prefetch2es
Fast import of Windows Prefetch(.pf) into Elasticsearch.
prefetch2es uses C library libscca.
Usage
When using from the commandline interface:
$ prefetch2es /path/to/your/file.pf
When using from the python-script:
from prefetch2es.prefetch2es import prefetch2es
if __name__ == '__main__':
filepath = '/path/to/your/file.pf'
prefetch2es(filepath)
Arguments
prefetch2es supports importing from multiple files.
$ prefetch2es file1.pf file2.pf file3.pf
Also, possible to import recursively from a specific directory.
$ tree .
pffiles/
├── file1.pf
├── file2.pf
├── file3.pf
└── subdirectory/
├── file4.pf
└── subsubdirectory/
├── file5.pf
└── file6.pf
$ prefetch2es /pffiles/ # The Path is recursively expanded to file1~6.pf.
Options
--host:
ElasticSearch host address
(default: localhost)
--port:
ElasticSearch port number
(default: 9200)
--index:
Index name
(default: prefetch2es)
--scheme:
Scheme to use (http, or https)
(default: http)
--pipeline
Elasticsearch Ingest Pipeline to use
(default: )
--login:
The login to use if Elastic Security is enable
(default: )
--pwd:
The password linked to the login provided
(default: )
Examples
When using from the commandline interface:
$ prefetch2es /path/to/your/file.pf --host=localhost --port=9200 --index=foobar
When using from the python-script:
if __name__ == '__main__':
prefetch2es('/path/to/your/file.pf', host=localhost, port=9200, index='foobar')
With the Amazon Elasticsearch Serivce (ES):
$ prefetch2es /path/to/your/file.pf --host=example.us-east-1.es.amazonaws.com --port=443 --scheme=https --index=foobar
With credentials for Elastic Security:
$ prefetch2es /path/to/your/file.pf --host=localhost --port=9200 --index=foobar --login=elastic --pwd=******
Note: The current version does not verify the certificate.
Supported Prefetch versions
- Windows XP
- Windows 2003
- Windows Vista (SP0)
- Windows 7 (SP0)
- Windows 8.1
- Windows 10 1809
- Windows 10 1903
For more information, please visit libscca.
Appendix
prefetch2json
Extra feature.
Convert from Windows Prefetch to json file.
$ prefetch2json /path/to/your/file.pf /path/to/output/target.json
Convert from Windows Prefetch to Python dict object.
from prefetch2es import prefetch2json
if __name__ == '__main__':
filepath = '/path/to/your/file.pf'
result: dict = prefetch2json(filepath)
Output Format Example
Using the sample prefetch file of EricZimmerman/Prefetch as an example.
{
"name": "CALC.EXE",
"filenames": [
"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\NTDLL.DLL",
...
],
"exec_count": 2,
"last_exec_time": 130974496211967500,
"format_version": 23,
"prefetch_hash": 2013131135,
"metrics": [
{
"filename": "\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\NTDLL.DLL",
"file_reference": 281474976736310
},
...
],
"volumes": [
{
"path": "\\DEVICE\\HARDDISKVOLUME2",
"creation_time": 130974525181093750,
"serial_number": 2281737263
}
]
}
Installation
via PyPI
$ pip install prefetch2es
via DockerHub
$ docker pull sumeshi/prefetch2es:latest
Run with Docker
https://hub.docker.com/r/sumeshi/prefetch2es
prefetch2es
# "host.docker.internal" is only available in mac and windows environments.
# For linux, use the --add-host option.
$ docker run -t --rm -v $(pwd):/app/work sumeshi/prefetch2es:latest prefetch2es /app/work/SAMPLE.pf --host=host.docker.internal
prefetch2json
$ docker run -t --rm -v $(pwd):/app/work sumeshi/prefetch2es:latest prefetch2es /app/work/SAMPLE.pf /app/work/out.json
Do not use the "latest" image if at all possible.
The "latest" image is not a released version, but is built from the contents of the master branch.
Contributing
The source code for prefetch2es is hosted at GitHub, and you may download, fork, and review it from this repository(https://github.com/sumeshi/prefetch2es). Please report issues and feature requests.
License
prefetch2es is released under the MIT License.
Powered by libscca.
25 Oct 31, 2022
1 Oct 27, 2021
7 Sep 17, 2022
1.1k Jan 2, 2023
37 Sep 25, 2022
3 Jun 3, 2021
28 Dec 23, 2022
23 Jan 21, 2022
1 Jan 9, 2022
1 Jan 19, 2022
4 Mar 7, 2022
1 Feb 14, 2022
3 Mar 22, 2022
2 Jul 28, 2022
38 Nov 7, 2022
2 Nov 22, 2022
3 Sep 18, 2022
2 Jan 2, 2022
1 Jan 26, 2022
463 Dec 30, 2022
5 Dec 8, 2021
130 Dec 20, 2022
2 Jan 25, 2022
0 Oct 6, 2022
1 Dec 23, 2021
3 Apr 1, 2022
52 Jun 10, 2022