dissect.target 3.25.dev37__tar.gz → 3.25.dev39__tar.gz

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev37
+Version: 3.25.dev39
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

dissect_target-3.25.dev39/dissect/target/plugins/os/windows/log/agentexecutor.py

@@ -0,0 +1,125 @@
+from __future__ import annotations
+
+import re
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+AgentExecutorLogRecord = TargetRecordDescriptor(
+    "windows/intune/agentexecutor/log",
+    [
+        ("datetime", "ts"),
+        ("string", "component"),
+        ("string", "thread"),
+        ("string", "type"),
+        ("string", "context"),
+        ("string", "message"),
+        ("string", "file_origin"),
+    ],
+)
+
+LOG_PATTERN = re.compile(
+    r"""
+        <!\[LOG\[(?P<message>.*?)\]LOG\]!>
+        <time="(?P<hms>\d{2}:\d{2}:\d{2})
+            (?:\.(?P<fractional_seconds>\d{1,7}))?"
+        \s+
+        date="(?P<date>[\d-]+)"
+        \s+
+        component="(?P<component>[^"]+)"
+        \s+
+        context="(?P<context>[^"]*)"
+        \s+
+        type="(?P<type>\d+)"
+        \s+
+        thread="(?P<thread>\d+)"
+        (?:
+            \s+file="(?P<file_origin>[^"]*)"
+        )?
+    """,
+    re.DOTALL | re.IGNORECASE | re.VERBOSE,
+)
+
+
+class AgentExecutorLogPlugin(Plugin):
+    """Parse Microsoft Intune AgentExecutor logs.
+
+    The AgentExecutor log file captures script execution and system management
+    activity from the Microsoft Intune Management Extension agent.
+    This plugin parses structured entries and converts them into records suitable
+    for timeline and forensic analysis.
+    """
+
+    DEFAULT_LOG_PATH = "sysvol/ProgramData/Microsoft/IntuneManagementExtension/Logs/AgentExecutor.log"
+
+    def check_compatible(self) -> None:
+        """Verify that the AgentExecutor log file exists within the target.
+
+        Raises:
+            UnsupportedPluginError: If the expected log file does not exist.
+        """
+        if not self.target.fs.path(self.DEFAULT_LOG_PATH).exists():
+            raise UnsupportedPluginError(f"AgentExecutor.log not found at {self.DEFAULT_LOG_PATH}")
+
+    @export(record=AgentExecutorLogRecord)
+    def agentexecutor(self) -> Iterator[AgentExecutorLogRecord]:
+        """Parse the AgentExecutor.log and yield structured records.
+
+        Extracts timestamp, message, context, thread, and type information from
+        the AgentExecutor log and yields normalized structured records.
+
+        Yields:
+            AgentExecutorLogRecord: A structured representation of each log entry.
+        """
+        log_path = self.target.fs.path(self.DEFAULT_LOG_PATH)
+
+        try:
+            content = log_path.read_text()
+        except Exception:
+            self.target.log.exception("Failed to open log file %s", log_path)
+            return
+
+        match_count = 0
+
+        for match in LOG_PATTERN.finditer(content):
+            match_count += 1
+
+            msg = match.group("message").replace("\r", "").strip()
+            date_str = match.group("date")
+            hms_str = match.group("hms")
+            fractional_seconds_str = match.group("fractional_seconds")
+
+            micro_str = (fractional_seconds_str or "000000")[:6].ljust(6, "0")
+            time_str = f"{hms_str}.{micro_str}"
+
+            timestamp = None
+            for fmt in ("%m-%d-%Y %H:%M:%S.%f", "%d-%m-%Y %H:%M:%S.%f"):
+                try:
+                    timestamp = datetime.strptime(f"{date_str} {time_str}", fmt).replace(tzinfo=timezone.utc)
+                    break
+                except ValueError:
+                    continue
+
+            if not timestamp:
+                self.target.log.debug("Could not parse datetime from %s %s", date_str, time_str)
+                continue
+
+            yield AgentExecutorLogRecord(
+                ts=timestamp,
+                component=match.group("component"),
+                thread=match.group("thread"),
+                type=match.group("type"),
+                context=match.group("context"),
+                message=msg,
+                file_origin=match.group("file_origin") or "AgentExecutor.log",
+                _target=self.target,
+            )
+
+        if match_count == 0:
+            self.target.log.warning("No log entries matched the regex in %s", log_path)

dissect_target-3.25.dev39/dissect/target/plugins/os/windows/log/intunemanagementextension.py

@@ -0,0 +1,138 @@
+from __future__ import annotations
+
+import re
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+IntuneManagementExtensionLogRecord = TargetRecordDescriptor(
+    "windows/intune/managementextension/log",
+    [
+        ("datetime", "ts"),
+        ("string", "component"),
+        ("string", "thread"),
+        ("string", "type"),
+        ("string", "context"),
+        ("string", "message"),
+        ("string", "file_origin"),
+    ],
+)
+
+LOG_PATTERN = re.compile(
+    r"""
+        <!\[LOG\[(?P<message>.*?)\]LOG\]!>
+        <time="(?P<hms>\d{2}:\d{2}:\d{2})
+            (?:\.(?P<fractional_seconds>\d+))?"
+        \s+
+        date="(?P<date>[\d-]+)"
+        \s+
+        component="(?P<component>[^"]+)"
+        \s+
+        context="(?P<context>[^"]*)"
+        \s+
+        type="(?P<type>\d+)"
+        \s+
+        thread="(?P<thread>\d+)"
+        \s+
+        file="(?P<file_origin>[^"]*)"
+    """,
+    re.DOTALL | re.IGNORECASE | re.VERBOSE,
+)
+
+
+class IntuneManagementExtensionLogParserPlugin(Plugin):
+    """Parse Microsoft Intune Management Extension logs (including rotated logs).
+
+    This plugin processes both the primary `IntuneManagementExtension.log` file and
+    any timestamped rotated versions (e.g. `IntuneManagementExtension-20251009-135155.log`).
+
+    Each parsed entry includes metadata such as timestamp, log type, thread ID,
+    component name, and message content.
+    """
+
+    LOG_DIR = "sysvol/ProgramData/Microsoft/IntuneManagementExtension/Logs"
+
+    def check_compatible(self) -> None:
+        """Verify that the Intune Management Extension logs exist in the target.
+
+        Raises:
+            UnsupportedPluginError: If the log directory or log files are missing.
+        """
+        log_dir = self.target.fs.path(self.LOG_DIR)
+        if not log_dir.exists():
+            raise UnsupportedPluginError(f"Intune Management Extension log directory not found: {self.LOG_DIR}")
+
+        has_logs = any(
+            p.name.lower().startswith("intunemanagementextension") and p.name.lower().endswith(".log")
+            for p in log_dir.iterdir()
+        )
+        if not has_logs:
+            raise UnsupportedPluginError("No Intune Management Extension logs found in target.")
+
+    @export(record=IntuneManagementExtensionLogRecord)
+    def intunemanagementextension(self) -> Iterator[IntuneManagementExtensionLogRecord]:
+        """Parse Intune Management Extension log files.
+
+        Yields:
+            IntuneManagementExtensionLogRecord: One record per parsed log line.
+        """
+        log_dir = self.target.fs.path(self.LOG_DIR)
+        log_files = [
+            p
+            for p in log_dir.iterdir()
+            if p.name.lower().startswith("intunemanagementextension") and p.name.lower().endswith(".log")
+        ]
+
+        if not log_files:
+            self.target.log.warning("No Intune Management Extension log files found under %s", self.LOG_DIR)
+            return
+
+        for log_path in log_files:
+            try:
+                content = log_path.read_text()
+            except Exception:
+                self.target.log.exception("Failed to open log file %s", log_path)
+                continue
+
+            match_count = 0
+            for match in LOG_PATTERN.finditer(content):
+                match_count += 1
+
+                msg = match.group("message").replace("\r", "").replace("\n", " ").strip()
+
+                date_str = match.group("date")
+                hms_str = match.group("hms")
+                fractional_seconds_str = match.group("fractional_seconds")
+
+                micro_str = (fractional_seconds_str or "000000")[:6].ljust(6, "0")
+                time_str = f"{hms_str}.{micro_str}"
+
+                timestamp = None
+                for fmt in ("%m-%d-%Y %H:%M:%S.%f", "%d-%m-%Y %H:%M:%S.%f", "%Y-%m-%d %H:%M:%S.%f"):
+                    try:
+                        timestamp = datetime.strptime(f"{date_str} {time_str}", fmt).replace(tzinfo=timezone.utc)
+                        break
+                    except ValueError:
+                        continue
+                if not timestamp:
+                    continue
+
+                yield IntuneManagementExtensionLogRecord(
+                    ts=timestamp,
+                    component=match.group("component"),
+                    thread=match.group("thread"),
+                    type=match.group("type"),
+                    context=match.group("context"),
+                    message=msg,
+                    file_origin=f"{log_path.name}:{match.group('file_origin')}",
+                    _target=self.target,
+                )
+
+            if match_count == 0:
+                self.target.log.warning("No log entries matched regex in %s", log_path)

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/dissect/target/plugins/os/windows/wua_history.py

@@ -35,8 +35,8 @@ WuaHistoryRecord = TargetRecordDescriptor(
         ("string", "uninstall_notes"),
         ("string", "support_url"),
         ("string", "uninstall_steps"),
-        ("string", "categories"),
-        ("string", "more_info_url"),
+        ("string[]", "categories"),
+        ("string[]", "more_info_url"),
         ("string", "path"),
         ("varint", "id_user"),
         ("string", "is_service_is_additional"),
@@ -1008,7 +1008,7 @@ class WuaHistoryPlugin(Plugin):
         .. code-block:: text
 
             ts (datetime): The timestamp (UTC) of when the Windows Update Agent operation was finished.
-            categories (string): Category of the update.
+            categories (string[]): Category of the update.
             classification (string): Unique ID indicating which classification the update has.
             classification_mapped (string): Mapping of the 'classification' field, giving an understandable classification.
             client_id (string): Client that initiated the Windows Update Agent operation.

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/dissect/target/target.py

@@ -694,14 +694,22 @@ class Target:
         counter = 0
         path = "/$fs$/fs0"
 
+        fake_ntfs = set()
         for fs in self.filesystems:
+            ntfs_obj = getattr(fs, "ntfs", None)
+            if ntfs_obj in fake_ntfs:
+                continue
             if fs not in root_fs.mounts.values():
                 # determine mount point
                 while root_fs.path(path).exists():
                     counter += 1
                     path = f"/$fs$/fs{counter}"
-
                 root_fs.mount(path, fs)
+            if ntfs_obj and fs.__type__ != "ntfs":
+                # A non ntfs filesystem with a "ntfs" object means that add_virtual_ntfs_filesystem was used.
+                # We use this ntfs object to identify the "fake" ntfs filesystem.
+                # This functions due to the fake ntfs object is added to the filesystem after its parent.
+                fake_ntfs.add(ntfs_obj)
 
     def add_plugin(
         self,

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev37
+Version: 3.25.dev39
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/dissect.target.egg-info/SOURCES.txt

@@ -414,10 +414,12 @@ dissect/target/plugins/os/windows/everything/parser.py
 dissect/target/plugins/os/windows/exchange/__init__.py
 dissect/target/plugins/os/windows/exchange/exchange.py
 dissect/target/plugins/os/windows/log/__init__.py
+dissect/target/plugins/os/windows/log/agentexecutor.py
 dissect/target/plugins/os/windows/log/amcache.py
 dissect/target/plugins/os/windows/log/etl.py
 dissect/target/plugins/os/windows/log/evt.py
 dissect/target/plugins/os/windows/log/evtx.py
+dissect/target/plugins/os/windows/log/intunemanagementextension.py
 dissect/target/plugins/os/windows/log/mssql.py
 dissect/target/plugins/os/windows/log/pfro.py
 dissect/target/plugins/os/windows/log/schedlgu.py
@@ -787,9 +789,11 @@ tests/plugins/os/windows/dpapi/keyprovider/test_empty.py
 tests/plugins/os/windows/dpapi/keyprovider/test_keychain.py
 tests/plugins/os/windows/dpapi/keyprovider/test_winlogon.py
 tests/plugins/os/windows/log/__init__.py
+tests/plugins/os/windows/log/test_agentexecutor.py
 tests/plugins/os/windows/log/test_etl.py
 tests/plugins/os/windows/log/test_evt.py
 tests/plugins/os/windows/log/test_evtx.py
+tests/plugins/os/windows/log/test_intunemanagementextension.py
 tests/plugins/os/windows/log/test_mssql.py
 tests/plugins/os/windows/log/test_schedlgu.py
 tests/plugins/os/windows/regf/__init__.py

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/tests/loaders/test_kape.py

@@ -67,8 +67,8 @@ def test_dir(mock_kape_dir: Path) -> None:
 
     # The 3 found drive letter directories + the fake NTFS filesystem
     assert len(t.filesystems) == 4
-    # The 3 found drive letters + sysvol + the fake NTFS filesystem at /$fs$
-    assert len(t.fs.mounts) == 5
+    # The 3 found drive letters + sysvol
+    assert len(t.fs.mounts) == 4
     assert len(list(t.fs.mounts["c:"].ntfs.usnjrnl.records())) == 1
 
 

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/tests/loaders/test_tanium.py

@@ -64,6 +64,6 @@ def test_loader(mock_tanium_dir: Path) -> None:
 
     # The 3 found drive letter directories + the fake NTFS filesystem
     assert len(t.filesystems) == 4
-    # The 3 found drive letters + sysvol + the fake NTFS filesystem at /$fs$
-    assert len(t.fs.mounts) == 5
+    # The 3 found drive letters + sysvol
+    assert len(t.fs.mounts) == 4
     assert len(list(t.fs.mounts["c:"].ntfs.usnjrnl.records())) == 1

dissect_target-3.25.dev39/tests/plugins/os/windows/log/test_agentexecutor.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import pytest
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.plugins.os.windows.log.agentexecutor import AgentExecutorLogPlugin
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    from dissect.target.filesystem import VirtualFilesystem
+    from dissect.target.target import Target
+
+
+LOG_PATH = "ProgramData/Microsoft/IntuneManagementExtension/Logs/AgentExecutor.log"
+
+
+def test_agentexecutor_check_compatible_missing_file(target_win: Target) -> None:
+    """Plugin should raise if the AgentExecutor log is missing."""
+    with pytest.raises(UnsupportedPluginError):
+        target_win.add_plugin(AgentExecutorLogPlugin)
+
+
+def test_agentexecutor_check_compatible_success(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    """Plugin should load when the AgentExecutor log exists."""
+    fs_win.map_file(
+        LOG_PATH,
+        absolute_path("_data/plugins/os/windows/log/agentexecutor/agentexecutor.log"),
+    )
+
+    target_win.add_plugin(AgentExecutorLogPlugin)
+
+
+def test_agentexecutor_parsing_valid_entries(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    """Should parse valid AgentExecutor log entries."""
+    fs_win.map_file(
+        LOG_PATH,
+        absolute_path("_data/plugins/os/windows/log/agentexecutor/agentexecutor.log"),
+    )
+
+    target_win.add_plugin(AgentExecutorLogPlugin)
+    records = list(target_win.agentexecutor())
+
+    assert len(records) == 2
+
+    first, second = records
+
+    assert type(first).__name__ == "windows_intune_agentexecutor_log"
+    assert first.component == "AgentExecutor"
+    assert first.thread == "1"
+    assert first.type == "1"
+    assert first.context == ""
+    assert "DNS detection failed with multi-line" in first.message
+    assert first.file_origin == "AgentExecutor.log"
+
+    assert type(second).__name__ == "windows_intune_agentexecutor_log"
+    assert second.component == "AgentExecutorService"
+    assert second.thread == "2"
+    assert second.type == "2"
+    assert second.context == "CTX"
+    assert "Another entry, testing DD-MM-YYYY format" in second.message
+    assert second.file_origin == "ExplicitLogFile.log"

dissect_target-3.25.dev39/tests/plugins/os/windows/log/test_intunemanagementextension.py

@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+import pathlib
+import tempfile
+from typing import TYPE_CHECKING
+
+import pytest
+
+from dissect.target.plugins.os.windows.log.intunemanagementextension import (
+    IntuneManagementExtensionLogParserPlugin,
+)
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    from dissect.target.filesystem import VirtualFilesystem
+    from dissect.target.target import Target
+
+LOG_DIR = "ProgramData/Microsoft/IntuneManagementExtension/Logs"
+
+
+def test_intunemanagementextension_check_compatible_missing_dir(
+    target_win: Target,
+) -> None:
+    """Plugin should raise if the log directory is missing."""
+    from dissect.target.exceptions import UnsupportedPluginError
+
+    with pytest.raises(UnsupportedPluginError):
+        target_win.add_plugin(IntuneManagementExtensionLogParserPlugin)
+
+
+def test_intunemanagementextension_check_compatible_missing_logs(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    """Plugin should raise if the directory exists but contains no log files."""
+    from dissect.target.exceptions import UnsupportedPluginError
+
+    with tempfile.TemporaryDirectory() as tmpdir:
+        fs_win.map_dir(LOG_DIR, pathlib.Path(tmpdir))
+        with pytest.raises(UnsupportedPluginError):
+            target_win.add_plugin(IntuneManagementExtensionLogParserPlugin)
+
+
+def test_intunemanagementextension_check_compatible_success(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    """Plugin should load when an IntuneManagementExtension log exists."""
+    fs_win.map_file(
+        f"{LOG_DIR}/IntuneManagementExtension.log",
+        absolute_path("_data/plugins/os/windows/log/intunemanagementextension/IntuneManagementExtension.log"),
+    )
+
+    target_win.add_plugin(IntuneManagementExtensionLogParserPlugin)
+
+
+def test_intunemanagementextension_parsing_main_and_rotated(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    """Should parse valid IntuneManagementExtension log entries."""
+
+    base = "_data/plugins/os/windows/log/intunemanagementextension"
+
+    fs_win.map_file(
+        f"{LOG_DIR}/IntuneManagementExtension.log",
+        absolute_path(f"{base}/IntuneManagementExtension.log"),
+    )
+    fs_win.map_file(
+        f"{LOG_DIR}/IntuneManagementExtension-20230101-100000.log",
+        absolute_path(f"{base}/IntuneManagementExtension-20230101-100000.log"),
+    )
+
+    target_win.add_plugin(IntuneManagementExtensionLogParserPlugin)
+    records = list(target_win.intunemanagementextension())
+
+    assert len(records) == 3
+
+    first, second, third = records
+
+    expected_type = "windows_intune_managementextension_log"
+    assert type(first).__name__ == expected_type
+    assert type(second).__name__ == expected_type
+    assert type(third).__name__ == expected_type
+
+    assert first.component == "IntuneManagementExtension"
+    assert second.component == "IntuneManagementExtension"
+    assert third.component == "IntuneManagementExtension"
+
+    assert first.thread == "1002"
+    assert first.type == "2"
+    assert first.context == "Agent"
+    assert "Another entry." in first.message
+    assert first.file_origin.endswith("IntuneManagementExtension.log")
+
+    assert second.thread == "1003"
+    assert second.type == "3"
+    assert second.context == "Policy"
+    assert "YYYY-MM-DD format test." in second.message
+    assert second.file_origin.endswith("IntuneManagementExtension.log")
+
+    assert third.thread == "1001"
+    assert third.type == "1"
+    assert third.context == "ManagedSoftware"
+    assert "Test message one." in third.message
+    assert third.file_origin.endswith("IntuneManagementExtension-20230101-100000.log")

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/tests/plugins/os/windows/test_wua_history.py

@@ -48,8 +48,8 @@ def test_wua_history_plugin(target_win: Target, fs_win: VirtualFilesystem) -> No
         "unwanted software. Once you have installed this item, it cannot be removed."
     )
     assert record.support_url == "https://go.microsoft.com/fwlink/?LinkId=52661"
-    assert record.categories == "Microsoft Defender Antivirus"
-    assert record.more_info_url == "https://go.microsoft.com/fwlink/?linkid=2007160"
+    assert record.categories == ["Microsoft Defender Antivirus"]
+    assert record.more_info_url == ["https://go.microsoft.com/fwlink/?linkid=2007160"]
     assert record.id_user == 0
     assert record.is_service_is_additional == "False"
     assert record.classification == "e0789628-ce08-4437-be74-2495b842f43b"

{dissect_target-3.25.dev37 → dissect_target-3.25.dev39}/tests/test_target.py

@@ -224,6 +224,7 @@ def mocked_win_volumes_fs() -> Iterator[tuple[Mock, Mock, Mock]]:
     mock_good_volume.drive_letter = "W"
 
     mock_good_fs = Mock(name="good-fs")
+    mock_good_fs.__type__ = "mock"
     mock_good_fs.iter_subfs.return_value = []
 
     def mock_filesystem_open(volume: Mock) -> Mock:
@@ -581,7 +582,9 @@ def test_empty_volume_log(target_bare: Target, caplog: pytest.LogCaptureFixture)
 @pytest.mark.parametrize("nr_of_fs", [1, 2])
 def test_fs_mount_others(target_unix: Target, nr_of_fs: int) -> None:
     for _ in range(nr_of_fs):
-        target_unix.filesystems.add(Mock())
+        fs = Mock()
+        fs.__type__ = "mock"
+        target_unix.filesystems.add(fs)
 
     target_unix._mount_others()
 
@@ -595,7 +598,9 @@ def test_fs_mount_others(target_unix: Target, nr_of_fs: int) -> None:
 @pytest.mark.parametrize("nr_of_fs", [1, 2])
 def test_fs_mount_already_there(target_unix: Target, nr_of_fs: int) -> None:
     for idx in range(nr_of_fs):
-        target_unix.filesystems.add(Mock())
+        fs = Mock()
+        fs.__type__ = "mock"
+        target_unix.filesystems.add(fs)
         target_unix._mount_others()
 
         assert f"/$fs$/fs{idx}" in target_unix.fs.mounts