Changeset 1515

Timestamp:

04/11/08 11:18:31 (1 month ago)

Author:

xkovah

Message:

interesting thing with the language bar getting turned on after I did updates…since it happened by itself, it is reasonable to assume it could happen to others, thus I have added the relevant events for the first couple minutes of run time, and will now re-run to see what else comes up

Files:

• honeyclient/trunk/thirdparty/capture-mod/FileMonitor.exl (modified) (1 diff)
• honeyclient/trunk/thirdparty/capture-mod/ProcessMonitor.exl (modified) (2 diffs)
• honeyclient/trunk/thirdparty/capture-mod/RegistryMonitor.exl (modified) (1 diff)

honeyclient/trunk/thirdparty/capture-mod/FileMonitor.exl

@@ -305 +305 @@
-#No guarantees that the % will be interpreted literally by the regex processing...but this is what it spit out
-+   Write   C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Desktop\\%USERPROFILE%\\UserData\\index\.dat
+
+#### HONEYCLIENT AUTO EXCLUDE SCRIPT
++   Write   C:\\WINDOWS\\system32\\lsass\.exe   C:\\Documents and Settings\\Administrator\\Application Data\\Microsoft\\Protect\\.*

honeyclient/trunk/thirdparty/capture-mod/ProcessMonitor.exl

@@ -23 +23 @@
-### Honeyclient added/specific?         ###
-###################################################
-Does specifying a parent process even work? I tried
+specifying a parent process doesn't work - this is a known bug
-+   bash.exe    .*  C:\\cygwin\\bin\\bash\.exe
-+   perl.exe    .*  C:\\cygwin\\bin\\perl\.exe
@@ -41 +41 @@
-#### HONEYCLIENT AUTO EXCLUDE SCRIPT - Internet Explorer 7 Updates
-+   verclsid.exe    .*  C:\\WINDOWS\\system32\\verclsid.exe
+#### HONEYCLIENT AUTO EXCLUDE SCRIPT
+#This is related to the language bar...I just installed updates, and it was newly activated
+#thus I consider it something valid to add
++   ctfmon.exe  .*  C:\\WINDOWS\\system32\\ctfmon.exe

honeyclient/trunk/thirdparty/capture-mod/RegistryMonitor.exl

@@ -363 +363 @@
-#### HONEYCLIENT AUTO EXCLUDE SCRIPT
-+   SetValueKey C:\\Program Files\\Internet Explorer\\IEXPLORE\.EXE HKCU\\Software\\Microsoft\\Internet Explorer\\International
+
+#### HONEYCLIENT AUTO EXCLUDE SCRIPT
+#After installing updates, the language bar was newly activated, these are related to that, and thus seem reasonable to add
++   SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe  HKCU\\Software\\Microsoft\\CTF\\Sapilayr
++   DeleteValueKey  C:\\WINDOWS\\system32\\ctfmon\.exe  HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
++   SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe  HKCU\\Software\\Microsoft\\CTF\\TIP\\.+\\LanguageProfile\\.*
++   SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe  HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
++   SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe  HKCU\\Software\\Microsoft\\CTF\\LangBar
+
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\SearchScopes\\.*
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\Extensions\\CmdMapping
++   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\SearchUrl
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Clients\\StartMenuInternet\\IEXPLORE\.EXE\\DefaultIcon
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser
++   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\7\.0
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\SearchScopes
++   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components
++   SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing\\.+\\Smart Screen DAT file
++   DeleteValueKey  C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks
+
++   SetValueKey C:\\WINDOWS\\explorer\.exe  HKCU\\Software\\Microsoft\\CTF\\LangBar
+
+#NOTE: looks like a liketely bug value (translation not getting done)
++   DeleteValueKey  C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe  \\REGIS