Plaso 20260720 released

By

 Plaso 20260720 released

The Plaso team is delighted to announce a new Plaso release, 20260720. This release has a mixture of new features and under the hood improvements.

Notable changes

  • Changes to schema and storage format as previously noted. Note that these change default behavior and can break backwards compatibility of storage files, filters and tagging rules. These include:

    • introduction of data type counter (#5017) with thanks to @nflexfo 

    • the “description” and “description_short” fields are no longer available in dynamic output. These fields previously were duplicate supported names for message and message_short, which are now the only way to refer to these fields.

    • The filename and inode fields in the psort/psteal output are no longer auto-populated with a value derived from the path specification of the event data stream and will be left empty if not set in the event data. You can use the command line option “--output-fallback-path” to enable the behavior.

    • The hostname field in the psort/psteal output is no longer auto-populated with a hostname derived by pre-processing and will be left empty if not set in the event data. You can use the command line option “--output-fallback-hostname” to enable the behavior.

    • Name changes of several event data types (#2836)

    • Name changes of attributes in multiple event data types for disambiguation and consistency of (#4956)

    • Removal of deprecated YearLessLogHelper (#5122)

    • Tagging of corrupted and/or recovered events (#5140)

  • Added Added iOS Health SQLite (healthdb_secure.sqlite) plugin (#5149) with thanks to @annisadp. Note that additional changes are pending in #5027. Do not hesitate to send a PR if you want to help improve support for this format.

  • Added support for Ivanti Connect/Pulse Secure VC0 logs (#5070) with thanks to @julianghill.

  • Added support for the TypedUrlsTime Window Registry key (#5104)

  • Added support for XFS bigtime, nrext64 and parent features (#4986)

  • Improved the utmp parser to better handle corruption and support 64-bit and big-endian utmp files (#5115) with thanks to @kev365 

  • Improved the systemd journal (#5139) and selinux log parser (#5172) with thanks to @kev365 

  • Numerous other improvements, including in dependencies, (#5113, #5114, #5117, #5119, #5121, #5176) with thanks to @kev365, @Spferical and @benjamindonnachie

  • Removed Viper version 1 analysis plugin (#5042)

  • Several changes for handling Windows EventLog message strings

    • Text after %0 in message string (template) is now ignored (#5144) to match EventViewer behavior

    • Added support for multi-parameter expansion (#5145)

    • Removed support for legacy winevt-rc database format (20150315) (#4906)

  • For developers, changes to the style guide due to adoption of black Python formatter and convention around event attribute naming.


The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone.


Note that the VC0 and iOS Health SQLite database formats support could benefit from more reference data. Please reach out if you have file samples and want to help improve these, and other, parsers.

Upcoming changes in future releases

  • 32-bit Windows builds of wheels will be removed from l2tbinaries

  • Move image export to the dfImageTools project (#1)


Where/how to get Plaso 20260720?

See Plaso's Users' Guide. The development team recommends using Docker to install Plaso without hassle. 


If Docker does not fit your needs there are installation instructions available for Mac OS, Ubuntu and Fedora. 


If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.

Comments

Post a Comment

Popular posts from this blog

Parsing the $MFT NTFS metadata file

By
Background Numerous articles have been written about parsing the $MFT NTFS metadata file before. Some of these explain the technique itself [ 1 ] and others mostly focus on how to use tools. Rarely do articles mention the pros and cons of the technique from a digital forensics perspective [ 2 ].  What is $MFT parsing?  For readers not familiar with the NTFS file system, MFT stands for Master File Table. This table is stored in a file system metadata file, meaning that as far as the file system is concerned it is a file, however that the file contains file system metadata not “regular” content. The name of this file is “$MFT”.  The MFT consists of a sequence of (predetermined) fixed-size entries (or MFT entries). These entries are typically 1024 bytes in size, however the size is defined in the NTFS volume header and in a “regular” MFT entry itself.  The first 4-bytes of a “regular” MFT-entry (or record) starts with the signature “FILE”. The MFT entry can...
Read more

Incident Response in the Cloud

By
Many organizations have begun moving a majority of their services towards the cloud in recent years. As a result, attackers have shifted their focus towards the cloud. This has resulted in new techniques and methods specifically designed to compromise cloud infrastructure, like the recent SALTSTACK vulnerability that was widely exploited [ 1 ]. Therefore it is critical for these organizations to have an incident response team that understands the new risks attached to cloud and how cloud can make incident response easier or harder.  In this blog post we will walk you through each phase you may encounter in traditional incident response and highlight the differences when adopting cloud computing. It is aimed towards both those who are new to incident response and cloud computing. We’ve included insights that will benefit organizations taking that step towards cloud who want to ensure they are prepared to respond efficiently to cloud incidents.  Traditional Incident Response Be...
Read more

Container Forensics with Docker Explorer

By Anonymous
  Introduction As previous blog posts on cloud forensics have noted, applications are increasingly being deployed using container orchestration frameworks such as Kubernetes, especially in cloud environments.  Similar to traditional deployments on physical servers or virtual machines (VMs), when a containerised application has a security issue it can lead to a compromise of the underlying compute architecture. In the case of container deployments this means a compromise of the container itself, the container host, or even a wider cluster compromise via abuse of orchestration tools. Often digital forensics is required to establish what went wrong and remediate any issues. This article will provide an introduction to container forensics with Docker Explorer by working through a scenario involving a compromised container running within a Kubernetes cluster. Although Kubernetes is briefly mentioned, this article will focus on analysis of an individual container rather than the wi...
Read more