Changes for readthedocs documentation

ForensicArtifacts · Dec 5, 2021 · ffa2be7 · ffa2be7
1 parent 7643c28
commit ffa2be7
Show file tree

Hide file tree

Showing 4 changed files with 52 additions and 13 deletions.
diff --git a/docs/sources/windows/ServicesAndDrivers.md b/docs/sources/windows/ServicesAndDrivers.md
@@ -0,0 +1,26 @@
+## Services and drivers
+
+### Significance
+
+Malware can add new services or drivers to gain persistence, or modify existing
+ones to avoid detection.
+
+For example the ZeroAccess rootkit will make the following changes to the
+Windows Security Service Center (WSCSVC), Windows Defender (WINDEFEND), and
+Windows Firewall (MPSSVC) services, among others.
+
+* Set the 'Start' value to 4, indicating that the service should be disabled
+* Set the 'DeleteFlag' value to 1, indicating that the service should be removed
+* Set the 'ErrorControl' value to 0 and 'Type' value to 32, causing it to fail to be started by the Service Controller without generating error messages
+
+### Settings
+
+The services and drivers settings can be found in the Windows Registry key:
+
+```
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
+```
+
+### References
+
+* [Services and drivers](https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Services-and-drivers.html)
diff --git a/docs/sources/windows/System Resource Usage Monitor.md b/docs/sources/windows/System Resource Usage Monitor.md
diff --git a/docs/sources/windows/SystemResourceUsageMonitor.md b/docs/sources/windows/SystemResourceUsageMonitor.md
@@ -0,0 +1,22 @@
+## System Resource Usage Monitor (SRUM)
+
+System Resource Usage Monitor (SRUM) is used to monitor desktop application
+programs, services, Windows applications and network connections.
+
+### SRUM extensions
+
+### Database
+
+The SRUM database is typically stored in:
+
+```
+C:\Windows\System32\sru\SRUDB.dat
+```
+
+SRUM uses the Extensible Storage Engine (ESE) Database File (EDB) to store
+its folder data.
+
+### References
+
+* [System Resource Usage Monitor (SRUM) database](https://github.com/libyal/esedb-kb/blob/main/documentation/System%20Resource%20Usage%20Monitor%20(SRUM).asciidoc)
+* SRUM forensics, by Yogesh Khatri
diff --git a/docs/sources/windows/index.rst b/docs/sources/windows/index.rst
@@ -10,9 +10,10 @@ Windows operating system artifacts.
    ActiveDesktop <ActiveDesktop>
    Activities Cache Database <ActivitiesCacheDatabase>
    AMCache <AMCache>
-   EnvironmentVariables <EnvironmentVariables>
+   Environment variables <EnvironmentVariables>
    EventLog <EventLog>
    JumpLists <JumpLists>
    RecentFileCache <RecentFileCache>
-   RegistryFiles <RegistryFiles>
-   System Resource Usage Monitor <System Resource Usage Monitor>
+   Registry files <RegistryFiles>
+   Services and Drivers <ServicesAndDrivers>
+   System Resource Usage Monitor <SystemResourceUsageMonitor>