Skip to content

Added Apple_IntelligencePlatform_Wifi rule #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
scudette merged 1 commit into from
Nov 3, 2025
Merged

Added Apple_IntelligencePlatform_Wifi rule #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions definitions/Apple_IntelligencePlatform_Wifi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
Name: IntelligencePlatform
Author: Yogesh Khatri - @swiftForensics, CyberCX
Description: |
Parses the views.db database, part of Apple Intelligence which
provides detailed connect/disconnect events on recent wifi
connections.

Globs:
- "/Users/*/Library/IntelligencePlatform/Artifacts/internal/views.db"

Categories:
- MacOS

FilenameRegex: "views.db"

SQLiteIdentifyQuery: |
SELECT count(*) AS `Check`
FROM sqlite_master
WHERE type='table' AND name='wifiContextEvents';
SQLiteIdentifyValue: 1

Sources:
- name: Wifi
SQL: |
SELECT behaviorType, behaviorIdentifier, timestamp
FROM wifiContextEvents ORDER BY timestamp
VQL: |
SELECT timestamp(cocoatime=timestamp) AS Timestamp,
behaviorType,
split(string=behaviorIdentifier, sep=':')[0] AS event,
split(string=behaviorIdentifier, sep=':')[1] AS network,
OSPath[1] AS User
FROM Rows
16 changes: 15 additions & 1 deletion docs/content/docs/rules/index.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,18 @@
[
{
"Name": "IntelligencePlatform",
"Author": "Yogesh Khatri - @swiftForensics, CyberCX",
"Description": "Parses the views.db database, part of Apple Intelligence which\nprovides detailed connect/disconnect events on recent wifi\nconnections.\n",
"Categories": [
"MacOS"
],
"Sources": [
{
"Name": "Wifi"
}
],
"RawData": "Name: IntelligencePlatform\nAuthor: Yogesh Khatri - @swiftForensics, CyberCX\nDescription: |\n Parses the views.db database, part of Apple Intelligence which\n provides detailed connect/disconnect events on recent wifi\n connections.\n\nGlobs:\n - \"/Users/*/Library/IntelligencePlatform/Artifacts/internal/views.db\"\n\nCategories:\n - MacOS\n\nFilenameRegex: \"views.db\"\n\nSQLiteIdentifyQuery: |\n SELECT count(*) AS `Check`\n FROM sqlite_master\n WHERE type='table' AND name='wifiContextEvents';\nSQLiteIdentifyValue: 1\n\nSources:\n - name: Wifi\n SQL: |\n SELECT behaviorType, behaviorIdentifier, timestamp\n FROM wifiContextEvents ORDER BY timestamp\n VQL: |\n SELECT timestamp(cocoatime=timestamp) AS Timestamp,\n behaviorType,\n split(string=behaviorIdentifier, sep=':')[0] AS event,\n split(string=behaviorIdentifier, sep=':')[1] AS network,\n OSPath[1] AS User\n FROM Rows\n"
},
{
"Name": "iMessage",
"Author": "x64-julian",
Expand Down Expand Up @@ -536,6 +550,6 @@
"Name": "UserActivityLogging"
}
],
"RawData": "Name: Windows Search Service\n\nDescription: |\n Analysis of the Windows search index database. See\n https://www.aon.com/cyber-solutions/aon_cyber_labs/windows-search-index-the-forensic-artifact-youve-been-searching-for/\n\nCategories:\n - Windows\n\nFilenameRegex: \"Windows.edb\"\nGlobs:\n - C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb\n\nSources:\n- name: SystemIndex_Gthr\n Preamble: |\n LET MatchingFiles = SELECT OSPath FROM Rows\n\n LET FormatTimeB(T) = timestamp(winfiletime=parse_binary(\n filename=T, accessor=\"data\", struct=\"uint64b\"))\n\n LET FormatTime(T) = timestamp(winfiletime=parse_binary(\n filename=T, accessor=\"data\", struct=\"uint64\"))\n\n LET FormatSize(T) = parse_binary(\n filename=T, accessor=\"data\", struct=\"uint64\")\n\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT ScopeID, DocumentID, SDID,\n FormatTimeB(T=LastModified) AS LastModified,\n FileName\n FROM parse_ese(file=OSPath, table= \"SystemIndex_Gthr\")\n })\n WHERE LastModified \u003e DateAfter AND LastModified \u003c DateBefore\n AND FileName =~ FilterRegex\n\n- name: SystemIndex_GthrPth\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT Scope, Parent, Name\n FROM parse_ese(file=OSPath, table= \"SystemIndex_GthrPth\")\n })\n WHERE Name =~ FilterRegex\n\n- name: SystemIndex_PropertyStore\n Preamble: |\n LET X = scope()\n\n -- The PropertyStore columns look like\n -- \u003crandom\u003e-ProperName so we strip the\n -- random part off to display it properly.\n LET FilterDict(Dict) = to_dict(item={\n SELECT split(sep_string=\"-\", string=_key)[1] || _key AS _key, _value\n FROM items(item=Dict)\n })\n\n LET PropStore(OSPath) = SELECT *,\n FormatTime(T=X.System_Search_GatherTime) AS System_Search_GatherTime,\n FormatSize(T=X.System_Size) AS System_Size,\n FormatTime(T=X.System_DateModified) AS System_DateModified,\n FormatTime(T=X.System_DateAccessed) AS System_DateAccessed,\n FormatTime(T=X.System_DateCreated) AS System_DateCreated\n FROM foreach(row={\n SELECT *, FilterDict(Dict=_value) AS _value\n FROM items(item={\n SELECT * FROM parse_ese(file=OSPath, table=\"SystemIndex_PropertyStore\")\n })\n }, column=\"_value\")\n\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT *\n FROM PropStore(OSPath=OSPath)\n })\n WHERE System_DateAccessed \u003e DateAfter AND System_DateAccessed \u003c DateBefore\n\n- name: SystemIndex_PropertyStore_Highlights\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT WorkID,\n System_Search_GatherTime,\n System_Size,\n System_DateModified,\n System_DateCreated,\n X.System_FileOwner AS System_FileOwner,\n X.System_ItemPathDisplay AS System_ItemPathDisplay,\n X.System_ItemType AS System_ItemType,\n X.System_FileAttributes AS System_FileAttributes,\n X.System_Search_AutoSummary AS System_Search_AutoSummary\n FROM PropStore(OSPath=OSPath)\n })\n WHERE System_DateAccessed \u003e DateAfter AND System_DateAccessed \u003c DateBefore\n\n- name: BrowsingActivity\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT X.ItemPathDisplay AS ItemPathDisplay,\n X.Activity_ContentUri AS Activity_ContentUri,\n X.Activity_Description AS Activity_Description\n FROM PropStore(OSPath=OSPath)\n WHERE Activity_ContentUri\n })\n\n- name: UserActivityLogging\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT X.System_ItemPathDisplay AS System_ItemPathDisplay,\n FormatTime(T=X.ActivityHistory_StartTime) AS ActivityHistory_StartTime,\n FormatTime(T=X.ActivityHistory_EndTime) AS ActivityHistory_EndTime,\n X.ActivityHistory_AppId AS ActivityHistory_AppId\n FROM PropStore(OSPath=OSPath)\n WHERE ActivityHistory_AppId\n })\n WHERE ActivityHistory_StartTime \u003e DateAfter\n AND ActivityHistory_StartTime \u003c DateBefore\n"
"RawData": "Name: Windows Search Service\n\nDescription: |\n Analysis of the Windows search index database. See\n https://www.aon.com/cyber-solutions/aon_cyber_labs/windows-search-index-the-forensic-artifact-youve-been-searching-for/\n\nCategories:\n - Windows\n\nFilenameRegex: \"Windows..db\"\nGlobs:\n - \"C:\\\\ProgramData\\\\Microsoft\\\\Search\\\\Data\\\\Applications\\\\Windows\\\\Windows.*db\"\n\nSources:\n- name: SystemIndex_Gthr\n Preamble: |\n LET MatchingFiles = SELECT OSPath FROM Rows\n\n LET FormatTimeB(T) = timestamp(winfiletime=parse_binary(\n filename=T, accessor=\"data\", struct=\"uint64b\"))\n\n LET FormatTime(T) = timestamp(winfiletime=parse_binary(\n filename=T, accessor=\"data\", struct=\"uint64\"))\n\n LET FormatSize(T) = parse_binary(\n filename=T, accessor=\"data\", struct=\"uint64\")\n\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT ScopeID, DocumentID, SDID,\n FormatTimeB(T=LastModified) AS LastModified,\n FileName\n FROM parse_ese(file=OSPath, table= \"SystemIndex_Gthr\")\n })\n WHERE LastModified \u003e DateAfter AND LastModified \u003c DateBefore\n AND FileName =~ FilterRegex\n\n- name: SystemIndex_GthrPth\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT Scope, Parent, Name\n FROM parse_ese(file=OSPath, table= \"SystemIndex_GthrPth\")\n })\n WHERE Name =~ FilterRegex\n\n- name: SystemIndex_PropertyStore\n Preamble: |\n LET X = scope()\n\n -- The PropertyStore columns look like\n -- \u003crandom\u003e-ProperName so we strip the\n -- random part off to display it properly.\n LET FilterDict(Dict) = to_dict(item={\n SELECT split(sep_string=\"-\", string=_key)[1] || _key AS _key, _value\n FROM items(item=Dict)\n })\n\n LET PropStore(OSPath) = SELECT *,\n FormatTime(T=X.System_Search_GatherTime) AS System_Search_GatherTime,\n FormatSize(T=X.System_Size) AS System_Size,\n FormatTime(T=X.System_DateModified) AS System_DateModified,\n FormatTime(T=X.System_DateAccessed) AS System_DateAccessed,\n FormatTime(T=X.System_DateCreated) AS System_DateCreated\n FROM foreach(row={\n SELECT *, FilterDict(Dict=_value) AS _value\n FROM items(item={\n SELECT * FROM parse_ese(file=OSPath, table=\"SystemIndex_PropertyStore\")\n })\n }, column=\"_value\")\n\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT *\n FROM PropStore(OSPath=OSPath)\n })\n WHERE System_DateAccessed \u003e DateAfter AND System_DateAccessed \u003c DateBefore\n\n- name: SystemIndex_PropertyStore_Highlights\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT WorkID,\n System_Search_GatherTime,\n System_Size,\n System_DateModified,\n System_DateCreated,\n X.System_FileOwner AS System_FileOwner,\n X.System_ItemPathDisplay AS System_ItemPathDisplay,\n X.System_ItemType AS System_ItemType,\n X.System_FileAttributes AS System_FileAttributes,\n X.System_Search_AutoSummary AS System_Search_AutoSummary\n FROM PropStore(OSPath=OSPath)\n })\n WHERE System_DateAccessed \u003e DateAfter AND System_DateAccessed \u003c DateBefore\n\n- name: BrowsingActivity\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT X.ItemPathDisplay AS ItemPathDisplay,\n X.Activity_ContentUri AS Activity_ContentUri,\n X.Activity_Description AS Activity_Description\n FROM PropStore(OSPath=OSPath)\n WHERE Activity_ContentUri\n })\n\n- name: UserActivityLogging\n VQL: |\n SELECT * FROM foreach(row=MatchingFiles, query={\n SELECT X.System_ItemPathDisplay AS System_ItemPathDisplay,\n FormatTime(T=X.ActivityHistory_StartTime) AS ActivityHistory_StartTime,\n FormatTime(T=X.ActivityHistory_EndTime) AS ActivityHistory_EndTime,\n X.ActivityHistory_AppId AS ActivityHistory_AppId\n FROM PropStore(OSPath=OSPath)\n WHERE ActivityHistory_AppId\n })\n WHERE ActivityHistory_StartTime \u003e DateAfter\n AND ActivityHistory_StartTime \u003c DateBefore\n"
}
]
Loading