An Ontology for Digital Forensics in IT Security Incidents - OPUS

60 CHAPTER 7. IMPLEMENTATION
1 SELECT DISTINCT ? name ? file
2 WHERE {
3 ? file rdf : type fs : FSFileName .
4 ? file fsfn : name ? name .
5 FILTER ( regex ( str (? name ), " FILENAME "))
6 }
Listing 7.4: Find le Query
7.6.2 Autorun
According to [Microsoft, 2010] the entries for the Run and RunOnce keys
are located in the paths shown in listing 7.5.
HKEY_LOCAL_MACHINE / Software / Microsoft / Windows / CurrentVersion / Run
HKEY_CURRENT_USER / Software / Microsoft / Windows / CurrentVersion / Run
HKEY_LOCAL_MACHINE / Software / Microsoft / Windows / CurrentVersion / RunOnce
HKEY_CURRENT_USER / Software / Microsoft / Windows / CurrentVersion / RunOnce
Listing 7.5: Autorun registry paths
A common part of these paths is Windows/CurrentVersion/Run. The
goal of the query is to retrieve the key-value pairs that are the values of
these keys. The resulting query is shown in listing 7.6. At rst, in lines
three and four a key that has the name Windows is selected and bound to
the variable ?win. Line ve binds a sub key of the one in ?win to the
variable ?cv. The lines six and seven ensure that the key in ?cv has the
name CurrentVersion. Line eight works similarly to line ve and binds the
subkeys of ?cv to ?run. Line ten lters the value of ?run to contain Run
in its name. This way Run, RunOnce and all other keys that contain run
like RunServices and RunServicesOnce are included. The lines eleven to
thirteen extract the key-value pairs to the variables ?name and ?command.
7.6.3 Parent Process
Some malware tries to hide by removing itself from the process hierarchy
that starts with one process. This can be detected by looking at the line
of ancestors of each process. If one process is its own parent or does not
originate from the most basic process, it might have tried to hide. Of course
the most basic parent process is always in the result set as it was specied to
be its own parent in section 6.5. For this query again two possibilities exist.
The rst one is shown in listing 7.7. Lines three and four bind a pro:Process
object to the variable ?child that is the process the query will examine. The
OPTIONAL keyword species that the restrictions in the following block, that
is indicated by braces, do not necessarily need to match. The * in line six