SRUM

This Windows feature is used to monitor system performance and can provide an incident responder with information on how much data was sent/received per application per hour, which is crucial for data exfiltration investigations.

The database with SRUM data is located at C:\Windows\System32\SRU.

To parse it properly, you may also need the SOFTWARE registry file, located under C:\Windows\System32\config.

Both of these files can be parsed with help of SrumECmd. The resulting files can be browsed with Timeline Explorer:

Figure 7.13 – Browsing parsed SRUM data with Timeline Explorer

What else do threat actors use for data exfiltration and lateral tool transfer? Web browsers, of course!