google / google/grr

WindowsPersistenceMechanismFiles - Hunt Error

Open
#570 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
5.1k
Forks
796
PR merge metrics
No merged PRs in 30d

Description

Greetings,
I believe I found an issue or a bug concerning a Google Rapid Response hunt and the way some clients are working.
I wish to run the “Collectors>ArtifactCollectorFlow>WindowsPersistenceMechanismFiles” hunt. As of now, I am only trying to run it locally and limiting the hunt to around two hours, 10 clients, and only my computer running the agent.
However this task, while it appears as completed, offers a load of errors concerning some registry lookup. I believe it is either related to the hunt not finding the files it is looking for, or to a lack of permissions on the client.
The hunt provides with error logs on the Admin UI in this particular hunt. I am sending you a sample of the output. The entire log consists of that same error pattern:
```
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-812718187-1142311462-14044502-9073\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 358 status : IOERROR }.
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-812718187-1142311462-14044502-10284\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 359 status : IOERROR }.
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-1094346107-1713775765-2398829250-500\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 360 status : IOERROR }.
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-812718187-1142311462-14044502-9073\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 345 status : IOERROR }.
2018-02-15 20:49:01 UTC Artifact WindowsAppInitDLLs data collection failed. Status: message GrrStatus { cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u”File not found: message PathSpec {\n path : u’HKEY_USERS\\\\S-1-5-21-812718187-1142311462-14044502-500\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_DLLs’\n pathtype : REGISTRY\n}” network_bytes_sent : 357 status : IOERROR }.
```
In order to resolve this issue, I was looking into Windows’ Process Monitor. It encountered many anomalies when it comes to the client accessing various registries. I am also providing you with a screenshot of an example of errors coming up (Excluding success log entries):

https://imgur.com/a/2g7Aj

It would be a pleasure to provide any information if necessary.
Thank you very much for your time.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.