SrumECmd

How to use SrumECmd to parse the Windows SRUM database in order to provide evidence of program execution and network connections during incident investigations.

SrumECmd is a command line tool developed by Eric Zimmerman, to process the SRUM Database on Windows operating systems, identifying items such as:

Executable filepaths
Timestamps of execution times
Byte read/write processed by an application
Power Consumption details
Network Connection details
Details of push notifications

Further Information the SRUM can be found on Darkcybe - Evidence of Execution

Tool Name

Version

MITRE ATT&CK Tactic

MITRE ATT&CK Technique

SrumECmd

V0.5.1.0

Execution

Instructions

Parsing a Live or Copied SRUM.dat Database

The default location for the SRUM database is C:\Windows\System32\SRU\. The database can be interrogated on a live system or against a collected copy of the SRUM database.

SrumECmd.exe -f C:\Windows\System32\sru\SRUDB.dat --csv /path/to/output

Output

SrumECmd will produce a number of .csv files on completion of the tools execution with differing objects of interest in each. Examples of the output of the tool for a number of the objects can be seen below.

App Resource Usage