Add Chromium's Notifications artifact

[0xThiebaut]

Recover the Chromium notification preferences and associated interactions. Browser notifications may be leveraged for social engineering; This generic artifact recovers the Chromium (Google Chrome, Microsoft Edge, ...) notification preferences and associated interactions.

The notification preferences allow for the identification of which URLs may or may not send notifications. The associated interactions provide metrics on when notifications have been sent, their amount as well as whether the user interacted.

The following is a benign example after having interacted with Mozillas's example notifications.

[scudette]

I wonder if this is best in the SqliteHunter with all the other chromium artifacts?

[0xThiebaut]

Even though it is not SQLite based?

[scudette]

Yes exactly - the SQLiteHunter actually contains a lot of browser artifacts that are sqlite based these days for example extensions

https://github.com/Velocidex/SQLiteHunter/blob/main/definitions/ChromiumBrowser_Extensions.yaml

[0xThiebaut]

[...] the SQLiteHunter actually contains a lot of browser artifacts that are sqlite based [...]

That "are" or "are not"? This artifact is JSON-based, not SQLite-based. More than happy to contribute it to the repository you prefer.

[scudette]

Yeah sorry thats what I meant - SQLiteHunter contains all kinds of targets which are not always sqlite based at all

The main interesting thing about the sqlitehunter is that it has the following steps:

1. glob through potential candidates
2. possibly test to see if the glob match is the correct file
3. collect an artifact source which parses those files

So it is supposed to be as automated as possible - throw it at the endpoint and see what sticks. Any of the browser artifacts, OS artifacts etc should match within the time range of interest.

[0xThiebaut]

Created Velocidex/SQLiteHunter#10 but I'll need to figure out the compiling later as the Example Development Walk Through doesn't work out of the box.