google / google/grr

Condition logic prevents some valid artifacts from being collected on Windows 10

Open
#988 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
5.1k
Forks
796
PR merge metrics
No merged PRs in 30d

Description

**Environment**
- How did you install GRR? Deb
- What GRR version are you running?: 3.4.5.1
- What operating system does the GRR server run on? Ubuntu 18.04
- What operating system does the affected GRR client run on, if applicable? [e.g. Windows 10]

**Describe the issue**
Some artifacts are unable to be collected on Windows 10 due to [CheckCondition](https://github.com/google/grr/blob/a16be8f4f60778268ac2ad60911adb5568afe0fd/grr/core/grr_response_core/lib/artifact_utils.py#L269) logic failing on the minor version. Windows 10 has major version `10` and minor version `0`. For the artifact `WindowsAMCacheHveFile` which has major: 6 and minor 2
GRR is unable to complete the flow because of the minor version mismatch.

Affected artifacts:

[Windows](https://github.com/ForensicArtifacts/artifacts/blob/main/data/windows.yaml):
- WindowsAMCacheHveFile [os_major_version >= 6 AND os_minor_version >= 1]
- WinAppXRT [os_major_version >= 6 AND os_minor_version >= 2]
- WindowsEnvironmentVariableAppxProcess [os_major_version >= 6 AND os_minor_version >= 2]
- WindowsRecentFileCacheBCF [os_major_version >= 6 AND os_minor_version >= 1]
- WindowsStartupInfo [os_major_version >= 6 AND os_minor_version >= 2]

[WMI](https://github.com/ForensicArtifacts/artifacts/blob/main/data/wmi.yaml):
- WMIDNSClientCache [os_major_version >= 6 AND os_minor_version >= 2]
- WMINetNeighbors [os_major_version >= 6 AND os_minor_version >= 2]
- WMINetTCPConnections [os_major_version >= 6 AND os_minor_version >= 2]
- WMINetUDPEndpoints [os_major_version >= 6 AND os_minor_version >= 2]
- WMIScheduledTasks [os_major_version >= 6 AND os_minor_version >= 2]

**Error logs**
N/A

**Additional context**
forensicArtifacts/artifacts/issues/274 is from the original issue back in 2018 and the author lists some suggestions like combining os_major and os_minor into os_version. There is also the possibility of removing the condition altogether. Thoughts?

Contributor guide

Open the contributing guide

Research direction

Start with CheckCondition in grr/core/grr_response_core/lib/artifact_utils.py and compare its version logic with the affected artifact definitions in the linked Windows and WMI YAML files. Review forensicArtifacts/artifacts/issues/274 for the prior discussion and determine the intended condition semantics. Done means the listed Windows 10 artifacts can be collected without the minor-version mismatch.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.