Skip to content

Commit 35272ac

Browse files
joachimmetzjoachimmetz
committed
Worked on Windows Defender scan DetectionHistory file
1 parent 162b24d commit 35272ac

File tree

3 files changed

+211
-25
lines changed

3 files changed

+211
-25
lines changed

‎documentation/Windows Defender scan DetectionHistory file format.asciidoc‎

Lines changed: 102 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -96,50 +96,130 @@ The Windows Defender scan DetectionHistory file consists of:
9696

9797
=== Known values
9898

99+
The known values consists of multiple sets of values that are separated by
100+
a value containing the string "Magic.Version:1.2".
101+
102+
* set 1, which contains basic information
103+
* set 2, which contains threat information
104+
* one of more set 3, which contains information about threat detection resources
105+
106+
[yellow-background]*TODO: if information is related to MSFT_MpThreat or MSFT_MpThreatDetection classes?*
107+
108+
==== Known values - set 1
109+
99110
[cols="1,1,5",options="header"]
100111
|===
101112
| Value index | Value | Description
102-
3+| _Information related to MSFT_MpThreat class?_
103113
| 0 | | Threat identifier
104114
| 1 | | Identifier +
105115
Contains the GUID corresponding to the file name
106-
| 2 | "Magic.Version:1.2" | [yellow-background]*Unknown (signature and version?)*
107-
| 3 | | Name of the threat that was detected +
116+
|===
117+
118+
==== Known values - set 2
119+
120+
[cols="1,1,5",options="header"]
121+
|===
122+
| Value index | Value | Description
123+
| 0 | "Magic.Version:1.2" | Known values set separator
124+
| 1 | | Name of the threat that was detected +
108125
For example: "Virus:DOS/EICAR_Test_File"
109-
| 4 | | [yellow-background]*Unknown* +
126+
| 2 | | [yellow-background]*Unknown* +
110127
Seen: 0
111-
| 5 | | [yellow-background]*Unknown* +
128+
| 3 | | [yellow-background]*Unknown* +
112129
Seen: 5
113-
| 6 | | Category +
130+
| 4 | | Category +
114131
See section: <<category,Category>>
115-
| 7 | | [yellow-background]*Unknown* +
116-
Seen: 0x6e
117-
| 8 | | [yellow-background]*Unknown (Severity?)* +
132+
| 5 | | [yellow-background]*Unknown* +
133+
Seen: 49 (last value index 10), 63 (last value index 12), 110 (last value index 13)
134+
| 6 | | [yellow-background]*Unknown (Severity?)* +
118135
Seen: 4
136+
| 7 | | [yellow-background]*Unknown* +
137+
Seen: 3
138+
| 8 | | [yellow-background]*Unknown* +
139+
Seen: 3
119140
| 9 | | [yellow-background]*Unknown* +
120141
Seen: 3
121142
| 10 | | [yellow-background]*Unknown* +
122143
Seen: 3
144+
3+| _Optional values_
123145
| 11 | | [yellow-background]*Unknown* +
124-
Seen: 3
125-
| 12 | | [yellow-background]*Unknown* +
126-
Seen: 3
127-
| 13 | | [yellow-background]*Unknown* +
128146
Seen: 2
129-
| 14 | | [yellow-background]*Unknown* +
147+
| 12 | | [yellow-background]*Unknown* +
130148
Seen: 6
131-
| 15 | | [yellow-background]*Unknown* +
149+
| 13 | | [yellow-background]*Unknown* +
132150
Seen: 1
133-
3+| _Information related to MSFT_MpThreatDetection class?_
134-
| 16 | "Magic.Version:1.2" | [yellow-background]*Unknown (signature and version?)*
135-
| 17 | "file" | [yellow-background]*Unknown*
136-
| 18 | | [yellow-background]*Unknown (path of file)*
151+
|===
152+
153+
==== Known values - set 3
154+
155+
[cols="1,1,5",options="header"]
156+
|===
157+
| Value index | Value | Description
158+
| 0 | "Magic.Version:1.2" | Known values set separator
159+
| 1 | | Resource type +
160+
Seen: "file", "regkey", "regkeyvalue", "startup", "uninstall"
161+
| 2 | | Resource location +
162+
Seen: file path, Windows Registry key path
163+
| 3 | | [yellow-background]*Unknown* +
164+
Seen: 0, 0x10000001
165+
| 4 | | Thread data size
166+
| 5 | | Thread data
167+
3+| _Optional values_
168+
| 6 | | [yellow-background]*Unknown date and time*
169+
| 7 | | [yellow-background]*Unknown* +
170+
Seen: 0
171+
| 8 | | [yellow-background]*Unknown* +
172+
Seen: 0
173+
| 9 | | [yellow-background]*Unknown GUID*
174+
| 10 | | [yellow-background]*Unknown* +
175+
Seen: 0, 1
176+
| 11 | | [yellow-background]*Unknown* +
177+
Seen: 2, 6
178+
| 12 | | User/System account name
179+
| 13 | | [yellow-background]*Unknown* +
180+
Seen: 2, 3
181+
| 14 | | [yellow-background]*Unknown (parent process?)* +
182+
Seen: Path of parent process executable, "Unknown"
183+
| 15 | | [yellow-background]*Unknown* +
184+
Seen: 2, 3
185+
| 16 | | [yellow-background]*Unknown* +
186+
Seen: 0, 1
187+
| 17 | | [yellow-background]*Unknown* +
188+
Seen: 0
189+
| 18 | | [yellow-background]*Unknown date and time*
137190
| 19 | | [yellow-background]*Unknown* +
138-
Seen: 0x10000001
139-
| 20 | | [yellow-background]*Unknown (threat data size?)*
140-
| 21 | | [yellow-background]*Unknown (threat data?)*
191+
Seen: 0, 3
192+
| 20 | | [yellow-background]*Unknown date and time*
193+
| 21 | | [yellow-background]*Unknown* +
194+
Seen: 0
195+
| 22 | | [yellow-background]*Unknown* +
196+
Seen: 0
197+
| 23 | | [yellow-background]*Unknown* +
198+
Seen: 0
199+
| 24 | | User/System account name
200+
| 25 | | [yellow-background]*Unknown* +
201+
Seen: 0
202+
| 26 | | [yellow-background]*Unknown* +
203+
Seen: 0
204+
| 27 | | [yellow-background]*Unknown* +
205+
Seen: 0
206+
| 28 | | [yellow-background]*Unknown* +
207+
Seen: 0
208+
| 29 | | [yellow-background]*Unknown* +
209+
Seen: 0
210+
| 30 | | [yellow-background]*Unknown* +
211+
Seen: 0
212+
| 31 | | [yellow-background]*Unknown* +
213+
Seen: 1
141214
|===
142215

216+
....
217+
Possible date and time values:
218+
InitialDetectionTime
219+
LastThreatStatusChangeTime
220+
RemediationTime
221+
....
222+
143223
=== [[category]]Category
144224

145225
[cols="1,1,5",options="header"]

‎dtformats/detection_history.py‎

Lines changed: 108 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,71 @@ class WindowsDefenderScanDetectionHistoryFile(data_format.BinaryDataFile):
2222
('value_string', 'Value string', '_FormatString'),
2323
('alignment_padding', 'Alignment padding', '_FormatDataInHexadecimal')]
2424

25+
_VALUE_DESCRIPTIONS = [
26+
{0: 'Threat identifier',
27+
1: 'Identifier'},
28+
{0: 'UnknownMagic1',
29+
1: 'Threat name',
30+
4: 'Category'},
31+
{0: 'UnknownMagic2',
32+
1: 'Resource type',
33+
2: 'Resource location',
34+
4: 'Threat data size',
35+
5: 'Threat data',
36+
6: 'Unknown date and time1',
37+
12: 'User/System account name1',
38+
18: 'Unknown date and time2',
39+
20: 'Unknown date and time3',
40+
24: 'User/System account name2'}]
41+
42+
_CATEGORY_NAME = {
43+
0: 'INVALID',
44+
1: 'ADWARE',
45+
2: 'SPYWARE',
46+
3: 'PASSWORDSTEALER',
47+
4: 'TROJANDOWNLOADER',
48+
5: 'WORM',
49+
6: 'BACKDOOR',
50+
7: 'REMOTEACCESSTROJAN',
51+
8: 'TROJAN',
52+
9: 'EMAILFLOODER',
53+
10: 'KEYLOGGER',
54+
11: 'DIALER',
55+
12: 'MONITORINGSOFTWARE',
56+
13: 'BROWSERMODIFIER',
57+
14: 'COOKIE',
58+
15: 'BROWSERPLUGIN',
59+
16: 'AOLEXPLOIT',
60+
17: 'NUKER',
61+
18: 'SECURITYDISABLER',
62+
19: 'JOKEPROGRAM',
63+
20: 'HOSTILEACTIVEXCONTROL',
64+
21: 'SOFTWAREBUNDLER',
65+
22: 'STEALTHNOTIFIER',
66+
23: 'SETTINGSMODIFIER',
67+
24: 'TOOLBAR',
68+
25: 'REMOTECONTROLSOFTWARE',
69+
26: 'TROJANFTP',
70+
27: 'POTENTIALUNWANTEDSOFTWARE',
71+
28: 'ICQEXPLOIT',
72+
29: 'TROJANTELNET',
73+
30: 'FILESHARINGPROGRAM',
74+
31: 'MALWARE_CREATION_TOOL',
75+
32: 'REMOTE_CONTROL_SOFTWARE',
76+
33: 'TOOL',
77+
34: 'TROJAN_DENIALOFSERVICE',
78+
36: 'TROJAN_DROPPER',
79+
37: 'TROJAN_MASSMAILER',
80+
38: 'TROJAN_MONITORINGSOFTWARE',
81+
39: 'TROJAN_PROXYSERVER',
82+
40: 'VIRUS',
83+
42: 'KNOWN',
84+
43: 'UNKNOWN',
85+
44: 'SPP',
86+
45: 'BEHAVIOR',
87+
46: 'VULNERABILTIY',
88+
47: 'POLICY'}
89+
2590
def _ReadValue(self, file_object, file_offset):
2691
"""Reads the value.
2792
@@ -30,7 +95,7 @@ def _ReadValue(self, file_object, file_offset):
3095
file_offset (int): offset of the value relative to the start of the file.
3196
3297
Returns:
33-
detection_history_value: value.
98+
object: value.
3499
35100
Raises:
36101
IOError: if the value cannot be read.
@@ -43,7 +108,20 @@ def _ReadValue(self, file_object, file_offset):
43108
if self._debug:
44109
self._DebugPrintStructureObject(value, self._DEBUG_INFO_VALUE)
45110

46-
return value
111+
value_object = None
112+
if value.data_type in (
113+
0x00000000, 0x00000005, 0x00000006, 0x00000008):
114+
value_object = value.value_integer
115+
elif value.data_type == 0x0000000a:
116+
value_object = value.value_filetime
117+
elif value.data_type == 0x00000015:
118+
value_object = value.value_string
119+
elif value.data_type == 0x0000001e:
120+
value_object = value.value_guid
121+
elif value.data_type == 0x00000028:
122+
value_object = value.data
123+
124+
return value_object
47125

48126
def ReadFileObject(self, file_object):
49127
"""Reads a Windows Defender scan DetectionHistory file-like object.
@@ -54,7 +132,34 @@ def ReadFileObject(self, file_object):
54132
Raises:
55133
ParseError: if the file cannot be read.
56134
"""
135+
value_objects = []
136+
57137
file_offset = 0
58138
while file_offset < self._file_size:
59-
self._ReadValue(file_object, file_offset)
139+
value_object = self._ReadValue(file_object, file_offset)
140+
value_objects.append(value_object)
141+
60142
file_offset = file_object.tell()
143+
144+
if self._debug:
145+
value_index_set = 0
146+
value_index = 0
147+
for value_object in value_objects:
148+
if value_object == 'Magic.Version:1.2':
149+
if value_index_set < 2:
150+
value_index_set += 1
151+
value_index = 0
152+
153+
description = self._VALUE_DESCRIPTIONS[value_index_set].get(
154+
value_index, 'UNKNOWN_{0:d}_{1:d}'.format(
155+
value_index_set, value_index))
156+
157+
if (value_index_set, value_index) == (1, 4):
158+
value_string = '{0!s} ({1:s})'.format(
159+
value_object, self._CATEGORY_NAME.get(value_object, 'UNKNOWN'))
160+
else:
161+
value_string = '{0!s}'.format(value_object)
162+
163+
self._DebugPrintValue(description, value_string)
164+
165+
value_index += 1

‎dtformats/detection_history.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ members:
149149
encoding: utf-16-le
150150
element_data_type: byte
151151
elements_data_size: detection_history_value_string.data_size
152+
elements_terminator: "\x00\x00"
152153
- name: alignment_padding
153154
type: padding
154155
alignment_size: 8

0 commit comments

Comments
 (0)