BAM, DAM, and SRUM

# Extract BAM entries from live system or offline SYSTEM hive
# For offline hive, load it first or use RECmd with a batch file

$bamBase = "HKLM:\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings"

Get-ChildItem $bamBase | ForEach-Object {
    $sid = $_.PSChildName
    # Resolve SID to username
    try {
        $username = ([System.Security.Principal.SecurityIdentifier]$sid).Translate([System.Security.Principal.NTAccount]).Value
    } catch {
        $username = $sid
    }

    # Each value is a file path with binary timestamp data
    $_.GetValueNames() | Where-Object { $_ -match "\\" } | ForEach-Object {
        $exePath = $_
        $rawBytes = $_.PSProvider.GetValue($null, $exePath, $null)

        # First 8 bytes are FILETIME — convert to datetime
        if ($rawBytes -and $rawBytes.Length -ge 8) {
            $fileTime = [BitConverter]::ToInt64($rawBytes[0..7], 0)
            $dt = [DateTime]::FromFileTimeUtc($fileTime)

            [PSCustomObject]@{
                User      = $username
                SID       = $sid
                ExePath   = $exePath
                LastRun   = $dt
            }
        }
    }
} | Sort-Object LastRun -Descending | Format-Table -AutoSize

:: Parse SRUM database with SrumECmd (Eric Zimmermann)

:: SRUM must be copied while live or shadow-copied — it's locked during use
:: KAPE automatically handles the locked file via VSS or raw copy

SrumECmd.exe ^
  -f "D:\evidence\C\Windows\System32\SRU\SRUDB.dat" ^
  --csv "D:\analysis\srum" ^
  -r "D:\evidence\C\Windows\System32\config\SOFTWARE"

:: -r: path to SOFTWARE registry hive (needed to resolve app names/SIDs)
:: Output CSVs:
::   srum_NetworkConnections.csv  — hourly network usage per app
::   srum_NetworkUsages.csv
::   srum_AppResourceUseInfo.csv  — CPU/memory usage per app

# Hunt for data exfiltration evidence in SRUM network data
$srum = Import-Csv "D:\analysis\srum\srum_NetworkConnections.csv"

# Find applications with abnormally high outbound data
$srum | Where-Object {
    [int64]$_.BytesSent -gt 100MB  # > 100 MB in a single hour period
} | Select-Object TimeStamp, ExeInfo, UserId, BytesSent, BytesRecvd |
  Sort-Object BytesSent -Descending |
  Format-Table -AutoSize

# Look for known attacker tool paths in SRUM
$srum | Where-Object {
    $_.ExeInfo -match "\\Temp\\" -or
    $_.ExeInfo -match "\\AppData\\Roaming\\" -or
    $_.ExeInfo -match "\\Users\\Public\\"
} | Select-Object TimeStamp, ExeInfo, BytesSent, BytesRecvd |
  Sort-Object TimeStamp |
  Format-Table -AutoSize

# Cross-reference: executables with large BytesSent that no longer exist
$srum | Where-Object { [int64]$_.BytesSent -gt 10MB } |
  ForEach-Object {
    $path = $_.ExeInfo
    if ($path -match "^[A-Z]:\\" -and !(Test-Path $path)) {
        $_ | Select-Object TimeStamp, ExeInfo, BytesSent
    }
  } | Format-Table -AutoSize