Skip to content

Initial Access

Email

Email Attachments

Description: List and hash all files in common Outlook temp directories

Author: @eric_capuano

Query:

SELECT * FROM hash 
WHERE (path LIKE 'C:\Users\%\AppData\Local\Temp\%.tmp\%' 
OR path LIKE 'C:\Users\%\AppData\Local\Microsoft\Outlook%%');

File Opening

Jump Lists

Description: Enumerate LNK files in user jump lists, evidence of file opening.

Author: @eric_capuano

Query:

SELECT datetime(btime, 'unixepoch', 'localtime') AS firstaccess,
datetime(mtime, 'unixepoch', 'localtime') AS lastaccess,filename,path
FROM file
WHERE path LIKE 'C:\Users\%\AppData\Roaming\Microsoft\Windows\Recent\%.lnk'
ORDER BY lastaccess DESC;

File Download

Open/Save MRU

Description: Tracks files that have been opened or saved within a Windows shell dialog box

Author: @eric_capuano

Query:

SELECT datetime(mtime, 'unixepoch', 'localtime') AS mtime,name,path,key FROM registry 
WHERE path LIKE 'HKEY_USERS\%\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\%%';