SleepStudy logs

Posted on by

Update

After I posted it, Bryan linked to this article which explains how to generate SleepStudy report. Thx!

Old Post

A few days ago I came across ETL logs I have not seen before. They are residing inside c:\WINDOWS\System32\SleepStudy and I posted about them on Twitter. Not sure if anyone looked at them from a forensic perspective in the past – quick Twitter and Google search returned nothing of interest, hence decided to quickly describe it here.

The logs originate from “Microsoft-Windows-Kernel-Power” and “Microsoft-Windows-UserModePowerService” ETW providers. Files that can be found inside the directory are as follows:

  • c:\WINDOWS\System32\SleepStudy\
    • ScreenOn\ScreenOnPowerStudyTraceSession-YYYY-MM-DD-HH-MM-SS.etl
    • UserNotPresentSession.etl
    • user-not-present-trace-YYYY-MM-DD-HH-MM-SS.etl

These marked with a YYYY-MM-DD-HH-MM-SS patterns include timestamps, meaning multiple files following the same file naming pattern exist in the folder.

The user* files can be quickly converted from ETL to XML format by using the following commands:

tracerpt.exe <etlfile>

or

tracerpt.exe -of csv

if you prefer CSV output. The resulting files are dumpfile.xml or dumpfile.csv.

What triggered my interest was the fact we can see both paths and timestamps inside the output user* files:

I don’t know exactly what these log mean, but it can be yet another source of process execution telemetry.

Cur\o/bin

Posted on by

This post wraps up another Twitter thread I started a few days ago:

If you ever get bored using “copy” to copy files you can always use … curl:

curl file://c:\test\foo -o bar

Same way, you can use it instead of “type” or “cat”

curl file://c:\test\foo

You can also copy file by… uploading it locally

curl -T bar file://c:\test\

this will copy “bar” file to “c:\test\bar”.

And during copying, you can stat copying at a given offset:

and even cooler, you can extract any part of the file using range

curl file://c:\test\foo -C 1

dynamic payload building anyone?

and even cooler, you can extract any part of the file using range

curl file://c:\test\foo -r2-10

offering a chance to build dynamic payloads.

The operation is surgical and using Procmon we can confirm it reads only these two specific bytes:

@nf3xn added one more interesting option:

curl --remote-time file://c:\test\foo -o bar

to preserve file timestamps.