WindowsPersistenceMechanismFiles - Hunt Error
- Dominant language
- Python
- Stars
- 5.1k
- Forks
- 796
- PR merge metrics
- No merged PRs in 30d
Description
Greetings,
I believe I found an issue or a bug concerning a Google Rapid Response hunt and the way some clients are working.
I wish to run the “Collectors>ArtifactCollectorFlow>WindowsPersistenceMechanismFiles” hunt. As of now, I am only trying to run it locally and limiting the hunt to around two hours, 10 clients, and only my computer running the agent.
However this task, while it appears as completed, offers a load of errors concerning some registry lookup. I believe it is either related to the hunt not finding the files it is looking for, or to a lack of permissions on the client.
The hunt provides with error logs on the Admin UI in this particular hunt. I am sending you a sample of the output. The entire log consists of that same error pattern:
```
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-812718187-1142311462-14044502-9073\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 358 status : IOERROR }.
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-812718187-1142311462-14044502-10284\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 359 status : IOERROR }.
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-1094346107-1713775765-2398829250-500\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 360 status : IOERROR }.
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-812718187-1142311462-14044502-9073\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 345 status : IOERROR }.
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-812718187-1142311462-14044502-500\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 357 status : IOERROR }.
```
In order to resolve this issue, I was looking into Windows’ Process Monitor. It encountered many anomalies when it comes to the client accessing various registries. I am also providing you with a screenshot of an example of errors coming up (Excluding success log entries):
https://imgur.com/a/2g7Aj
It would be a pleasure to provide any information if necessary.
Thank you very much for your time.
Contributor guide
Assessment
This issue has not been assessed yet.