Difference between revisions of "Expand"
Jump to navigation
Jump to search
| Line 1,108: | Line 1,108: | ||
| 1001<br />1002 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_USB_DEVICE]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]] | | 1001<br />1002 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_USB_DEVICE]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]] | ||
|- | |- | ||
| − | | 1006 || USB Info | + | | 1006 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]] |
|- | |- | ||
| 2003 || USB Info | | 2003 || USB Info | ||
Revision as of 06:23, 2 June 2024
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
| ID | Description | Items Produced |
|---|---|---|
| 1 | VHD | EVENT_TYPE_DISK_MOUNTED |
| 2 | VHD | EVENT_TYPE_DISK_DISMOUNTED |
| 22 | RDP Connection | EVENT_TYPE_RDP_CONNECTION |
| 25 | RDP Connection | EVENT_TYPE_RDP_CONNECTION |
| 300 | Word Document Recovery | EVENT_TYPE_OFFICE_ALERT |
| 600 | Powershell Command Line | EVENT_TYPE_POSSIBLE_INFECTION |
| 1001 1002 |
USB Info | ENTITY_TYPE_DISK_SIGNATURE ENTITY_TYPE_SERIAL_NUMBER ENTITY_TYPE_USB_DEVICE ENTITY_TYPE_VOLUME_NAME ENTITY_TYPE_VOLUME_SERIAL_NUMBER EVENT_TYPE_USB_INSERTED |
| 1006 | USB Info | ENTITY_TYPE_DISK_SIGNATURE ENTITY_TYPE_SERIAL_NUMBER ENTITY_TYPE_VOLUME_NAME ENTITY_TYPE_VOLUME_SERIAL_NUMBER |
| 2003 | USB Info | |
| 2102 | USB Info | |
| 2104 | USB Info | |
| 4616 | Change System Time | |
| 4624 | Logon | EVENT_TYPE_LOGON |
| 4663 | WiFi Data | |
| 6100 | WiFi Data | |
| 7045 | Service Installed | |
| 8001 | WiFi Data | |
| 8003 | WiFi Data | |
| 11001 | WiFi Data | |
| 20001 | USB Data | |
| 20003 | USB Data | |
| 24576 | USB Data | |
| 24577 | USB Data | |
| 50067 | WiFi Data |
