Parsing of msPKIRoamingTimeStamp

lkarlslund · Jan 22, 2024 · 69a66ad · 69a66ad
1 parent 89325b8
commit 69a66ad
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/modules/integrations/activedirectory/attributes.go b/modules/integrations/activedirectory/attributes.go
@@ -18,6 +18,7 @@ var (
 	MemberOf                                = engine.NewAttribute("memberOf").Tag("AD")
 	Member                                  = engine.NewAttribute("member").Tag("AD")
 	BadPasswordTime                         = engine.NewAttribute("badPasswordTime").Tag("AD").Type(engine.AttributeTypeTime100NS)
+	MsPKIRoamingTimeStamp                   = engine.NewAttribute("msPKIRoamingTimeStamp").Tag("AD").Type(engine.AttributeTypeTime100NS)
 	CreationTime                            = engine.NewAttribute("creationTime").Tag("AD").Type(engine.AttributeTypeTime100NS)
 	AccountExpires                          = engine.NewAttribute("accountExpires").Tag("AD").Type(engine.AttributeTypeTime100NS)
 	RepsTo                                  = engine.NewAttribute("repsTo").Tag("AD")

diff --git a/modules/integrations/activedirectory/rawobject.go b/modules/integrations/activedirectory/rawobject.go
@@ -94,6 +94,10 @@ func EncodeAttributeData(attribute engine.Attribute, values []string) engine.Att
 		var attributevalue engine.AttributeValue
 		switch attribute {
 		// Add more things here, like time decoding etc
+		case MsPKIRoamingTimeStamp:
+			// https://www.sysadmins.lv/blog-en/how-to-convert-ms-pki-roaming-timestamp-attribute.aspx
+			t := util.FiletimeToTime(binary.LittleEndian.Uint64([]byte(value[8:])))
+			attributevalue = engine.AttributeValueTime(t)
 		case AccountExpires, CreationTime, PwdLastSet, LastLogon, LastLogonTimestamp, MSmcsAdmPwdExpirationTime, BadPasswordTime:
 			if intval, err := strconv.ParseInt(value, 10, 64); err == nil {
 				if intval == 0 {