Skip to content

Commit e51393b

Browse files
tomsonpltomsonpl
committed
prefetch artifact
1 parent 43e4d46 commit e51393b

File tree

2 files changed

+91
-9
lines changed

2 files changed

+91
-9
lines changed

‎packages/osquery_manager/artifacts_matrix.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,19 @@
22

33
This document tracks the coverage of forensic artifacts in Osquery.
44

5-
**Last Updated**: 2025-11-07
6-
**Total Core Artifacts**: 1 available + 39 in progress + 6 not available = 46 total variants
7-
**Total Queries**: 30 (3 core forensic variants + 27 additional)
8-
**Completion Rate**: 2.2% (1/46 core artifacts fully supported)
5+
**Last Updated**: 2025-11-20
6+
**Total Core Artifacts**: 2 available + 38 in progress + 6 not available = 46 total variants
7+
**Total Queries**: 31 (4 core forensic variants + 27 additional)
8+
**Completion Rate**: 4.3% (2/46 core artifacts fully supported)
99

1010
---
1111

1212
## Coverage Summary
1313

1414
| Status | Count | Percentage |
1515
|--------|-------|------------|
16-
| ✅ Available (Fully Supported) | 0 | 0% |
17-
| ⚠️ In Progress (Needs Validation) | 39 | 87.0% |
16+
| ✅ Available (Fully Supported) | 2 | 4.3% |
17+
| ⚠️ In Progress (Needs Validation) | 38 | 82.6% |
1818
| ❌ Not Available (Requires Extensions) | 6 | 13.0% |
1919

2020
---
@@ -54,7 +54,7 @@ This document tracks the coverage of forensic artifacts in Osquery.
5454
| 14a | Persistence | ⚠️ | Linux | - | - | Supported across multiple tables (services, startup_items, scheduled_tasks) |
5555
| 14b | Persistence | ⚠️ | Mac | - | - | Supported across multiple tables (services, startup_items, scheduled_tasks) |
5656
| 15 | PowerShell History | ⚠️ | Win | - | - | powershell_events table |
57-
| 16 | Prefetch Files | ⚠️ | Win | - | - | prefetch table |
57+
| 16 | Prefetch Files | ✅ | Win | prefetch_windows_elastic | [c9f4](kibana/osquery_saved_query/osquery_manager-c9f4e1a0-a7e4-11ef-9b3d-94b24cd614c6.json) | Native prefetch table (CORRECTED: parses .pf files to extract executable names, run counts, last run times, and accessed resources - equivalent to VQL Windows.Forensics.Prefetch) |
5858
| 17 | Process Listing | ⚠️ | Win | - | - | processes table |
5959
| 17a | Process Listing | ⚠️ | Linux | - | - | processes table |
6060
| 17b | Process Listing | ⚠️ | Mac | - | - | processes table |
@@ -127,12 +127,13 @@ The following artifacts cannot be queried with standard osquery and require exte
127127
|:-:|----------|:------:|-------|
128128
| 1 | Browser URL History (All Platforms) | ⚠️ | No native table, databases locked while browser running. Can be supported via ATC custom tables. Alternative: Downloads folder analysis, file system queries for browser cache |
129129
| 2 | BITS Jobs Database (Windows) | ⚠️ | Not a native table, but can be queried via windows_eventlog table |
130+
| 3 | Prefetch Files (Windows) | ✅ | CORRECTED: Native prefetch table available since Osquery v5.x - fully parses .pf files to extract executable names, run counts, last run times, and accessed resources. Equivalent to VQL Windows.Forensics.Prefetch artifact. |
130131

131132
### Alternative Coverage
132133

133134
While some artifacts are not directly available, the existing queries provide strong coverage through related artifacts:
134135

135-
**Execution Tracking**: Use Prefetch + AppCompatCache (shimcache) + File Listing + Process Listing instead of AmCache
136+
**Execution Tracking**: Use Prefetch (native prefetch table) + AppCompatCache (shimcache) + File Listing + Process Listing instead of AmCache
136137
**User Activity**: Use Shellbags + LNK Files + Recent Files instead of Jumplists/Browser History
137138
**File System Monitoring**: Use NTFS USN Journal + File Listing with Hashes instead of MFT
138139
**Resource Access**: Use Network Connections (process_open_sockets) + Process Listing instead of Open Handles
@@ -154,7 +155,7 @@ While some artifacts are not directly available, the existing queries provide st
154155
### Execution Artifacts
155156
- ⚠️ AppCompatCache (Windows: shimcache table)
156157
- ⚠️ PowerShell History (Windows: powershell_events table)
157-
- ⚠️ Prefetch Files (Windows: prefetch table)
158+
- ✅ Prefetch Files (Windows: native prefetch table - CORRECTED to use proper parsing, not file enumeration)
158159
- ❌ AmCache (Not Available - Use AppCompatCache + Prefetch as alternatives)
159160

160161
### Persistence Mechanisms

‎packages/osquery_manager/kibana/osquery_saved_query/osquery_manager-c9f4e1a0-a7e4-11ef-9b3d-94b24cd614c6.json‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{
2+
"attributes": {
3+
"created_at": "2025-11-20T15:30:00.000Z",
4+
"created_by": "elastic",
5+
"description": "Investigate Windows Prefetch artifacts for execution history. Prefetch files (.pf) track application launches, execution counts, and associated file/directory access patterns. This query uses the native Osquery prefetch table to parse .pf files and extract forensic intelligence including executable names, run counts, last execution times, and accessed resources. Limited to executables run in the last 90 days to reduce noise. Results capped at 1024 (Windows prefetch directory limit). Equivalent to Velociraptor Windows.Forensics.Prefetch artifact.",
6+
"ecs_mapping": [
7+
{
8+
"key": "process.name",
9+
"value": {
10+
"field": "filename"
11+
}
12+
},
13+
{
14+
"key": "file.name",
15+
"value": {
16+
"field": "filename"
17+
}
18+
},
19+
{
20+
"key": "process.hash.md5",
21+
"value": {
22+
"field": "hash"
23+
}
24+
},
25+
{
26+
"key": "event.created",
27+
"value": {
28+
"field": "last_execution_time"
29+
}
30+
},
31+
{
32+
"key": "event.sequence",
33+
"value": {
34+
"field": "run_count"
35+
}
36+
},
37+
{
38+
"key": "file.size",
39+
"value": {
40+
"field": "size"
41+
}
42+
},
43+
{
44+
"key": "host.id",
45+
"value": {
46+
"field": "volume_serial"
47+
}
48+
},
49+
{
50+
"key": "file.path",
51+
"value": {
52+
"field": "accessed_files"
53+
}
54+
},
55+
{
56+
"key": "file.directory",
57+
"value": {
58+
"field": "accessed_directories"
59+
}
60+
},
61+
{
62+
"key": "file.path",
63+
"value": {
64+
"field": "prefetch_file_path"
65+
}
66+
}
67+
],
68+
"id": "prefetch_windows_elastic",
69+
"interval": "3600",
70+
"platform": "windows",
71+
"query": "SELECT\n datetime(last_run_time, 'unixepoch') AS last_execution_time,\n filename,\n hash,\n run_count,\n other_run_times,\n size,\n volume_serial,\n volume_creation,\n accessed_files_count,\n accessed_directories_count,\n accessed_files,\n accessed_directories,\n path AS prefetch_file_path\nFROM prefetch\nWHERE last_run_time > (strftime('%s', 'now') - 7776000)\nORDER BY last_run_time DESC\nLIMIT 1024",
72+
"updated_at": "2025-11-20T15:30:00.000Z",
73+
"updated_by": "elastic"
74+
},
75+
"coreMigrationVersion": "8.3.0",
76+
"id": "osquery_manager-c9f4e1a0-a7e4-11ef-9b3d-94b24cd614c6",
77+
"references": [],
78+
"type": "osquery-saved-query",
79+
"updated_at": "2025-11-20T15:30:00.000Z",
80+
"version": "WzEwMCwxXQ=="
81+
}

0 commit comments

Comments
 (0)