dissect.target 3.25.dev65__tar.gz → 3.25.2.dev3__tar.gz

{dissect_target-3.25.dev65 → dissect_target-3.25.2.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev65
+Version: 3.25.2.dev3
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -23,11 +23,11 @@ License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
 Requires-Dist: dissect.cstruct<5,>=4
-Requires-Dist: dissect.database<2,>=1.1.dev4
+Requires-Dist: dissect.database<2,>=1.1
 Requires-Dist: dissect.eventlog<4,>=3
-Requires-Dist: dissect.evidence<4,>=3.13.dev3
-Requires-Dist: dissect.hypervisor<4,>=3.21.dev5
-Requires-Dist: dissect.ntfs<4,>=3.16.dev
+Requires-Dist: dissect.evidence<4,>=3.13
+Requires-Dist: dissect.hypervisor<4,>=3.21
+Requires-Dist: dissect.ntfs<4,>=3.16
 Requires-Dist: dissect.regf<4,>=3.13
 Requires-Dist: dissect.util<4,>=3
 Requires-Dist: dissect.volume<4,>=3.17
@@ -35,7 +35,7 @@ Requires-Dist: flow.record~=3.21.0
 Requires-Dist: structlog
 Provides-Extra: full
 Requires-Dist: asn1crypto; extra == "full"
-Requires-Dist: dissect.apfs<2,>=1.0.2.dev; extra == "full"
+Requires-Dist: dissect.apfs<2,>=1.1; extra == "full"
 Requires-Dist: dissect.archive<2,>=1; extra == "full"
 Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cim<4,>=3; extra == "full"
@@ -63,33 +63,34 @@ Requires-Dist: tomli; python_version < "3.11" and extra == "full"
 Requires-Dist: backports.zstd; python_version < "3.14" and extra == "full"
 Provides-Extra: dev
 Requires-Dist: dissect.target[full,yara]; extra == "dev"
-Requires-Dist: dissect.apfs[dev]<2.0.dev,>=1.0.2.dev; extra == "dev"
+Requires-Dist: dissect.apfs[dev]<2.0.dev,>=1.1; extra == "dev"
 Requires-Dist: dissect.archive[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.btrfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cramfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
-Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1.dev8; extra == "dev"
+Requires-Dist: dissect.database[dev]<2.0.dev,>=1.1; extra == "dev"
 Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
-Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.13.dev2; extra == "dev"
+Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.13; extra == "dev"
 Requires-Dist: dissect.executable[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
-Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.5.dev; extra == "dev"
-Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.21.dev3; extra == "dev"
+Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.5; extra == "dev"
+Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.21; extra == "dev"
 Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.5.dev; extra == "dev"
-Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.16.dev; extra == "dev"
-Requires-Dist: dissect.qnxfs[dev]<2.0.dev,>=1.1.dev; extra == "dev"
-Requires-Dist: dissect.regf[dev]<4.0.dev,>=3.13.dev; extra == "dev"
+Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.16; extra == "dev"
+Requires-Dist: dissect.ole[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.qnxfs[dev]<2.0.dev,>=1.1; extra == "dev"
+Requires-Dist: dissect.regf[dev]<4.0.dev,>=3.13; extra == "dev"
 Requires-Dist: dissect.shellitem[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.squashfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.thumbcache[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.util<4.0.dev,>=3.0.dev; extra == "dev"
-Requires-Dist: dissect.vmfs[dev]<4.0.dev,>=3.12.dev; extra == "dev"
-Requires-Dist: dissect.volume[dev]<4.0.dev,>=3.17.dev; extra == "dev"
+Requires-Dist: dissect.vmfs[dev]<4.0.dev,>=3.12; extra == "dev"
+Requires-Dist: dissect.volume[dev]<4.0.dev,>=3.17; extra == "dev"
 Requires-Dist: dissect.xfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Provides-Extra: yara
 Requires-Dist: dissect.target[full]; extra == "yara"

{dissect_target-3.25.dev65 → dissect_target-3.25.2.dev3}/dissect/target/plugins/filesystem/yara.py

@@ -1,10 +1,12 @@
 from __future__ import annotations
 
+import contextlib
 import hashlib
 from io import BytesIO
 from pathlib import Path
 
 from dissect.target.helpers import hashutil
+from dissect.target.helpers.fsutil import open_decompress
 from dissect.target.helpers.logging import get_logger
 
 try:
@@ -54,6 +56,7 @@ class YaraPlugin(Plugin):
     @arg("-p", "--path", default="/", help="path on target(s) to recursively scan")
     @arg("-m", "--max-size", type=int, default=DEFAULT_MAX_SCAN_SIZE, help="maximum file size in bytes to scan")
     @arg("-c", "--check", action="store_true", help="check if every YARA rule is valid")
+    @arg("--no-decompress", action="store_true", help="do not automatically decompress files for extra scanning")
     @export(record=YaraMatchRecord)
     def yara(
         self,
@@ -61,6 +64,7 @@ class YaraPlugin(Plugin):
         path: str = "/",
         max_size: int = DEFAULT_MAX_SCAN_SIZE,
         check: bool = False,
+        no_decompress: bool = False,
     ) -> Iterator[YaraMatchRecord]:
         """Scan files inside the target up to a given maximum size with YARA rule file(s).
 
@@ -69,6 +73,7 @@ class YaraPlugin(Plugin):
             path: ``string`` of absolute target path to scan.
             max_size: Files larger than this size will not be scanned.
             check: Check if provided rules are valid, only compiles valid rules.
+            no_decompress: Do not automatically decompress compressed files before scanning.
 
         Returns:
             Iterator yields ``YaraMatchRecord``.
@@ -87,29 +92,56 @@ class YaraPlugin(Plugin):
 
         self.target.log.warning("Will not scan files larger than %s MB", max_size // 1024 // 1024)
 
+        if no_decompress:
+            self.target.log.info("Will not automatically check in compressed files")
+        else:
+            self.target.log.info(
+                "Will check in compressed files automatically (at most %s MB after decompression)",
+                max_size // 1024 // 1024,
+            )
+
         for _, _, files in self.target.fs.walk_ext(path):
             for file in files:
+                fhandles = []
                 try:
                     if (file_size := file.stat().st_size) > max_size:
                         self.target.log.info("Not scanning file of %s MB: '%s'", (file_size // 1024 // 1024), file)
                         continue
 
-                    buf = file.open().read()
-                    for match in compiled_rules.match(data=buf):
-                        string_matches: list[str] = []
-                        for string in match.strings:
-                            string_matches.extend(f"{string}={instance}" for instance in string.instances)
-
-                        yield YaraMatchRecord(
-                            ts_mtime=file.stat().st_mtime,
-                            path=self.target.fs.path(file.path),
-                            rule=match.rule,
-                            matches=string_matches,
-                            tags=match.tags,
-                            digest=hashutil.common(BytesIO(buf)),
-                            namespace=match.namespace,
-                            _target=self.target,
-                        )
+                    fh_original = file.open()
+                    fhandles.append(fh_original)
+                    if not no_decompress:
+                        fh_decompress = open_decompress(fileobj=fh_original, mode="rb")
+                        if fh_decompress is not fh_original:
+                            fhandles.append(fh_decompress)
+
+                    for fh in fhandles:
+                        buf = fh.read(max_size + 1)
+                        if len(buf) > max_size:
+                            self.target.log.warning(
+                                "Decompressed '%s' is larger than the maximum scan size, scanning up to %s bytes",
+                                file,
+                                max_size,
+                            )
+
+                        # ensure that the original file handle is reset for compressed reads
+                        fh_original.seek(0)
+
+                        for match in compiled_rules.match(data=buf):
+                            string_matches: list[str] = []
+                            for string in match.strings:
+                                string_matches.extend(f"{string}={instance}" for instance in string.instances)
+
+                            yield YaraMatchRecord(
+                                ts_mtime=file.stat().st_mtime,
+                                path=self.target.fs.path(file.path),
+                                rule=match.rule,
+                                matches=string_matches,
+                                tags=match.tags,
+                                digest=hashutil.common(BytesIO(buf)),
+                                namespace=match.namespace,
+                                _target=self.target,
+                            )
 
                 except FileNotFoundError:
                     continue
@@ -118,6 +150,10 @@ class YaraPlugin(Plugin):
                 except Exception as e:
                     self.target.log.error("Exception scanning file '%s'", file)  # noqa: TRY400
                     self.target.log.debug("", exc_info=e)
+                finally:
+                    for fh in reversed(fhandles):
+                        with contextlib.suppress(Exception):
+                            fh.close()
 
 
 def process_rules(paths: list[str | Path], check: bool = False) -> yara.Rules | None:

{dissect_target-3.25.dev65 → dissect_target-3.25.2.dev3}/dissect/target/plugins/os/windows/ad/ntds.py

@@ -2,10 +2,13 @@ from __future__ import annotations
 
 from datetime import datetime
 from functools import cached_property
+from itertools import zip_longest
 from typing import TYPE_CHECKING, Any
 
 from dissect.database.ese.ntds import NTDS
+from dissect.database.ese.ntds.util import UserAccountControl
 
+from dissect.target.exceptions import RegistryKeyNotFoundError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, UnsupportedPluginError, export, internal
 from dissect.target.plugins.os.windows.sam import des_decrypt
@@ -102,17 +105,21 @@ class NtdsPlugin(Plugin):
 
     def __init__(self, target: Target):
         super().__init__(target)
-        self.path = None
-
+        path = "sysvol/windows/NTDS/ntds.dit"
         if self.target.has_function("registry"):
-            key = self.target.registry.value(NTDS_PARAMETERS_REGISTRY_PATH, NTDS_PARAMETERS_DB_VALUE)
-            self.path = self.target.fs.path(key.value)
+            try:
+                key = self.target.registry.value(NTDS_PARAMETERS_REGISTRY_PATH, NTDS_PARAMETERS_DB_VALUE)
+                path = key.value
+            except RegistryKeyNotFoundError:
+                pass
+
+        self.path = self.target.fs.path(path)
 
     def check_compatible(self) -> None:
         if not self.target.has_function("lsa"):
             raise UnsupportedPluginError("System Hive is not present or LSA function not available")
 
-        if self.path is None or not self.path.is_file():
+        if not self.path.is_file():
             raise UnsupportedPluginError("No NTDS.dit database found on target")
 
     @cached_property
@@ -166,6 +173,58 @@ class NtdsPlugin(Plugin):
                 _target=self.target,
             )
 
+    @export(output="yield")
+    def secretsdump(self) -> Iterator[str]:
+        """Extract credentials in secretsdump format. Because it's a popular format."""
+
+        # Keep impacket defined constants in the method so we don't polute our own
+        kerberos_key_type = {
+            1: "dec-cbc-crc",
+            3: "des-cbc-md5",
+            17: "aes128-cts-hmac-sha1-96",
+            18: "aes256-cts-hmac-sha1-96",
+            0xFFFFFF74: "rc4_hmac",
+        }
+
+        for obj in self.ntds.query(
+            # For now just use the same filter as secretsdump.py
+            "(&(|(sAMAccountType=805306368)(sAMAccountType=805306369)(sAMAccountType=805306370))(instanceType=4))"
+        ):
+            if (upn := obj.get("userPrincipalName")) is not None:
+                domain = upn.split("@")[-1]
+                username = f"{domain}\\{obj.sam_account_name}"
+            else:
+                username = obj.sam_account_name
+
+            rid = obj.rid
+            lm_hash = des_decrypt(lm_pwd, rid).hex() if (lm_pwd := obj.get("dBCSPwd")) else DEFAULT_LM_HASH
+            nt_hash = des_decrypt(nt_pwd, rid).hex() if (nt_pwd := obj.get("unicodePwd")) else DEFAULT_NT_HASH
+            pwd_last_set = obj.get("pwdLastSet")
+            user_account_status = (
+                "Disabled" if UserAccountControl.ACCOUNTDISABLE in obj.user_account_control else "Enabled"
+            )
+
+            yield f"{username}:{rid}:{lm_hash}:{nt_hash}::: (pwdLastSet={pwd_last_set}) (status={user_account_status})"
+
+            # Password history output doesn't match what secretsdump.py outputs, but that's because they parse it wrong.
+            # Their crypto is flawed and assumes the LM history is always RC4 encrypted. That's not the case,
+            # it's just another encrypted blob that has an USHORT AlgoritmId determining the encryption type.
+            # Our decryption is handled transparently by the NTDS implementation, so we don't have to worry about it.
+            lm_history = [des_decrypt(lm, rid).hex() for lm in obj.get("lmPwdHistory")]
+            nt_history = [des_decrypt(nt, rid).hex() for nt in obj.get("ntPwdHistory")]
+            for i, (lm_hist, nt_hist) in enumerate(zip_longest(lm_history, nt_history, fillvalue="")):
+                yield f"{username}_history{i}:{rid}:{lm_hist}:{nt_hist}:::"
+
+            for supplemental in obj.get("supplementalCredentials") or []:
+                if "Primary:Kerberos-Newer-Keys" in supplemental:
+                    for cred in supplemental["Primary:Kerberos-Newer-Keys"]["Credentials"]:
+                        key_type = kerberos_key_type.get(cred["KeyType"], hex(cred["KeyType"]))
+                        key = cred["Key"].hex()
+                        yield f"{username}:{key_type}:{key}"
+
+                if "Primary:CLEARTEXT" in supplemental:
+                    yield f"{username}:CLEARTEXT:{supplemental['Primary:CLEARTEXT']}"
+
 
 def extract_user_info(user: User | Computer, target: Target) -> dict[str, Any]:
     """Extract generic information from a User or Computer account."""

{dissect_target-3.25.dev65 → dissect_target-3.25.2.dev3}/dissect/target/plugins/os/windows/generic.py

@@ -45,14 +45,6 @@ KnownDllRecord = UserRegistryRecordDescriptor(
     ],
 )
 
-SessionManagerRecord = UserRegistryRecordDescriptor(
-    "filesystem/registry/sessionmanager",
-    [
-        ("datetime", "ts"),
-        ("path", "path"),
-    ],
-)
-
 NullSessionPipeRecord = UserRegistryRecordDescriptor(
     "filesystem/registry/nullsessionpipes",
     [
@@ -296,58 +288,6 @@ class GenericPlugin(Plugin):
         except RegistryError:
             pass
 
-    @export(record=SessionManagerRecord)
-    def sessionmanager(self) -> Iterator[SessionManagerRecord]:
-        """Return interesting Session Manager (Smss.exe) registry key entries.
-
-        Session Manager (Smss.exe) is the first user-mode process started by the kernel and performs several tasks,
-        such as creating environment variables, starts the Windows Logon Manager (winlogon.exe), etc. The BootExecute
-        registry key holds the Windows tasks that cannot be performed when Windows is running, the Execute registry key
-        should never be populated when Windows is installed. Can be leveraged as persistence mechanisms.
-
-        References:
-            - https://en.wikipedia.org/wiki/Session_Manager_Subsystem
-            - https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2
-        """
-        keys = [
-            ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager", "BootExecute"),
-            ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager", "Execute"),
-            ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\SubSystems", "windows"),
-            ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\WOW", "cmdline"),
-            ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\WOW", "wowcmdline"),
-        ]
-
-        for key, name in keys:
-            for r in self.target.registry.keys(key):
-                try:
-                    value = r.value(name)
-                    data = value.value
-                except RegistryError:
-                    continue
-
-                user = self.target.registry.get_user(r)
-
-                if isinstance(data, list):
-                    for d in data:
-                        if d == "autocheck autochk *":
-                            continue
-
-                        yield SessionManagerRecord(
-                            ts=r.ts,
-                            path=self.target.fs.path(d),
-                            _target=self.target,
-                            _user=user,
-                            _key=r,
-                        )
-                else:
-                    yield SessionManagerRecord(
-                        ts=r.ts,
-                        path=self.target.fs.path(data.split(" ")[0]),
-                        _target=self.target,
-                        _user=user,
-                        _key=r,
-                    )
-
     @export(record=NullSessionPipeRecord)
     def nullsessionpipes(self) -> Iterator[NullSessionPipeRecord]:
         """Return the NullSessionPipes registry key value.

{dissect_target-3.25.dev65 → dissect_target-3.25.2.dev3}/dissect/target/plugins/os/windows/log/mssql.py

@@ -78,24 +78,45 @@ class MssqlPlugin(Plugin):
             for errorlog in log_path.glob(self.FILE_GLOB):
                 # The errorlog includes a BOM, so endianess gets determined automatically
                 fh = errorlog.open(mode="rt", encoding="utf-16", errors="surrogateescape")
-                buf = ""
+
+                current_ts: re.Match[str] | None = None
+                current_buf = ""
 
                 for line in fh:
-                    if ts := RE_TIMESTAMP_PATTERN.match(line):
-                        yield MssqlErrorlogRecord(
-                            ts=datetime.strptime(ts.group(), "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
-                            instance=instance,
-                            # The process name is a fixed-width field and is always 12 characters long.
-                            process=buf[23:35].strip(),
-                            message=buf[35:].strip(),
-                            path=errorlog,
-                            _target=self.target,
-                        )
-                        buf = ""
-
-                    buf += line
-
-    def _find_instances(self) -> set[str, TargetPath]:
+                    # If we have a buffer with a timestamp and
+                    # our current line also has a timestamp,
+                    # we should have a complete record in our buffer.
+                    if ts_match := RE_TIMESTAMP_PATTERN.match(line):
+                        if current_ts:
+                            yield MssqlErrorlogRecord(
+                                ts=datetime.strptime(current_ts.group(), "%Y-%m-%d %H:%M:%S.%f").replace(
+                                    tzinfo=timezone.utc
+                                ),
+                                instance=instance,
+                                # The process name is a fixed-width field and is always 12 characters long.
+                                process=current_buf[23:35].strip(),
+                                message=current_buf[35:].strip(),
+                                path=errorlog,
+                                _target=self.target,
+                            )
+
+                        current_ts = ts_match
+                        current_buf = line
+                    elif current_buf:
+                        current_buf += line
+                # For the last line
+                if current_ts and current_buf:
+                    yield MssqlErrorlogRecord(
+                        ts=datetime.strptime(current_ts.group(), "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
+                        instance=instance,
+                        # The process name is a fixed-width field and is always 12 characters long.
+                        process=current_buf[23:35].strip(),
+                        message=current_buf[35:].strip(),
+                        path=errorlog,
+                        _target=self.target,
+                    )
+
+    def _find_instances(self) -> set[tuple[str, TargetPath]]:
         return {
             (subkey.name, self.target.fs.path(subkey.subkey("SQLServerAgent").value("ErrorLogFile").value).parent)
             for subkey in self.target.registry.glob_ext(self.MSSQL_KEY_GLOB)

{dissect_target-3.25.dev65 → dissect_target-3.25.2.dev3}/dissect/target/plugins/os/windows/regf/runkeys.py

@@ -19,7 +19,7 @@ RunKeyRecord = create_extended_descriptor([RegistryRecordDescriptorExtension, Us
         ("datetime", "ts"),
         ("wstring", "name"),
         ("command", "command"),
-        ("string", "key"),
+        ("string", "source"),
     ],
 )
 
@@ -28,6 +28,7 @@ class RunKeysPlugin(Plugin):
     """Plugin that iterates various Runkey locations."""
 
     KEYS = (
+        # System-wide ASEP
         "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
         "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
         "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
@@ -38,16 +39,31 @@ class RunKeysPlugin(Plugin):
         "HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Setup",
         "HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx",
         "HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
+        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",  # noqa: E501
+        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",  # noqa: E501
+        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx",  # noqa: E501
+        # Per user ASEP
         "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
         "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
         "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
         "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Setup",
         "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx",
+        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run",
+        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",  # noqa: E501
+        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",  # noqa: E501
+        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx",  # noqa: E501
+        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
         "HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
         "HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
         "HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
         "HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Setup",
         "HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx",
+        # Service start-up
+        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices",
+        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce",
+        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices",
+        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce",
     )
 
     def check_compatible(self) -> None:
@@ -64,6 +80,8 @@ class RunKeysPlugin(Plugin):
 
         References:
             - https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
+            - https://attack.mitre.org/techniques/T1547/001/
+            - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
 
         Yields RunKeyRecords with fields:
 
@@ -74,18 +92,18 @@ class RunKeysPlugin(Plugin):
             ts (datetime): The registry key last modified timestamp.
             name (string): The run key name.
             command (command): The run key command.
-            key (string): The source key for this run key.
+            source (string): The source registry key for this run key.
         """
-        for key in self.KEYS:
-            for r in self.target.registry.keys(key):
-                user = self.target.registry.get_user(r)
-                for entry in r.values():
+        for key_path in self.KEYS:
+            for key in self.target.registry.keys(key_path):
+                user = self.target.registry.get_user(key)
+                for entry in key.values():
                     yield RunKeyRecord(
-                        ts=r.ts,
+                        ts=key.ts,
                         name=entry.name,
                         command=entry.value or None,
-                        key=key,
+                        source=key_path,
                         _target=self.target,
-                        _key=r,
+                        _key=key,
                         _user=user,
                     )

dissect_target-3.25.2.dev3/dissect/target/plugins/os/windows/regf/sessionmanager.py

@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import RegistryError, UnsupportedPluginError
+from dissect.target.plugin import Plugin, export
+from dissect.target.plugins.os.windows.generic import UserRegistryRecordDescriptor
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.target.helpers.regutil import RegistryKey
+    from dissect.target.target import Target
+
+SessionManagerRecord = UserRegistryRecordDescriptor(
+    "windows/registry/sessionmanager",
+    [
+        ("datetime", "ts"),
+        ("command", "command"),
+        ("string", "source"),
+    ],
+)
+
+
+class SessionManagerPlugin(Plugin):
+    """Windows Session Manager (smss.exe) plugin."""
+
+    KEYS = (
+        ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager", "BootExecute"),
+        ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager", "Execute"),
+        ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager", "S0InitialCommand"),
+        ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager", "SetupExecute"),
+        ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\SubSystems", "windows"),
+        ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\WOW", "cmdline"),
+        ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\WOW", "wowcmdline"),
+        ("HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control", "ServiceControlManagerExtension"),
+    )
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+
+        self.keys: list[tuple[RegistryKey, str]] = []
+
+        if self.target.has_function("registry"):
+            self.keys = [
+                (key, name_str) for key_str, name_str in self.KEYS for key in self.target.registry.keys(key_str)
+            ]
+
+    def check_compatible(self) -> None:
+        if not self.keys:
+            raise UnsupportedPluginError("No session manager keys found on target")
+
+    @export(record=SessionManagerRecord)
+    def sessionmanager(self) -> Iterator[SessionManagerRecord]:
+        """Return interesting Session Manager (Smss.exe) registry key entries.
+
+        Session Manager (Smss.exe) is the first user-mode process started by the kernel and performs several tasks, such
+        as creating environment variables, starts the Windows Logon Manager (winlogon.exe), etc. The BootExecute
+        registry key holds the Windows tasks that cannot be performed when Windows is running, the Execute registry key
+        should never be populated when Windows is installed. Can be leveraged as persistence mechanisms.
+
+        References:
+            - https://en.wikipedia.org/wiki/Session_Manager_Subsystem
+            - https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2
+        """
+
+        for key, name in self.keys:
+            user = self.target.registry.get_user(key)
+
+            try:
+                value = key.value(name).value
+            except RegistryError:
+                continue
+
+            if not isinstance(value, list):
+                value = [value]
+
+            for item in value:
+                # This is the default value of BootExecute in Windows.
+                if item == "autocheck autochk *":
+                    continue
+
+                yield SessionManagerRecord(
+                    ts=key.ts,
+                    command=item,
+                    source=f"HKLM\\{key.path}\\{name}",
+                    _target=self.target,
+                    _user=user,
+                    _key=key,
+                )

{dissect_target-3.25.dev65 → dissect_target-3.25.2.dev3}/dissect/target/tools/yara.py

@@ -29,8 +29,9 @@ def main() -> int:
     parser.add_argument("targets", metavar="TARGETS", nargs="*", help="Targets to load")
     parser.add_argument("-s", "--strings", action="store_true", help="print output as string")
 
+    plugin_parser = parser.add_argument_group("YARA plugin options")
     for args, kwargs in getattr(YaraPlugin.yara, "__args__", []):
-        parser.add_argument(*args, **kwargs)
+        plugin_parser.add_argument(*args, **kwargs)
 
     configure_generic_arguments(parser)
 
@@ -48,7 +49,7 @@ def main() -> int:
     try:
         for target in open_targets(args):
             rs = record_output(args.strings, False)
-            for record in target.yara(args.rules, args.path, args.max_size, args.check):
+            for record in target.yara(args.rules, args.path, args.max_size, args.check, args.no_decompress):
                 rs.write(record)
 
     except TargetError as e: