Plaso 20261027 released

By

Plaso 20261027 released

The Plaso team is delighted to announce a new Plaso release, 20261027. This release has a mixture of new features and under the hood improvements.


A special shout out to @elhoim and @kev365 for all their changes to help improve Plaso. A friendly reminder if you are using a coding agent (or other type of artificial intelligence), please tune its output verbosity to a necessary minimum, have it follow project guidelines and standard practices, and double check any speculations it might make in write ups.


For people reporting code weaknesses and/or vulnerabilities, we appreciate you helping improve Plaso’s resilience, but please do not speculate about impact and make sure to back up your claims by facts. Refrain from claiming hypothetical worst-case impact, please keep it factual. Assess trade-offs, sometimes a resilience change has adverse effects from the perspective of forensics reproducibility.


The “log with a cape”' will always be a key part of log2timeline and Plaso history, but after 14 years (of Plaso) we think it is time for a new look-and-feel. If you have good suggestions for a new logo, please reach out on the Open Source DFIR slack, otherwise we’ll stick with:


Notable changes

Given the high volume of notable changes this time, we hope we comprehensively covered all of them. If you feel one is missing send one the maintainers a direct message on the slack channel.


  • Added an ESXi log parser (#5196) with thanks to @wwwesh.

  • Added a Microsoft HTTP Server API (HTTP.sys) error log parser plugin (#5304) with thanks to @MichalJankura.

  • Added support for fallback hostname and username in the JSON output formats (#5194) with thanks to @Get-Sybers. This complements the --output-fallback-hostname option introduced in 20260720 by also supporting a fallback username.

  • Added support for an IPv6 zone index suffix in the IIS log parser (#5200) with thanks to @dev-rehaann.

  • With thanks to @kev365:

    • Extended the syslog parser with support for sudo command records (#5225), cron daemon, crontab, cronie, run-parts and anacron messages (#5215, #5342) and handling of SSH connection end and invalid user messages, including recent OpenSSH log formats (#5193, #5208, #5340).

    • Improved the SELinux log file parser with support for AVC records (#5209) and improved auditd support, extracting structured execution, file and user information (#5180, #5182).

    • Added Linux tagging rules for structured SSH, audit, su, vsftpd, apt and logind events (#5224) and for the SSH connection end and invalid user events (#5343).

    • Added a script to check tagging files for labels and rules that cannot be loaded (#5301).

  • With thanks to @elhoim:

    • Enhanced the Apache access log parser (#5296).

    • Improved the sanitation of the dynamic (DSV) (#5314) and KML (#5288) output, and the escaping of values in the pinfo JSON reports (#5252) and the CLI table view (#5329).

    • The path filter no longer expands environment variables (#5320).

    • Corrections for negated matches in the event filter (#5246), and changes to the handling of abandoned tasks and worker timeouts (#5253, #5255, #5284, #5332).

    • Improved the parsing of long Office MRU value names (#5322), long URLs in the browser search analysis plugin (#5324) and long lines in the SCCM, appfirewall and Bitbucket text plugins (#5338).

    • Changes to explicitly set date and time values as UTC in the default plist plugin (#5233), and corrected the XLSX output not using the output time zone (#5276).

  • With thanks to @elhoim and @kev365

    • Improved analysis performance, including through caching of event tags (#5353), event tag lookups (#5187, #5354), event value hashes (#5357), time zones per hint in the timeliner (#5358), attribute names in the event filter (#5352), usernames in the output mediator (#5269) and labels per data stream in the hash tagging plugins (#5280), as well as fast paths in the text plugins (#5355, #5356) and the JSON serializer (#5359).

    • Improved pinfo, including the storage file comparison (#5249), the storage profiler (#5192) and corrections for the use of the analysis counter (#5219).

    • Corrections to various plugins, including the 12-hour clock conversion in the McAfee AV parser (#5259), a missing URL in the Safari cookies parser (#5258), typed and hidden integer values in the Firefox history parser (#5247), URL hidden value extraction in the Chrome history parser (#5239), the is_incoming and video status extraction in the Skype plugin (#5241), the VM identifier extraction in the UAL ESE database plugin (#5231), the use of the Task Cache task subkey (#5300) and the birth droid file identifier in the NTFS $MFT parser (#5308).

  • Many resiliency improvements including the systemd journal (#5181, #5336), SQLite (#5310), ASL (#5330), JSON (#5302) and plist (#5270) parsers, the Windows Registry key preprocessor plugins (#5305), handling of corrupted entries and partial data in the utmpx (#5236), fish history (#5261), Windows push notification (#5265), Docker container config (#5273) and uTorrent (#5237) plugins, more resilient handling of a missing TypedURLs context key (#5282), the NSKeyedArchiver plist decoder handling cyclic object references (#5326) and adding the corrupted and recovered flags to the serialized protected attributes (#5286), a follow-up to the tagging of corrupted and/or recovered events introduced in 20260720, changes to sanitize the image export paths and data stream names (#5347, #5382, #5383) and to the SQLite parser to restrict the permissions on the temporary WAL copy (#5318), with thanks to @elhoim, @kev365, @jleaniz and @onager.

  • Added the backslashreplace error handler to the text file output modules (#5206) with thanks to @J-a-s-o-n-P.

  • A series of changes to make the event data docstrings, attribute mappings and formatter configuration consistent with the actual event data attributes (#5361, #5362, #5364, #5365, #5366, #5368, #5380) with thanks to @nflexfo.

  • Numerous other improvements, including in the logging of worker processes (#5374, #5376), the OpenSearch output module (#5290), the syslog comment body parsing (#5334) and improvements to pre-epoch date time value handling in dfdatetime with thanks to @bacescuandrei.


The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone.

Proposed changes for future releases

  • Move image export to the dfImageTools project (#1)

  • Changes to redact secrets from being stored in the storage file (#5348)

  • More resilient text parsers, including resuming parsing after consecutive line failures (#5349) and not trying other plugins after a plugin failed (#5293, #5294)

  • Improved Windows Defender DetectionHistory parser with detection lifecycle timestamps and threat status (#5344, #5345)


Where/how to get Plaso 20261027?

See Plaso's Users' Guide. The development team recommends using Docker to install Plaso without hassle. 


If Docker does not fit your needs there are installation instructions available for Mac OS, Ubuntu and Fedora. 


If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.

Comments

Post a Comment

Popular posts from this blog

Parsing the $MFT NTFS metadata file

By
Background Numerous articles have been written about parsing the $MFT NTFS metadata file before. Some of these explain the technique itself [ 1 ] and others mostly focus on how to use tools. Rarely do articles mention the pros and cons of the technique from a digital forensics perspective [ 2 ].  What is $MFT parsing?  For readers not familiar with the NTFS file system, MFT stands for Master File Table. This table is stored in a file system metadata file, meaning that as far as the file system is concerned it is a file, however that the file contains file system metadata not “regular” content. The name of this file is “$MFT”.  The MFT consists of a sequence of (predetermined) fixed-size entries (or MFT entries). These entries are typically 1024 bytes in size, however the size is defined in the NTFS volume header and in a “regular” MFT entry itself.  The first 4-bytes of a “regular” MFT-entry (or record) starts with the signature “FILE”. The MFT entry can...
Read more

Incident Response in the Cloud

By
Many organizations have begun moving a majority of their services towards the cloud in recent years. As a result, attackers have shifted their focus towards the cloud. This has resulted in new techniques and methods specifically designed to compromise cloud infrastructure, like the recent SALTSTACK vulnerability that was widely exploited [ 1 ]. Therefore it is critical for these organizations to have an incident response team that understands the new risks attached to cloud and how cloud can make incident response easier or harder.  In this blog post we will walk you through each phase you may encounter in traditional incident response and highlight the differences when adopting cloud computing. It is aimed towards both those who are new to incident response and cloud computing. We’ve included insights that will benefit organizations taking that step towards cloud who want to ensure they are prepared to respond efficiently to cloud incidents.  Traditional Incident Response Be...
Read more

Container Forensics with Docker Explorer

By Anonymous
  Introduction As previous blog posts on cloud forensics have noted, applications are increasingly being deployed using container orchestration frameworks such as Kubernetes, especially in cloud environments.  Similar to traditional deployments on physical servers or virtual machines (VMs), when a containerised application has a security issue it can lead to a compromise of the underlying compute architecture. In the case of container deployments this means a compromise of the container itself, the container host, or even a wider cluster compromise via abuse of orchestration tools. Often digital forensics is required to establish what went wrong and remediate any issues. This article will provide an introduction to container forensics with Docker Explorer by working through a scenario involving a compromised container running within a Kubernetes cluster. Although Kubernetes is briefly mentioned, this article will focus on analysis of an individual container rather than the wi...
Read more