marketingsoph
0
250
The Impact of AI in SEO - AI Overviews June 2024 Edition
Avatar for Aleyda Solis aleyda
6
1.2k
The AI Revolution Will Not Be Monopolized: How open-source beats economies of scale, even for LLMs
Avatar for Ines Montani inesmontani
PRO
3
3.7k
Leo the Paperboy
Avatar for Maya Tellez mayatellez
10
2.3k
Pawsitive SEO: Lessons from My Dog (and Many Mistakes) on Thriving as a Consultant in the Age of AI
Avatar for David Carrasco davidcarrasco
0
250
Designing Experiences People Love
Avatar for Jonathan Moore moore
143
24k

Transcript

  1. Veronica Schmitt

  2. whoami Veronica Schmitt P01z0n_P1x13 Slides Published online: • https://medium.com/ •

    @P01z0n_P1x13 • [email protected] • www.dfirlabs.com
  3. None

  4. What does it monitor? 1 3 5 2 4

  5. • • • • • • •

  6. NOT AVAILABLE

  7. None
  8. None
  9. None

  10. SRUM Energy Usage (Long Term)

  11. None
  12. None
  13. None
  14. None

  15. • Timestamps are in UTC in OLE format (64 bits)

    and FILETIME format (64 bits) • Network interfaces are specified as InterfaceLuid (NET_LUID)
  16. None
  17. None

  18. Prefetch file records start time of process, not duration

  19. • Prefetch only retains last 8 start times, no record

    of prior runs • SRUM can tell you if an app was run or not
  20. None

  21. Downloads to Ares and Utorrent and he was running OpenVPN

  22. Application Resource Manager

  23. None
  24. None

  25. Energy Usage

  26. Well, what did we find...

  27. • Utorrent and Ares downloading. • Network connected to and

    total downloads. • TOR being used • Veracrypt • Ccleaner being run. • OpenVPN being used • Skype Activity • Viber Chat Activity

  28. Using srum-dump-master https://github.com/MarkBaggett/srum-dump LET'S DO THIS

  29. None