search

ydkhatri / mac_apt

macOS (& ios) Artifact Parsing Tool
https://swiftforensics.com
MIT License
779 stars 100 forks source link

MSRDC plugin invalid query #124

Open ydkhatri opened 1 day ago

ydkhatri commented 1 day ago

It seems an update to Microsoft Remote Desktop may have broken the query. In the current sqlite db, there does not appear to be any link between tables ZBOOKMARKENTITY and ZCONNECTIONTIMEENTITY.

@mnrkbys This query is now invalid. https://github.com/ydkhatri/mac_apt/blob/a6286a171354923573d2ba6c596227841addb072/plugins/msrdc.py#L125

mnrkbys commented 20 hours ago

That's right. I checked with Windows App 11.0.6 (2417) and it appears that ZCONNECTIONTIMEENTITY is no longer used. However, no alternative data seems to be stored. This query returns nothing, but also does not generate an error when the plugin is run. I don't think any code modification is necessary.

mnrkbys commented 18 hours ago

I have noticed that there is a column called ZCONNECTIONCOUNT in ZBOOKMARKENTITY. This value indicates the number of times a connection was made to the computer. It might be a good idea to add it to the plugin's results.