forensicnomicon-data 1.4.0

// AUTO-GENERATED by forensicnomicon ingest pipeline.
// Source: nirsoft
// Entries: 13
// Do not edit manually — re-run `cargo run -p ingest` to regenerate.
#![allow(clippy::too_many_lines)]

use super::super::super::types::{
    ArtifactDescriptor, ArtifactLocation, DataScope, Decoder, HiveTarget, OsScope, TriagePriority,
};
pub(crate) static NIRSOFT_MUICACHE_LOCAL_SETTINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_muicache_local_settings",
    name: "MUICache — Program Execution Evidence",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::UsrClass),
    key_path: "Local Settings\\Software\\Microsoft\\Windows\\Shell\\MuiCache",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "MUICache stores program display names for executables that have run — evidence of program execution even after binary deletion. Documented by NirSoft MUICacheView.",
    mitre_techniques: &["T1059"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/muicache_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_JUMPLISTS_AUTOMATIC_DESTINATIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_jumplists_automatic_destinations",
    name: "JumpListsView — Automatic Destinations",
    artifact_type: ArtifactLocation::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Automatic Jump List files (*.automaticDestinations-ms) — records recent files opened by each application. Parsed by NirSoft JumpListsView.",
    mitre_techniques: &["T1547.009"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/jump_lists_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_OPENED_FILES_VIEW_HANDLE: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_opened_files_view_handle",
    name: "OpenedFilesView — Open File Handles",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("\\\\.\\PhysicalDrive0"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "NirSoft OpenedFilesView queries the OS for open file handles — live artifact useful during triage to identify locked files.",
    mitre_techniques: &["T1083"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/opened_files_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_APP_CRASH_DUMPS_DIR: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_app_crash_dumps_dir",
    name: "AppCrashView — Crash Dump Directory",
    artifact_type: ArtifactLocation::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%LOCALAPPDATA%\\CrashDumps"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Application crash dump files. May contain credential material or memory forensics artefacts. Listed by NirSoft AppCrashView.",
    mitre_techniques: &["T1003"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/app_crash_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_WIFI_HISTORY_PROFILES_DIR: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_wifi_history_profiles_dir",
    name: "WifiHistoryView — WLAN Profiles Directory",
    artifact_type: ArtifactLocation::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%SystemRoot%\\System32\\wlansvc\\Profiles\\Interfaces"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "WLAN XML profile files listing previously connected Wi-Fi networks (includes SSID). Parsed by NirSoft WifiHistoryView.",
    mitre_techniques: &["T1049"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/wifi_history_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_REGISTRY_CHANGES_NTUSER: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_registry_changes_ntuser",
    name: "RegistryChangesView — NTUSER.DAT",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%USERPROFILE%\\NTUSER.DAT"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "User registry hive (NTUSER.DAT) — source for RegistryChangesView to diff registry before/after malware execution.",
    mitre_techniques: &["T1112"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/registry_changes_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_USBDEVIEW_ENUM_USB: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_usbdeview_enum_usb",
    name: "USBDeview — USB Device Enumeration",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "CurrentControlSet\\Enum\\USB",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "USB device enumeration entries in HKLM\\SYSTEM. Parsed by NirSoft USBDeview to list connected USB devices.",
    mitre_techniques: &["T1052", "T1025"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/usb_devices_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_LAST_ACTIVITY_RECENT_ITEMS: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_last_activity_recent_items",
    name: "LastActivityView — Recent Items",
    artifact_type: ArtifactLocation::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%APPDATA%\\Microsoft\\Windows\\Recent\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Recent files and folders accessed by the user (LNK shortcuts). Documented by NirSoft LastActivityView.",
    mitre_techniques: &["T1547.009"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/computer_activity_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_JUMPLISTS_CUSTOM_DESTINATIONS: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_jumplists_custom_destinations",
    name: "JumpListsView — Custom Destinations",
    artifact_type: ArtifactLocation::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Custom Jump List files (*.customDestinations-ms) — pinned items and tasks defined by applications.",
    mitre_techniques: &["T1547.009"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/jump_lists_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_PROCESS_ACTIVITY_PREFETCH: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_process_activity_prefetch",
    name: "ProcessActivityView — Prefetch Files",
    artifact_type: ArtifactLocation::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%SystemRoot%\\Prefetch\\*.pf"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Windows Prefetch files used by NirSoft ProcessActivityView to reconstruct process execution history.",
    mitre_techniques: &["T1059"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/process_activity_view.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_NETWORK_CONNECT_LOG: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_network_connect_log",
    name: "NetworkConnectLog — System Log Files",
    artifact_type: ArtifactLocation::Directory,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%SystemRoot%\\System32\\LogFiles\\*"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning:
        "Network connection log files in System32\\LogFiles. Parsed by NirSoft NetworkConnectLog.",
    mitre_techniques: &["T1049"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://www.nirsoft.net/utils/network_connect_log.html"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_BROWSING_HISTORY_FIREFOX: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_browsing_history_firefox",
    name: "BrowsingHistoryView — Firefox History",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%APPDATA%\\Mozilla\\Firefox\\Profiles\\*.default-release\\places.sqlite"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Firefox browsing history (places.sqlite) as parsed by NirSoft BrowsingHistoryView.",
    mitre_techniques: &["T1217"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.nirsoft.net/utils/browsing_history_view.html",
        "https://forensicswiki.xyz/wiki/index.php?title=Browsers",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static NIRSOFT_BROWSING_HISTORY_CHROME: ArtifactDescriptor = ArtifactDescriptor {
    id: "nirsoft_browsing_history_chrome",
    name: "BrowsingHistoryView — Chrome History",
    artifact_type: ArtifactLocation::File,
    hive: None,
    key_path: "",
    value_name: None,
    file_path: Some("%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History"),
    scope: DataScope::Mixed,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Chrome browsing history SQLite DB as parsed by NirSoft BrowsingHistoryView.",
    mitre_techniques: &["T1217"],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &[
        "https://www.nirsoft.net/utils/browsing_history_view.html",
        "https://forensicswiki.xyz/wiki/index.php?title=Google_Chrome",
    ],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Generated entries (13) ─────────────────────────────────────────────────
// pub(crate) static GENERATED_NIRSOFT_ENTRIES: &[&ArtifactDescriptor] = &[
//     &NIRSOFT_MUICACHE_LOCAL_SETTINGS,
//     &NIRSOFT_JUMPLISTS_AUTOMATIC_DESTINATIONS,
//     &NIRSOFT_OPENED_FILES_VIEW_HANDLE,
//     &NIRSOFT_APP_CRASH_DUMPS_DIR,
//     &NIRSOFT_WIFI_HISTORY_PROFILES_DIR,
//     &NIRSOFT_REGISTRY_CHANGES_NTUSER,
//     &NIRSOFT_USBDEVIEW_ENUM_USB,
//     &NIRSOFT_LAST_ACTIVITY_RECENT_ITEMS,
//     &NIRSOFT_JUMPLISTS_CUSTOM_DESTINATIONS,
//     &NIRSOFT_PROCESS_ACTIVITY_PREFETCH,
//     &NIRSOFT_NETWORK_CONNECT_LOG,
//     &NIRSOFT_BROWSING_HISTORY_FIREFOX,
//     &NIRSOFT_BROWSING_HISTORY_CHROME,
// ];