{"metadata": {"vulnerability": "CVE-2025-24479", "count": 30, "kinds": {"milestone": 7, "sighting": 6, "kev": 0, "other": 17}}, "data": [{"timestamp": "2025-01-21T21:21:03.342Z", "date_only": false, "value": "2025-01-21T21:21:03.342Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-24479", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-01-28T07:00:00Z", "date_only": false, "value": "2025-01-28T07:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-028-03", "record": "ICSA-25-028-03", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-01-28T07:00:00Z", "date_only": false, "value": "2025-01-28T07:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-25-028-03", "record": "ICSA-25-028-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-01-28T07:00:00Z", "date_only": false, "value": "2025-01-28T07:00:00.000000Z", "kind": "other", "label": "Updated", "source": "csaf_cisa \u00b7 ICSA-25-028-03", "record": "ICSA-25-028-03", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-01-28T11:00:00Z", "date_only": false, "value": "2025-01-28T11:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-03", "record": "CVE-2025-24479", "field": "creation_timestamp", "uuid": "67205b49-1e3d-4098-aa20-2c6cdb123f6a", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-03"}, {"timestamp": "2025-01-28T14:00:00Z", "date_only": false, "value": "2025-01-28T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Rockwell", "record": "CVE-2025-24479", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-01-28T18:52:18.429Z", "date_only": false, "value": "2025-01-28T18:52:18.429Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-24479", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-01-28T18:52:18.429Z", "date_only": false, "value": "2025-01-28T18:52:18.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Rockwell", "record": "CVE-2025-24479", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-01-28T18:54:09.810Z", "date_only": false, "value": "2025-01-28T18:54:09.810110Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/113907495683372640", "record": "CVE-2025-24479", "field": "creation_timestamp", "uuid": "e4c3affa-9295-455a-9a0d-fb4e1cefb2a3", "url": "https://infosec.exchange/users/cve/statuses/113907495683372640"}, {"timestamp": "2025-01-28T19:01:40.776Z", "date_only": false, "value": "2025-01-28T19:01:40.776252Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-24479", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-01-28T19:01:40.776Z", "date_only": false, "value": "2025-01-28T19:01:40.776252Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24479", "record": "FKIE_CVE-2025-24479", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-01-28T19:15:14Z", "date_only": false, "value": "2025-01-28T19:15:14Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5Q2H-RCFJ-XC9G", "record": "GHSA-5Q2H-RCFJ-XC9G", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-01-28T19:15:14.910Z", "date_only": false, "value": "2025-01-28T19:15:14.910", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24479", "record": "FKIE_CVE-2025-24479", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-01-28T19:15:40.346Z", "date_only": false, "value": "2025-01-28T19:15:40.346348Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgt64fqlrt2n", "record": "CVE-2025-24479", "field": "creation_timestamp", "uuid": "9b4b15a2-501a-446d-8cc8-9cd8868e8c83", "url": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgt64fqlrt2n"}, {"timestamp": "2025-01-28T21:17:42Z", "date_only": false, "value": "2025-01-28T21:17:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/16616", "record": "CVE-2025-24479", "field": "creation_timestamp", "uuid": "0749e799-48b2-4ed8-98e0-c60f2bafdcb7", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-24479 - Windows Command Prompt Privilege Escalation Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-24479 \nPublished : Jan. 28, 2025, 7:15 p.m. | 19\u00a0minutes ago \nDescription : A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"28 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/16616"}, {"timestamp": "2025-01-28T21:31:03Z", "date_only": false, "value": "2025-01-28T21:31:03Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5Q2H-RCFJ-XC9G", "record": "GHSA-5Q2H-RCFJ-XC9G", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-01-28T21:31:03Z", "date_only": false, "value": "2025-01-28T21:31:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5Q2H-RCFJ-XC9G", "record": "GHSA-5Q2H-RCFJ-XC9G", "field": "modified"}, {"timestamp": "2025-01-28T22:20:46.136Z", "date_only": false, "value": "2025-01-28T22:20:46.136652Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/113908308068172337", "record": "CVE-2025-24479", "field": "creation_timestamp", "uuid": "7873f1ea-e3dc-4188-8aa3-9f4bc1f51c89", "url": "https://infosec.exchange/users/cR0w/statuses/113908308068172337"}, {"timestamp": "2025-01-28T23:00:00Z", "date_only": false, "value": "2025-01-28T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0206", "record": "WID-SEC-W-2025-0206", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-01-28T23:00:00Z", "date_only": false, "value": "2025-01-28T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0206", "record": "WID-SEC-W-2025-0206", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-01-28T23:00:00Z", "date_only": false, "value": "2025-01-28T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0206", "record": "WID-SEC-W-2025-0206", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-01-28T23:00:00Z", "date_only": false, "value": "2025-01-28T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0206", "record": "WID-SEC-W-2025-0206", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-01-29T10:31:54.373Z", "date_only": false, "value": "2025-01-29T10:31:54.373+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0206", "record": "WID-SEC-W-2025-0206", "field": "document.tracking.generator.date"}, {"timestamp": "2025-01-29T10:32:40.594Z", "date_only": false, "value": "2025-01-29T10:32:40.594073Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0035", "record": "NCSC-2025-0035", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-01-29T10:32:40.594Z", "date_only": false, "value": "2025-01-29T10:32:40.594073Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0035", "record": "NCSC-2025-0035", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-01-29T10:32:40.594Z", "date_only": false, "value": "2025-01-29T10:32:40.594073Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0035", "record": "NCSC-2025-0035", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-02-12T20:01:10.925Z", "date_only": false, "value": "2025-02-12T20:01:10.925Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-24479", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-02-12T20:01:10.925Z", "date_only": false, "value": "2025-02-12T20:01:10.925Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-24479", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T08:59:05.580Z", "date_only": false, "value": "2026-06-17T08:59:05.580", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24479", "record": "FKIE_CVE-2025-24479", "field": "lastModified"}, {"timestamp": "2026-10-12T16:46:38Z", "date_only": false, "value": "2026-10-12T16:46:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Piuliss/f7ab88dbcef916f098c658a8896804fe", "record": "CVE-2025-24479", "field": "creation_timestamp", "uuid": "f46ea143-a598-42aa-8b5d-20fceba5949d", "content": "Description: Rockwell FactoryTalk Diagnostics local logs (common to all FTSP products: View, Linx, Alarms&Events, Historian, Batch, Activation). Captures system activity, tag reads/writes, communication errors, login events, configuration changes routed through FactoryTalk Diagnostics. Bulletproof against locked files via AlwaysAddToQueue.\nAuthor: Raul B Netto (Cybolt DFIR)\nVersion: 1.1\nId: 546c910f-6aef-418b-8a26-647aa5c88273\nRecreateDirectories: true\nTargets:\n    -\n        Name: FactoryTalk Diagnostics Local Log (modern path)\n        Category: Logs\n        Path: C:\\ProgramData\\Rockwell\\FTV\\Logs\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"Default path for FactoryTalk Diagnostics local log on Windows Server 2012+ / Win10+. Contains .xml, .evtx-style messages per service that registered with FTSP. AlwaysAddToQueue: KAPE will raw-read these if locked by the live FTSP service.\"\n    -\n        Name: FactoryTalk Diagnostics Local Log (legacy path)\n        Category: Logs\n        Path: C:\\Documents and Settings\\All Users\\Application Data\\Rockwell\\FTV\\Logs\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"Legacy path on Windows Server 2008 / older hosts.\"\n    -\n        Name: FactoryTalk ProgramData (other Rockwell services)\n        Category: Logs\n        Path: C:\\ProgramData\\Rockwell\\\n        Recursive: true\n        FileMask: \"*.log\"\n        AlwaysAddToQueue: true\n        Comment: \"Catch-all for any Rockwell service that writes logs under C:\\\\ProgramData\\\\Rockwell\\\\ (Activation, Linx, FTSP, AssetCentre, etc).\"\n    -\n        Name: FactoryTalk ProgramData (catch-all, any file)\n        Category: Logs\n        Path: C:\\ProgramData\\Rockwell\\\n        Recursive: true\n        FileMask: \"*\"\n        Comment: \"Second pass: any non-.log file under ProgramData\\\\Rockwell\\\\ that the prior filter may have missed (registry exports, snapshots, debug dumps). NOT AlwaysAddToQueue to avoid expensive raw reads on large unrelated files.\"\n\n# Documentation\n# FactoryTalk Diagnostics is the common logging subsystem shared by every FactoryTalk\n# product. Default retention 7 days. For DFIR, the most valuable entries are:\n#   - Tag writes with source (operator, screen, macro)\n#   - Login events to the FactoryTalk Directory\n#   - Service start/stop of HMI server, data server, alarm server\n#   - Communication errors between Linx and ControlLogix/CompactLogix\n#   - Security policy changes\n# Bulletproof notes:\n#   - AlwaysAddToQueue: true on .log files forces KAPE's secondary raw-read pass\n#     for any file that the OS reports as locked. This is the realistic case when\n#     the HMI server is still running during triage.\n#   - The trailing catch-all (without AlwaysAddToQueue) ensures we don't miss\n#     non-.log artifacts (snapshots, dumps) while avoiding raw-read cost.\n# Reference: CISA ICSA-24-256-23 (CVE-2024-45824), Rockwell SD1673.\n\n\nDescription: FactoryTalk Services Platform (FTSP), FactoryTalk Activation Manager, FactoryTalk Linx (data server), FactoryTalk Historian SE, FactoryTalk Batch, and FactoryTalk ViewPoint (IIS web add-on) logs and configuration. This is the umbrella target for non-View FactoryTalk services that share the same host as an FT View SE server. Bulletproof against locked files via AlwaysAddToQueue on critical services.\nAuthor: Raul B Netto (Cybolt DFIR)\nVersion: 1.1\nId: a6e41e26-b4de-41dd-8e16-ea7f465f9d70\nRecreateDirectories: true\nTargets:\n    -\n        Name: FactoryTalk Activation Manager logs\n        Category: Logs\n        Path: C:\\ProgramData\\Rockwell\\Activation\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"Activation Manager logs. CVE-2026-16675 (Sep 2026) LPE. AlwaysAddToQueue: locked by Activation Service at runtime.\"\n    -\n        Name: FactoryTalk Activation install dir\n        Category: Logs\n        Path: C:\\Program Files (x86)\\Rockwell Software\\Activation\\\n        Recursive: true\n        FileMask: \"*.log\"\n        AlwaysAddToQueue: true\n        Comment: \"Activation Manager installer/runtime logs in Program Files. Locked while service runs.\"\n    -\n        Name: FactoryTalk Activation install dir - all\n        Category: FileSystem\n        Path: C:\\Program Files (x86)\\Rockwell Software\\Activation\\\n        Recursive: true\n        FileMask: \"*\"\n        Comment: \"Catch-all: any non-.log file in Activation install (config, ini). NOT AlwaysAddToQueue to keep pass fast.\"\n    -\n        Name: FactoryTalk Services Platform install dir - logs\n        Category: Logs\n        Path: C:\\Program Files (x86)\\Rockwell Software\\FactoryTalk\\\n        Recursive: true\n        FileMask: \"*.log\"\n        AlwaysAddToQueue: true\n        Comment: \"FTSP runtime logs. Includes FactoryTalk Directory, Security, and Policy Manager services. Locked while services run.\"\n    -\n        Name: FactoryTalk Services Platform install dir - all\n        Category: FileSystem\n        Path: C:\\Program Files (x86)\\Rockwell Software\\FactoryTalk\\\n        Recursive: true\n        FileMask: \"*\"\n        Comment: \"Catch-all: any non-.log file in FTSP install. NOT AlwaysAddToQueue.\"\n    -\n        Name: FactoryTalk Linx (data server) - logs\n        Category: Logs\n        Path: C:\\Program Files (x86)\\Rockwell Software\\FactoryTalk Linx\\\n        Recursive: true\n        FileMask: \"*.log\"\n        AlwaysAddToQueue: true\n        Comment: \"FT Linx / RSLinx-class data server. CIP/EtherNet/IP comms to ControlLogix/CompactLogix live here. Locked while service runs. Critical for PLC comms evidence.\"\n    -\n        Name: FactoryTalk Linx (data server) - all\n        Category: FileSystem\n        Path: C:\\Program Files (x86)\\Rockwell Software\\FactoryTalk Linx\\\n        Recursive: true\n        FileMask: \"*\"\n        Comment: \"Catch-all: non-.log files in FT Linx install. NOT AlwaysAddToQueue.\"\n    -\n        Name: FactoryTalk Historian SE install dir\n        Category: FileSystem\n        Path: C:\\Program Files\\Rockwell Software\\FactoryTalk Historian\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"FT Historian SE. PIGetMsg.exe lives in Server\\\\adm\\\\ for log access. CVE-2025-13036/44019/36539 (login race condition). AlwaysAddToQueue: Historian data store is heavily locked.\"\n    -\n        Name: FactoryTalk Batch Event Journal (default)\n        Category: FileSystem\n        Path: C:\\Users\\Public\\Public Documents\\Rockwell Automation\\Batch\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"Default FT Batch Event Journal path. Batchsvr.ini ErrorLogDirectory may override. AlwaysAddToQueue: journal is constantly appended to.\"\n    -\n        Name: FactoryTalk Batch alt install path\n        Category: FileSystem\n        Path: C:\\ProgramData\\Rockwell Automation\\Batch\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"Alternate FT Batch install on modern hosts.\"\n    -\n        Name: FactoryTalk ViewPoint install (IIS-backed)\n        Category: FileSystem\n        Path: C:\\inetpub\\wwwroot\\\n        Recursive: true\n        FileMask: \"*ViewPoint*\"\n        Comment: \"FT ViewPoint web application root. Pair with IISLogFiles target for full web traffic (CVE-2025-9066 XXE). NOT AlwaysAddToQueue: static web app files.\"\n    -\n        Name: Rockwell Software install root - INI files\n        Category: FileSystem\n        Path: C:\\Program Files (x86)\\Rockwell Software\\\n        Recursive: true\n        FileMask: \"*.ini\"\n        Comment: \"All Rockwell .ini config files for installed services. Fast triage of which FTSP components are present and how they are configured.\"\n    -\n        Name: Rockwell Software install root - all configs\n        Category: FileSystem\n        Path: C:\\Program Files (x86)\\Rockwell Software\\\n        Recursive: true\n        FileMask: \"*.config\"\n        Comment: \".NET config files (.config) for Rockwell services. Tells us service config, connection strings, etc.\"\n\n# Documentation\n# The path C:\\\\Program Files (x86)\\\\Rockwell Software\\\\ is the canonical install\n# root for the entire FactoryTalk suite on x64 Windows. Listing this directory\n# is a quick way to enumerate which components are installed. The 32-bit path\n# applies even on x64 Windows because most FactoryTalk services are still\n# 32-bit or installer-32-bit-on-64.\n#\n# Bulletproof notes:\n#   - All .log captures have AlwaysAddToQueue: true because the corresponding\n#     service has these files open at runtime. Raw read is necessary if we\n#     triage a live host.\n#   - The catch-all duplicates WITHOUT AlwaysAddToQueue cover config files and\n#     other artifacts that aren't actively locked.\n#\n# Cross-references:\n#   - Activation: CVE-2026-16675\n#   - Historian SE: CVE-2025-13036 / 44019 / 36539\n#   - ViewPoint: CVE-2025-9066\n#   - View SE: CVE-2024-45824, CVE-2024-7513\n#   - View ME: CVE-2025-24479, CVE-2025-24480, CVE-2025-9063/9064\n\n\nDescription: FactoryTalk View SE and ME HMI projects, runtime logs, alarm logs, audit trails, data logs, and global objects. Captures the engineering project (.ggfx displays, .HMI project metadata) and runtime artifact folders. This is the highest-value target in DFIR for OT environments: the HMI project files contain display logic and were the attack surface in CVE-2024-7513 (default INTERACTIVE group write to project folder). Bulletproof against locked files via AlwaysAddToQueue on critical artifacts.\nAuthor: Raul B Netto (Cybolt DFIR)\nVersion: 1.1\nId: e69b3c0e-02d3-4c7b-9245-bcecf495e146\nRecreateDirectories: true\nTargets:\n    -\n        Name: FT View SE - HMI projects - Global Objects (.ggfx)\n        Category: FileSystem\n        Path: C:\\Users\\Public\\Documents\\RSView Enterprise\\SE\\HMI projects\\\n        Recursive: true\n        FileMask: \"*.ggfx\"\n        AlwaysAddToQueue: true\n        Comment: \"Global Object display files. MFT timestamps reveal display modification. AlwaysAddToQueue: KAPE will raw-read these if the HMI server has them open. CVE-2024-7513 default INTERACTIVE write applies here.\"\n    -\n        Name: FT View SE - HMI projects - Project metadata (.HMI)\n        Category: FileSystem\n        Path: C:\\Users\\Public\\Documents\\RSView Enterprise\\SE\\HMI projects\\\n        Recursive: true\n        FileMask: \"*.HMI\"\n        AlwaysAddToQueue: true\n        Comment: \"HMI project metadata files. AlwaysAddToQueue: critical for forensic timeline.\"\n    -\n        Name: FT View SE - HMI projects - All files (catch-all)\n        Category: FileSystem\n        Path: C:\\Users\\Public\\Documents\\RSView Enterprise\\SE\\HMI projects\\\n        Recursive: true\n        FileMask: \"*\"\n        Comment: \"Catch-all for any other files in the project (macros, parameter files, etc.) NOT AlwaysAddToQueue to keep secondary pass fast.\"\n    -\n        Name: FT View SE - HMI projects (legacy XP/2003 path)\n        Category: FileSystem\n        Path: C:\\Documents and Settings\\All Users\\Shared Documents\\RSView Enterprise\\SE\\HMI Projects\\\n        Recursive: true\n        FileMask: \"*\"\n        Comment: \"Legacy path on Windows XP / Server 2003 hosts.\"\n    -\n        Name: FT View SE - Data Log files (.DAT / .OBF)\n        Category: FileSystem\n        Path: C:\\Users\\Public\\Documents\\RSView Enterprise\\SE\\\n        Recursive: true\n        FileMask: \"*.DAT\"\n        AlwaysAddToQueue: true\n        Comment: \"SE data log binary files. Pair with .OBF index. Locked by HMI server during runtime -> AlwaysAddToQueue.\"\n    -\n        Name: FT View SE - Data Log files (.OBF index)\n        Category: FileSystem\n        Path: C:\\Users\\Public\\Documents\\RSView Enterprise\\SE\\\n        Recursive: true\n        FileMask: \"*.OBF\"\n        AlwaysAddToQueue: true\n        Comment: \"SE data log index files. Use FT View File Viewer to read. Locked by HMI server during runtime -> AlwaysAddToQueue.\"\n    -\n        Name: FT View ME - HMI projects (modern path)\n        Category: FileSystem\n        Path: C:\\Users\\Public\\Documents\\RSView Enterprise\\ME\\HMI projects\\\n        Recursive: true\n        FileMask: \"*\"\n        Comment: \"ME engineering projects (.mer sources).\"\n    -\n        Name: FT View ME - Runtime logs on PC / MobileView / IPC\n        Category: FileSystem\n        Path: C:\\Users\\Public\\Documents\\RSView Enterprise\\ME\\Logs\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"ME runtime logs when running on Windows PC / MobileView / industrial PC. Contains M_Alarms (HISTORY.ALM), M_AuditTrails, M_DataLogs, Diagnostics. AlwaysAddToQueue: these are open by ME Station at runtime.\"\n    -\n        Name: FT View ME - Runtime logs on PanelView Plus 7/6\n        Category: FileSystem\n        Path: C:\\Windows\\Logs\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"ME runtime logs when running on PanelView Plus 7 or Plus 6 (Windows CE 6.0 embedded). Limited to \\\\\\\\Windows\\\\\\\\Logs on the device.\"\n    -\n        Name: FT View ME - Runtime logs on legacy PanelView (Storage Card)\n        Category: FileSystem\n        Path: C:\\Storage Card\\Rockwell Software\\RSViewME\\Logs\\\n        Recursive: true\n        FileMask: \"*\"\n        AlwaysAddToQueue: true\n        Comment: \"ME runtime logs on legacy PanelView Plus / Compact / CE using the removable storage card.\"\n\n# Documentation\n# HMI project files (.ggfx, .HMI, .mer) on a FactoryTalk View server are the\n# engineering source-of-truth for what the operator sees. Modifications outside\n# of change windows are evidence of either unauthorized engineering or attacker\n# tampering. ALWAYS preserve these files before any re-deploy or restore, with\n# their original NTFS timestamps.\n#\n# Bulletproof notes:\n#   - .ggfx and .HMI are the most likely files to be locked by the HMI server\n#     during live triage. AlwaysAddToQueue forces KAPE to attempt a raw disk\n#     read (via FTK Imager-style read) if the regular copy fails.\n#   - The catch-all with mask \"*\" (without AlwaysAddToQueue) is a safety net\n#     for project files we didn't anticipate.\n#   - ME runtime logs are appended to constantly while the application is\n#     running. AlwaysAddToQueue here is critical to capture the current\n#     session's audit trail and alarm history before triage.\n#\n# View SE/ME log file types and their viewers:\n#   SE DataLog     : .DAT + .OBF      (FT View File Viewer)\n#   ME DataLog     : .LOG              (FT View File Viewer)\n#   ME Alarm log   : HISTORY.ALM       (HMI Tag Alarm Log Viewer)\n#   ME Audit trail : in M_AuditTrails\\ (CSV exportable)\n#   ME RecipePlus  : .RPP              (FT View File Viewer)\n#\n# References: Rockwell View SE User Guide, CISA ICSA-24-226-06 (CVE-2024-7513).\n\n\n# Rockwell FactoryTalk \u2014 KAPE Triage 2-PASS (DFIR)\n\nBundle para hacer triage de un host Windows con Rockwell FactoryTalk (HMI server,\nengineering workstation, o PC con FT View ME) usando KAPE en dos pasadas.\n\n---\n\n## Setup (3 pasos)\n\n**1. Crear la carpeta y extraer kape.zip ah\u00ed:**\n\n```cmd\nmkdir D:\\KAPE\nexpand E:\\ruta\\al\\kape.zip D:\\KAPE\\\n```\n\n(Si la USB no es E:, ajustar la letra. Si quer\u00e9s otro path, todo vale \u2014 pasalo\ncomo argumento al .cmd, ver abajo.)\n\n**2. Copiar los 4 archivos del gist a la misma carpeta `D:\\KAPE\\`:**\n\n```\nD:\\KAPE\\\n\u251c\u2500\u2500 kape.exe                              \u2190 de kape.zip\n\u251c\u2500\u2500 KAPE_TRIAGE_ROCKWELL.cmd              \u2190 este bundle\n\u251c\u2500\u2500 README.md\n\u251c\u2500\u2500 RockwellFactoryTalk.tkape             \u2190 del gist\n\u251c\u2500\u2500 FactoryTalkDiagnostics.tkape          \u2190 del gist\n\u251c\u2500\u2500 FactoryTalkViewSE_ME.tkape            \u2190 del gist\n\u251c\u2500\u2500 FactoryTalkServices.tkape             \u2190 del gist\n\u251c\u2500\u2500 Targets\\                              \u2190 de kape.zip (carpeta completa)\n\u2502   \u251c\u2500\u2500 Compound\\KapeTriage.tkape\n\u2502   \u251c\u2500\u2500 Basic\\*  (etc)\n\u2502   \u2514\u2500\u2500 Logs\\*\n\u2514\u2500\u2500 Modules\\                              \u2190 de kape.zip (carpeta completa)\n    \u251c\u2500\u2500 KapeTriage.mkape\n    \u251c\u2500\u2500 MFTECmd.mkape\n    \u251c\u2500\u2500 EvtxECmd.mkape\n    \u2514\u2500\u2500 ...\n```\n\n**3. Ejecutar en el HMI server** (cmd como Administrador):\n\n```cmd\nD:\\KAPE\\KAPE_TRIAGE_ROCKWELL.cmd\n```\n\nSi la carpeta no es `D:\\KAPE`, pasala como argumento:\n\n```cmd\nD:\\KAPE\\KAPE_TRIAGE_ROCKWELL.cmd E:\\KAPE\nD:\\KAPE\\KAPE_TRIAGE_ROCKWELL.cmd F:\\Forensics\\KAPE\n```\n\n---\n\n## Lo que hace\n\n| Pass | Target | Necesita | Output |\n|---|---|---|---|\n| **1** | `KapeTriage` (oficial) | `Targets\\` + `Modules\\` del kape.zip | `-KAPE-.zip` + `.sha256` |\n| **2** | `RockwellFactoryTalk` (custom) | Los 4 `.tkape` al lado del .cmd | `-FTV-.zip` + `.sha256` |\n\nAmbas pasadas usan `--vss` (Volume Shadow Copy snapshot) para copiar archivos\nlocked (event logs abiertos, displays `.ggfx` en uso por el HMI server, etc).\n\nPass 1 adem\u00e1s corre los modules EZ Tools (MFTECmd, EvtxECmd, RECmd, PECmd, etc)\nsobre los artefactos colectados \u2014 salida en CSVs listos para Timeline Explorer.\n\nSi Pass 1 falla (falta `Targets\\`), Pass 2 sigue corriendo.\n\n---\n\n## Outputs\n\nQuedan en la misma carpeta base (`D:\\KAPE\\`, `E:\\KAPE\\`, etc):\n\n```\n-KAPE-YYYYMMDD.zip         \u2190 Pass 1 (si corrio)\n-KAPE-YYYYMMDD.zip.sha256\n-FTV-YYYYMMDD.zip          \u2190 Pass 2 (siempre)\n-FTV-YYYYMMDD.zip.sha256\nModules\\                         \u2190 Output CSVs de los modules EZ Tools (Pass 1)\n```\n\nArchivos temporales de KAPE van a `C:\\_kape_tmp\\KAPE` y `C:\\_kape_tmp\\FTV`\n(esto acelera la copia en USBs lentas).\n\n---\n\n## Validaci\u00f3n en analyst workstation\n\n```bash\ncd /ruta/al/usb/o/carpeta\nsha256sum -c -KAPE-YYYYMMDD.zip.sha256\nsha256sum -c -FTV-YYYYMMDD.zip.sha256\n```\n\nAmbos deben decir `OK`.\n\n---\n\n## Qu\u00e9 colecta cada target\n\n**Pass 1 \u2014 KapeTriage (oficial):** event logs, registry hives, prefetch,\nscheduled tasks, $MFT, browser history, LNK, JumpLists, recycle bin, services,\nSRUM, etc + processing via MFTECmd/EvtxECmd/RECmd/PECmd/etc.\n\n**Pass 2 \u2014 RockwellFactoryTalk (custom):**\n\n- `C:\\ProgramData\\Rockwell\\FTV\\Logs\\` \u2014 FactoryTalk Diagnostics\n- `C:\\ProgramData\\Rockwell\\Activation\\` \u2014 Activation Manager\n- `C:\\Users\\Public\\Documents\\RSView Enterprise\\SE\\HMI projects\\` \u2014 FT View SE\n- `C:\\Users\\Public\\Documents\\RSView Enterprise\\ME\\Logs\\` \u2014 FT View ME (PC)\n- `C:\\Windows\\Logs\\` \u2014 FT View ME (PanelView Plus 7/6, Win CE)\n- `C:\\Program Files (x86)\\Rockwell Software\\FactoryTalk\\` \u2014 FTSP services\n- `C:\\Program Files (x86)\\Rockwell Software\\FactoryTalk Linx\\` \u2014 FT Linx\n- `C:\\Program Files\\Rockwell Software\\FactoryTalk Historian\\` \u2014 FT Historian SE\n- `C:\\Users\\Public\\Public Documents\\Rockwell Automation\\Batch\\` \u2014 FT Batch\n- `C:\\inetpub\\wwwroot\\*ViewPoint*` \u2014 FT ViewPoint\n\nCVEs cubiertos: CVE-2024-45824, CVE-2024-7513, CVE-2025-24479/24480,\nCVE-2025-9063/9064, CVE-2025-9066, CVE-2025-13036/44019/36539, CVE-2026-16675.\n\n---\n\n## Troubleshooting\n\n| Error | Causa | Fix |\n|---|---|---|\n| `kape.exe no encontrado en D:\\KAPE` | kape.exe no se extrajo ah\u00ed | Verificar el `expand` del paso 1 |\n| `Faltan archivos: RockwellFactoryTalk.tkape...` | No est\u00e1n los 4 .tkape al lado | Descargar del gist y copiar a `D:\\KAPE` |\n| `[1/2] SKIP - KapeTriage.tkape no encontrado` | No extrajiste `Targets\\` del kape.zip | Re-extraer kape.zip completo (con `Targets\\` y `Modules\\`) |\n| `Access denied` en HMI projects | CVE-2024-7513 (permisos default) | Normal. El target hace raw read; lo que se pueda copiar queda. |\n| PanelView Plus 7/6 con Win CE | KAPE no maneja drives Win CE | Montar SD card o usar FTP server del panel |\n| AV/Defender borra kape.exe | EDR agresivo | `powershell Add-MpPreference -ExclusionPath \"C:\\_kape_tmp\"` antes de correr |\n\n---\n\n## SHA-256 del bundle v2.3 (2026-10-12)\n\n```\nKAPE_TRIAGE_ROCKWELL.cmd    \nRockwellFactoryTalk.tkape   7bf07ca97dfbc3d04f4a417704a78e02a7299663b8d389e5f72d51585cd496cd\nFactoryTalkDiagnostics.tkape a03d150f9cf4464f146176d8ffdd42dbdc8c1d3e3d9f694aa52e9b5c5de7e6e0\nFactoryTalkViewSE_ME.tkape  e004180bf314fdfb584479de9a29eba2d8a489e309c997cea36930cf97a8ae81\nFactoryTalkServices.tkape   70cbc06be31f78a02d01188286a62d0f04e5ff4f9f1f01d66bccc59e5ed002aa\n```\n\nOrigen: Cybolt DFIR \u2014 `Beacon-Lab-IR/cybolt-dfir-triage` (private).\n\n\nDescription: Compound target for Rockwell FactoryTalk / Allen-Bradley OT environments. Aggregates FactoryTalk Diagnostics, FT View SE + ME project files and runtime logs, and the rest of the FactoryTalk Services Platform stack (Activation, Linx, Historian SE, Batch, ViewPoint). Run this against any Windows HMI server or engineering workstation suspected of involvement in an OT incident.\nAuthor: Raul B Netto (Cybolt DFIR)\nVersion: 1.0\nId: a221e8dd-4b3a-4fb5-a835-dbdf42e3706e\nRecreateDirectories: true\nTargets:\n    -\n        Name: FactoryTalk Diagnostics (common logging subsystem)\n        Category: Logs\n        Path: FactoryTalkDiagnostics.tkape\n    -\n        Name: FactoryTalk View SE and ME (HMI projects + runtime logs)\n        Category: FileSystem\n        Path: FactoryTalkViewSE_ME.tkape\n    -\n        Name: FactoryTalk Services (FTSP, Activation, Linx, Historian, Batch, ViewPoint)\n        Category: Logs\n        Path: FactoryTalkServices.tkape\n\n# Documentation\n# Usage:\n#   kape.exe --tsource C: --target RockwellFactoryTalk ^\n#            --tdest E:\\EVIDENCE\\ ^\n#            --targetdir C:\\KAPE\\Targets ^\n#            --zip E:\\EVIDENCE\\\\-FTV ^\n#            --hv nc,vm --vss\n#\n# Why a custom target exists:\n#   There is no official RockwellFactoryTalk target in EricZimmerman/KapeFiles.\n#   This compound target is the Cybolt DFIR answer for OT environments where\n#   the affected host runs any FactoryTalk component. Pair with KapeTriage to\n#   also collect standard Windows artifacts (event logs, registry, prefetch).\n#\n# Cross-references (CISA ICS Advisories):\n#   ICSA-24-226-06 : FT View SE permission assignment (CVE-2024-7513)\n#   ICSA-24-256-23 : FT View SE command injection RCE (CVE-2024-45824)\n#   ICSA-25-028-03 : FT View ME command injection RCE (CVE-2025-24480)\n#   SD1753 (10/2025): FT View ME + PanelView Plus 7 path traversal (CVE-2025-9063/9064)\n#   SD1752 (10/2025): FT ViewPoint XXE (CVE-2025-9066)\n", "url": "https://gist.github.com/Piuliss/f7ab88dbcef916f098c658a8896804fe"}], "metrics": {"as_of": "2026-10-31T08:35:14.342Z", "anchors": {"origin": {"timestamp": "2025-01-28T07:00:00Z", "date_only": false, "value": "2025-01-28T07:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-25-028-03", "record": "ICSA-25-028-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-01-28T07:00:00Z", "date_only": false, "value": "2025-01-28T07:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-25-028-03", "record": "ICSA-25-028-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 55388114.34225, "hours": 15385.587317291665, "days": 641.0661382204861, "min_seconds": 55388114.34225, "max_seconds": 55388114.34225, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-01-28T07:00:00Z", "date_only": false, "value": "2025-01-28T07:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-25-028-03", "record": "ICSA-25-028-03", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T08:35:14.342Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}