# Artifact definitions.
---
name: LinuxHostnameFile
doc: Linux hostname file.
sources:
- type: FILE
  attributes: {paths: ['/etc/hostname']}
labels: [Configuration Files, System]
supported_os: [Linux]
---
name: LinuxLocalTime
doc: Local time zone configuration.
sources:
- type: FILE
  attributes: {paths: ['/etc/localtime']}
labels: [System]
supported_os: [Linux]
---
name: LinuxPasswdFile
doc: |
  Linux passwd file.

  A passwd file consist of colon separated values in the format:
  username:password:uid:gid:full name:home directory:shell
sources:
- type: FILE
  attributes: {paths: ['/etc/passwd']}
labels: [Configuration Files, System]
supported_os: [Linux]
---
name: LinuxDistributionRelease
doc: Linux distribution release information of non-LSB compliant systems.
sources:
- type: FILE
  attributes:
    paths:
    - '/etc/enterprise-release'
    - '/etc/oracle-release'
    - '/etc/redhat-release'
    - '/etc/system-release'
provides: [os_release, os_major_version, os_minor_version]
labels: [Software]
supported_os: [Linux]
---
name: LinuxIssueFile
doc: Linux prelogin message and identification (issue) file.
sources:
- type: FILE
  attributes:
    paths:
    - '/etc/issue'
    - '/etc/issue.net'
labels: [Configuration Files, System]
supported_os: [Linux]
urls: ['https://linux.die.net/man/5/issue']
---
name: LinuxLSBRelease
doc: Linux Standard Base (LSB) release information
sources:
- type: FILE
  attributes: {paths: ['/etc/lsb-release']}
provides: [os_release, os_major_version, os_minor_version]
labels: [Software]
supported_os: [Linux]
urls: ['https://linux.die.net/man/1/lsb_release']
---
name: LinuxSystemdOSRelease
doc: Linux systemd /etc/os-release file
sources:
- type: FILE
  attributes:
    paths:
    - '/etc/os-release'
    - '/usr/lib/os-release'
provides: [os_release, os_major_version, os_minor_version]
labels: [Software]
supported_os: [Linux]
urls: ['https://www.freedesktop.org/software/systemd/man/os-release.html']
---
name: MacOSKeyboardLayoutPlistFile
doc: Keyboard layout plist file
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/com.apple.HIToolbox.plist']}
labels: [System]
supported_os: [Darwin]
---
name: MacOSLocalTime
doc: Current Time Zone
sources:
- type: FILE
  attributes:
    paths:
    - '/etc/localtime'
    - '/private/etc/localtime'
labels: [System]
supported_os: [Darwin]
urls:
- 'https://forensics.wiki/mac_os_x'
- 'https://forensics.wiki/mac_os_x_10.9_-_artifacts_location#system_info_misc.'
---
name: MacOSSystemConfigurationPreferencesPlistFile
doc: System configuration preferences plist file
sources:
- type: FILE
  attributes: {paths: ['/Library/Preferences/SystemConfiguration/preferences.plist']}
labels: [System]
supported_os: [Darwin]
---
name: MacOSSystemVersionPlistFile
doc: Operating system name and version plist file
sources:
- type: FILE
  attributes: {paths: ['/System/Library/CoreServices/SystemVersion.plist']}
labels: [System]
supported_os: [Darwin]
urls:
- 'https://forensics.wiki/mac_os_x'
- 'https://forensics.wiki/mac_os_x_10.9_-_artifacts_location#system_settings_and_informations'
---
name: MacOSUserPasswordHashesPlistFiles
doc: User password hashes plist files
sources:
- type: FILE
  attributes:
    paths:
    - '/var/db/dslocal/nodes/Default/users/*.plist'
    - '/private/var/db/dslocal/nodes/Default/users/*.plist'
labels: [System, Users, Authentication]
supported_os: [Darwin]
urls:
- 'https://forensics.wiki/mac_os_x'
- 'https://forensics.wiki/mac_os_x_10.9_-_artifacts_location#system_settings_and_informations'
---
name: WindowsAvailableTimeZones
doc: Timezones available on a Windows system.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\*']}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/Time%20zone%20keys.asciidoc']
---
name: WindowsCodePage
doc: The system code page.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodePage', value: 'ACP'}
provides: [code_page]
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Codepage.html']
---
name: WindowsComputerName
doc: The name of the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: '%%current_control_set%%\Control\ComputerName\ComputerName', value: 'ComputerName'}
provides: [hostname]
supported_os: [Windows]
---
name: WindowsCurrentVersion
doc: The Windows current version
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'CurrentVersion'}]}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/System%20keys.asciidoc']
---
name: WindowsEnvironmentVariableAllUsersProfile
doc: |
  The %AllUsersProfile% environment variable

  May or may not depend on registry keys - see urls
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'AllUsersProfile'}
provides: [environ_allusersprofile]
supported_os: [Windows]
urls:
- 'https://www.microsoft.com/en-us/wdsi/help/folder-variables'
- 'https://github.com/mirror/reactos/blob/c6d2b35ffc91e09f50dfb214ea58237509329d6b/reactos/boot/bootdata/livecd.inf'
- 'http://support.microsoft.com/kb//214653'
---
name: WindowsEnvironmentVariableProgramData
doc: The %ProgramData% environment variable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'ProgramData'}
provides: [environ_allusersappdata]
supported_os: [Windows]
urls: ['http://environmentvariables.org/ProgramData']
---
name: WindowsEnvironmentVariableProgramFiles
doc: The %ProgramFiles% environment variable.
sources:
- type: PATH
  attributes:
    paths: ['\Program Files']
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion', value: 'ProgramFilesDir'}
provides: [environ_programfiles]
supported_os: [Windows]
urls: ['http://environmentvariables.org/ProgramFiles']
---
name: WindowsEnvironmentVariableProgramFilesX86
doc: The %ProgramFiles(x86)% environment variable.
sources:
- type: PATH
  attributes:
    paths: ['\Program Files (x86)']
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion', value: 'ProgramFilesDir (x86)'}
provides: [environ_programfilesx86]
supported_os: [Windows]
urls: ['http://environmentvariables.org/ProgramFiles']
---
name: WindowsEnvironmentVariableSystemRoot
doc: The system root directory path, defined by %SystemRoot%, typically "C:\Windows".
sources:
- type: PATH
  attributes:
    paths:
    - '\Windows'
    - '\WinNT'
    - '\WINNT35'
    - '\WTSRV'
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'SystemRoot'}
provides: [environ_systemroot]
supported_os: [Windows]
urls: ['http://environmentvariables.org/SystemRoot']
---
name: WindowsEnvironmentVariableWinDir
doc: The %WinDir% environment variable.
sources:
- type: PATH
  attributes:
    paths:
    - '\Windows'
    - '\WinNT'
    - '\WINNT35'
    - '\WTSRV'
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: '%%current_control_set%%\Control\Session Manager\Environment', value: 'windir'}
provides: [environ_windir]
supported_os: [Windows]
urls: ['http://environmentvariables.org/WinDir']
---
name: WindowsEventLogPublishers
doc: Windows EventLog publishers (or providers) Registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\*']
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/EventLog-keys.html']
---
name: WindowsEventLogSources
doc: Windows EventLog sources Registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\*\*']
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/EventLog-keys.html']
---
name: WindowsProductName
doc: The Windows product name
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'ProductName'}]}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/System%20keys.asciidoc']
---
name: WindowsLanguage
doc: The system language.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language', value: 'Default'}
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Language.html']
---
name: WindowsMountedDevices
doc: Windows mounted devices
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_LOCAL_MACHINE\System\MountedDevices']}
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Mounted-devices.html']
---
name: WindowsRegistryProfiles
doc: |
  Get SIDs for all users on the system with profiles present in the Registry.

  This looks in the Windows Registry where the profiles are stored and retrieves
  the paths for each profile.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\*', value: 'ProfileImagePath'}]}
labels: [Users]
provides: [users.sid, users.userprofile, users.homedir, users.username]
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/windows/desktop/bb776892(v=vs.85).aspx']
---
name: WindowsServices
doc: Windows services and drivers configuration.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\*'
labels: [Software]
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html']
---
name: WindowsTimezone
doc: The time zone of the system as a Windows time zone name or in MUI form.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation', value: 'StandardName'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation', value: 'TimeZoneKeyName'}
provides: [time_zone]
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Time-zones.html']