CyLR - Live Response Collection Tool

CyLR — Live Response Collection tool by Alan Orlikoski and Jason Yegge

Table of Contents

The CyLR tool collects forensic artifacts from hosts with NTFS file systems quickly, securely and minimizes impact to the host.

The main features are:

  • Quick collection (it's really fast)
  • Raw file collection process does not use Windows API
  • Optimized to store the collected artifacts in memory (minimizing or removing entirely the need to write additional artifacts on the host disk)
  • Built in SFTP capability

CyLR uses .NET Core and runs natively on Windows, Linux, and MacOS. Self contained applications for the following are included in releases for version 2.0 and higher.

  • Windows x86
  • Windows x64
  • Linux x64
  • MacOS x64

Description

CyLR tool collects forensic artifacts from hosts with NTFS file systems quickly, securely and minimizes impact to the host.

The standard list of collected artifacts are:

Windows Default

  • System Level Artifacts
    • %SYSTEMROOT%\SchedLgU.Txt
    • %SYSTEMROOT%\Tasks
    • %SYSTEMROOT%\Prefetch
    • %SYSTEMROOT%\inf\setupapi.dev.log
    • %SYSTEMROOT%\Appcompat\Programs
    • %SYSTEMROOT%\System32\drivers\etc\hosts
    • %SYSTEMROOT%\System32\sru
    • %SYSTEMROOT%\System32\winevt\logs
    • %SYSTEMROOT%\System32\Tasks
    • %SYSTEMROOT%\System32\LogFiles\W3SVC1
    • %SYSTEMROOT%\System32\config\SAM
    • %SYSTEMROOT%\System32\config\SYSTEM
    • %SYSTEMROOT%\System32\config\SOFTWARE
    • %SYSTEMROOT%\System32\config\SECURITY
    • %SYSTEMROOT%\System32\config\SAM.LOG1
    • %SYSTEMROOT%\System32\config\SYSTEM.LOG1
    • %SYSTEMROOT%\System32\config\SOFTWARE.LOG1
    • %SYSTEMROOT%\System32\config\SECURITY.LOG1
    • %SYSTEMROOT%\System32\config\SAM.LOG2
    • %SYSTEMROOT%\System32\config\SYSTEM.LOG2
    • %SYSTEMROOT%\System32\config\SOFTWARE.LOG2
    • %SYSTEMROOT%\System32\config\SECURITY.LOG2
    • %PROGRAMDATA%\Microsoft\Search\Data\Applications\Windows
    • %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup
    • %SystemDrive%$Recycle.Bin
    • %SystemDrive%$LogFile
    • %SystemDrive%$MFT
  • Artifacts For All Users
    • {user.ProfilePath}\NTUSER.DAT
    • {user.ProfilePath}\AppData\Local\Microsoft\Windows\UsrClass.dat
    • {user.ProfilePath}\AppData\Roaming\Microsoft\Windows\Recent
    • {user.ProfilePath}\NTUSER.DAT
    • {user.ProfilePath}\NTUSER.DAT.LOG1
    • {user.ProfilePath}\NTUSER.DAT.LOG2
    • {user.ProfilePath}\AppData\Local\Microsoft\Windows\UsrClass.dat
    • {user.ProfilePath}\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
    • {user.ProfilePath}\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
    • {user.ProfilePath}\AppData\Local\Microsoft\Windows\Explorer
    • {user.ProfilePath}\AppData\Local\Google\Chrome\User Data\Default\History\
    • {user.ProfilePath}\AppData\Local\Microsoft\Windows\WebCache\
    • {user.ProfilePath}\AppData\Local\ConnectedDevicesPlatform
    • {user.ProfilePath}\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\
    • {user.ProfilePath}\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline
    • {user.ProfilePath}\AppData\Roaming\Mozilla\Firefox\Profiles\

Mac and Linux Default

  • "/var/log",
  • "/private/var/log/",
  • "/.fseventsd",
  • "/etc/hosts.allow",
  • "/etc/hosts.deny",
  • "/etc/hosts",
  • "/System/Library/StartupItems",
  • "/System/Library/LaunchAgents",
  • "/System/Library/LaunchDaemons",
  • "/Library/LaunchAgents",
  • "/Library/LaunchDaemons",
  • "/Library/StartupItems",
  • "/etc/passwd",
  • "/etc/group"
  • All plist files
  • All .bash_history files
  • All .sh_history files
  • Chrome Preference files
  • FireFox Preference Files

Examples

Standard collection CyLR.exe

Linux/macOS collection ./CyLR

Collect artifacts and store data in "C:\Temp\LRData" CyLR.exe -o "C:\Temp\LRData"

Collect artifacts and store data in ".\LRData" CyLR.exe -o LRData

Collect artifacts and send data to SFTP server 8.8.8.8 CyLR.exe -u username -p password -s 8.8.8.8

Collect artifacts, send data to SFTP server 8.8.8.8, and keep all artifacts in memory CyLR.exe -u username -p password -s 8.8.8.8 -m

Download

https://github.com/orlikoski/CyLR