Difference between revisions of "Expand"
Jump to navigation
Jump to search
| Line 1,092: | Line 1,092: | ||
! ID | ! ID | ||
! Description | ! Description | ||
| + | ! Items Produced | ||
|- | |- | ||
| − | | | + | | 1 || VHD || [[Event Types|EVENT_TYPE_DISK_MOUNTED]] |
|- | |- | ||
| − | | | + | | 2 || VHD || [[Event Types|EVENT_TYPE_DISK_DISMOUNTED]] |
|- | |- | ||
| − | | | + | | 22 || RDP Connection || [[Event Types|EVENT_TYPE_RDP_CONNECTION]] |
|- | |- | ||
| − | | | + | | 25 || RDP Connection || [[Event Types|EVENT_TYPE_RDP_CONNECTION]] |
|- | |- | ||
| − | | | + | | 300 || Word Document Recovery || [[Event Types|EVENT_TYPE_OFFICE_ALERT]] |
|- | |- | ||
| − | | 1001 || USB Info | + | | 600 || Powershell Command Line || [[Event Types|EVENT_TYPE_POSSIBLE_INFECTION]] |
| + | |- | ||
| + | | 1001 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_USB_DEVICE]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]] | ||
|- | |- | ||
| 1002 || USB Info | | 1002 || USB Info | ||
| Line 1,117: | Line 1,120: | ||
| 4616 || Change System Time | | 4616 || Change System Time | ||
|- | |- | ||
| − | | 4624 || Logon | + | | 4624 || Logon || [[Event Types|EVENT_TYPE_LOGON]] |
|- | |- | ||
| 4663 || WiFi Data | | 4663 || WiFi Data | ||
Revision as of 06:15, 2 June 2024
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
| ID | Description | Items Produced |
|---|---|---|
| 1 | VHD | EVENT_TYPE_DISK_MOUNTED |
| 2 | VHD | EVENT_TYPE_DISK_DISMOUNTED |
| 22 | RDP Connection | EVENT_TYPE_RDP_CONNECTION |
| 25 | RDP Connection | EVENT_TYPE_RDP_CONNECTION |
| 300 | Word Document Recovery | EVENT_TYPE_OFFICE_ALERT |
| 600 | Powershell Command Line | EVENT_TYPE_POSSIBLE_INFECTION |
| 1001 | USB Info | ENTITY_TYPE_DISK_SIGNATURE ENTITY_TYPE_SERIAL_NUMBER ENTITY_TYPE_USB_DEVICE ENTITY_TYPE_VOLUME_NAME ENTITY_TYPE_VOLUME_SERIAL_NUMBER EVENT_TYPE_USB_INSERTED |
| 1002 | USB Info | |
| 1006 | USB Info | |
| 2003 | USB Info | |
| 2102 | USB Info | |
| 2104 | USB Info | |
| 4616 | Change System Time | |
| 4624 | Logon | EVENT_TYPE_LOGON |
| 4663 | WiFi Data | |
| 6100 | WiFi Data | |
| 7045 | Service Installed | |
| 8001 | WiFi Data | |
| 8003 | WiFi Data | |
| 11001 | WiFi Data | |
| 20001 | USB Data | |
| 20003 | USB Data | |
| 24576 | USB Data | |
| 24577 | USB Data | |
| 50067 | WiFi Data |
