SRUM (System Resource Usage Monitor)
DFIR Artifact for checking user running process if EDR is not present
Last updated
Was this helpful?
DFIR Artifact for checking user running process if EDR is not present
Last updated
Was this helpful?
You can read about SRUM here , it will answer the question below
What application was executed?
How long the application ran for (execution time)?
WHO or what SID was it running under?
Location: C:\Windows\System32\sru\SRUDB.dat but you must have a tool or software that can parse the information that is stored in that, most people will use this tool (you have to download and move it to the machine that you want to investigate)
In the srum-dump repository on GitHub, you will also need to download the SRUM-DUMP template
And then follow the instruction that is written in the repository after that you will dump the SRUM and excel file will look like this
You will have information like which application was run by whom (User SID) and the Time Creation and EndTime. Study Case:
(the youtube talk about SRUM forensic
