Adding Active Directory Timeline module #923
Conversation
…s/GGitHub/PowerShell_AD_Timeline.mkape
remove trailing spaces
Can you review my comments and address those before I merge? I don't think the Module will work in its current state. |
|
Hey @AndrewRathbun, thanks for the review. We have tested this module on two differents test domain controller and it works perfectly :
|
It may "work" but the way it's currently structured isn't the cleanest. https://github.com/EricZimmerman/KapeFiles/blob/master/Modules%2FEZTools%2FLECmd.mkape Look at this one for example. Line 7 specifies which format KAPE should default to if not specified otherwise. Then, the separate formats are each in their own processors, and not listed all on the same line. Right now, it may work but we should clean this up before merging. Hopefully the LECmd example helps! |
|
If there's a single processor that's the only one that will ever be used, so you don't even need an export format. |
Go to the Files Changed tab, here's one of them: |
Or, if you want a processor for each of those 3 formats, they need to be separated out. Currently, in your command, I see flags for XML, so that should be your XML processor. If you want the other output formats, modify the command to reflect that and make a separate processor for each 👍 |
|
Hey guys, I've used the ADTimeline a lot "offline manually" in several IRs. Having to collect the NTDS folder and process it offline isn't always fun. The offline processing requires that the server that's running dsamain have an OS version that matches the ntds.dit that's being processed. I've talked with the developers a little in the past because the requirements for offline processing weren't mentioned. In an off-line situation I've gotten to where it'll run nearly 100% of the time and if it doesn't after a little tweaking I can get it to run. The biggest hurdle is getting dsamain to successfully mount a dirty .dit file. The Splunk app that they offer does an awesome job visualizing the data. Getting customers to run the tools live on a DC as they're supplied from the developer has been an issue, due to their learning curve. Looking forward to seeing this work on some of my response engagements. |
In my understanding, NTDS.dit is simply an ESE database, so much like SRUM/SUM/Windows Search Index, etc, the database will be dirty when it's acquired live. It'll need to be repaired by an OS equal or newer than the system it was acquired from due to the version of the JetEngine used to create it initially. An easy test would be to try to repair an ESE DB acquired from W10 on W11 and watch it work. Do the opposite and it won't work.
https://www.stellarinfo.com/article/check-exchange-database-state-using-eseutil-mh-command.php |
|
@AndrewRathbun Are there any plans to work with an offline collection of the NTDS folder? |
https://github.com/EricZimmerman/KapeFiles/blob/master/Targets%2FWindows%2FActiveDirectoryNTDS.tkape |
make CSV the default ExportFormat, and rename the ExportFormat for the first processor to CSV
There was a problem hiding this comment.
I took the liberty of making a change to the Module so we can merge it. The ExportFormat(s) were changed to simply CSV, instead of multiple comma-separated values. The command can have all the outputs it wants, but specifying an ExportFormat should be singular in nature as no other Module has multiple values on the same ExportFormat line, rather, they are separated out into multiple processors, one for each format. However, I don't think this Module is intended to work like that, so I'm simplifying it by just calling it CSV and moving on. If there are any issues with that, do another PR to fix it, but this will keep the format clean and in line with every other Module.
|
Also, I didn't catch this the first time, but |
|
Nice, thanks for your actions @AndrewRathbun ! |
Description
ADtimeline is a powershell script created by the ANSSI (French Cybersecurity Agency).
It's a powerfull live DFIR script when analysing a potential compromised active directory environnement.
Checklist:
Please replace every instance of
[ ]with[X]OR click on the checkboxes after you submit your PRGUIDfor my Target(s)/Module(s)Miscfolder or created a relevant subfolder with justification--tlist/--mlistand corrected any errorsN/Aunderneath the Documentation headerIf your submission involves an SQLite database, have you considered making an SQLECmd Map for the SQLite database? If you make a Map, please add the SQLite database to the SQLiteDatabases.tkape Compound Target.
Thank you for your submission and for contributing to the DFIR community!