Skip to content

Added ConsentStore Artifacts#104

Merged
AndrewRathbun merged 1 commit intoEricZimmerman:masterfrom
reece394:dfirbatch
Sep 1, 2025
Merged

Added ConsentStore Artifacts#104
AndrewRathbun merged 1 commit intoEricZimmerman:masterfrom
reece394:dfirbatch

Conversation

@reece394
Copy link
Copy Markdown
Contributor

@reece394 reece394 commented Sep 1, 2025

Description

This adds ConsentStore artifacts for both NTUser as well as HKLM/Software. This displays permissions set for applications to access such as webcam, microphone and geolocation as well as the length of time applications utilised the permissions for. This will be useful as evidence of application usage.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

  • I have generated a unique GUID for my Batch file(s)
  • I have tested and validated the new Batch file(s) against test data and achieved the desired output
  • I have placed the Batch file(s) within the .\RECmd\BatchExamples directory
  • I have set or updated the version of my Batch file(s)
  • I have made an attempt to document the artifacts within the Batch file(s)
  • I have consulted the Guide/Template to ensure my Map(s) follow the same format

Thank you for your submission and for contributing to the DFIR community!

@AndrewRathbun
Copy link
Copy Markdown
Collaborator

Fantastic work, as always!

@AndrewRathbun AndrewRathbun merged commit 0603f17 into EricZimmerman:master Sep 1, 2025
1 check passed
@reece394 reece394 deleted the dfirbatch branch September 2, 2025 08:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants