I always find it of much interest when a new to me forensic artifact raises its evidentiary head! One such event happened last evening, and it cost me a little sleep reading about it and wondering if I had missed items in past investigations. Now, granted no one can know everything, but every little bit helps.
In this case Fortinet released some excellent information on Auto-logger-diagtrack-listener.etl. I know, right! Who would have thought of this, but it provides the forensic examiner with the possibility to get visibility into process execution data from the AutoLogger-Diagtrack-Listener.etl, a program maybe overlooked.
Fortinet reported that during a recent incident response engagement, their IR services were working on a ransomware case where the attacker had used anti-forensic techniques in an effort to cover their tracks and hide their malware. This is a fairly common technique among attackers and can often be spotted, but the tools and information might very well be gone.
So, what is ETW? It is a built-in, high-performance logging framework enabling Windows and applications to record detailed events with minimal overhead. ETW does not use plain text logs, but rather it uses providers such as the kernel, TCP/IP stack, or registry, that sends structured event data into ETW sessions. These sessions can either buffer the data for real-time consumption or write it to binary Event Trace Log (ETL) files. All of this provides some extra evidence that analysts can and should be checked for during investigations.
I will leave it to the Fortinet report, which you can read here: https://www.fortinet.com/blog/threat-research/uncovering-hidden-forensic-evidence-in-windows-mystery-of-autologger?utm_source=social&utm_medium=amplify-org&utm_campaign=sprinklr, to further explain their findings and the application that forensic analysts can make of it!
You can also read more about Event Tracing and its associated data here: https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session.
Take the time to keep learning and applying new information to each and every investigation or case you are involved with, it can always reveal something new!
Leave a Reply