Environment Variables

Overview

Evidence: Environment Variables Description: Collect Environment Variables Category: System Platform: Windows Short Name: environm Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Windows environment variables provide system configuration information, including paths, settings, and system parameters. This data is essential for understanding system configuration and detecting configuration-based attacks.

Data Collected

This collector gathers structured data about environment variables.

Environment Variables Data

Field	Description	Example
ID	Primary key (auto-increment)	1
Name	Variable name	PATH
Value	Variable value	C:\Windows\System32;C:\Windows
Scope	Variable scope	System
Source	Source registry key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

Collection Method

This collector parses the necessary data from the environment_variables table.

Usage

This evidence is crucial for forensic investigations as it provides system configuration information. It helps investigators understand system settings, detect configuration changes, and investigate configuration-based attacks. The data can reveal system paths, configuration settings, and potential security vulnerabilities. Analysts can use this information to identify configuration compromises, trace system changes, and assess Windows security posture.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.