google/grr

Condition logic prevents some valid artifacts from being collected on Windows 10

coperni opened this issue · 1 comments

coperni commented

Environment

  • How did you install GRR? Deb
  • What GRR version are you running?: 3.4.5.1
  • What operating system does the GRR server run on? Ubuntu 18.04
  • What operating system does the affected GRR client run on, if applicable? [e.g. Windows 10]

Describe the issue
Some artifacts are unable to be collected on Windows 10 due to CheckCondition logic failing on the minor version. Windows 10 has major version 10 and minor version 0. For the artifact WindowsAMCacheHveFile which has major: 6 and minor 2
GRR is unable to complete the flow because of the minor version mismatch.

Affected artifacts:

Windows:

  • WindowsAMCacheHveFile [os_major_version >= 6 AND os_minor_version >= 1]
  • WinAppXRT [os_major_version >= 6 AND os_minor_version >= 2]
  • WindowsEnvironmentVariableAppxProcess [os_major_version >= 6 AND os_minor_version >= 2]
  • WindowsRecentFileCacheBCF [os_major_version >= 6 AND os_minor_version >= 1]
  • WindowsStartupInfo [os_major_version >= 6 AND os_minor_version >= 2]

WMI:

  • WMIDNSClientCache [os_major_version >= 6 AND os_minor_version >= 2]
  • WMINetNeighbors [os_major_version >= 6 AND os_minor_version >= 2]
  • WMINetTCPConnections [os_major_version >= 6 AND os_minor_version >= 2]
  • WMINetUDPEndpoints [os_major_version >= 6 AND os_minor_version >= 2]
  • WMIScheduledTasks [os_major_version >= 6 AND os_minor_version >= 2]

Error logs
N/A

Additional context
ForensicArtifacts/artifacts/issues/274 is from the original issue back in 2018 and the author lists some suggestions like combining os_major and os_minor into os_version. There is also the possibility of removing the condition altogether. Thoughts?

coperni commented

@joachimmetz has rectified this within the ForensicArtifacts repository via Removed support for conditions. All that remains is to tag the ForensicArtifiacts changes and update the reference in the artifacts makefile.