# System Resource Usage Monitor (SRUM)

The SRUM database is a forensic artifact that provides evidence of execution and network activity. It is used by Windows to provide telemetry regarding applications that run on an endpoint. It provides 30-60 days of resolution.

{% hint style="info" %}
This artifact is present in both the **registry** as well as the **filesystem**, as an ESE database.
{% endhint %}

## Analysis Value

{% content-ref url="/pages/7PsIbY4z0aa7D6FfSddw" %}
[Execution Account](/windows-forensics/artifacts-by-activity/execution/execution-account.md)
{% endcontent-ref %}

{% content-ref url="/pages/vnDLfD9RBoVh5UOGGhiw" %}
[Evidence of Execution](/windows-forensics/artifacts-by-activity/execution/evidence-of-execution.md)
{% endcontent-ref %}

{% content-ref url="/pages/V3cDcDJogcr4slquHEzB" %}
[File Path](/windows-forensics/artifacts-by-activity/file-activity/file-path.md)
{% endcontent-ref %}

{% content-ref url="/pages/LRJZQZsAd12i4mDfGwuK" %}
[Security Identifier](/windows-forensics/artifacts-by-activity/account-activity/security-identifier.md)
{% endcontent-ref %}

{% content-ref url="/pages/ylJHwaSzYnCr2VFHo6Yn" %}
[Transmit Volume](/windows-forensics/artifacts-by-activity/network-activity/transmit-volume.md)
{% endcontent-ref %}

## Operating System Availability

| Major Version | Support | Major Version | Support |
| ------------- | ------- | ------------- | ------- |
| Windows 11    | ✅       | Server 2019   | ✅       |
| Windows 10    | ✅       | Server 2016   | ❌       |
| Windows 8     | ✅       | Server 2012   | ❌       |
| Windows 7     | ❌       | Server 2008   | ❌       |
| Windows Vista | ❌       | Server 2003   | ❌       |
| Windows XP    | ❌       |               |         |

## Artifact Location(s)

* Filesystem: `%SystemRoot%\System32\sru\SRUDB.dat`
* Registry: `SOFTWARE\Microsoft\Windows NT\Current Version\SRUM\Extensions`

## Artifact Parsers

* [srum-dump](https://github.com/MarkBaggett/srum-dump)
* ESEDatabaseView
* Registry Explorer

## Artifact Interpretation

The recommended method to interpret this artifact is to use the srum-dump parser. It will allow you to specify the path the the SRUDB.dat file, the SOFTWARE registry hive, and easily convert the information into a presentable format in an Excel spreadsheet.

The SRUM database records information from a number of providers. If you are parsing this manually, you will encounter the following IDs:

| Key                                      | Provider                            |
| ---------------------------------------- | ----------------------------------- |
| `{973F5D5C-1D90-4944-BE8E-24B94231A174}` | Network Data Usage Monitor          |
| `{D10CA2FE-6FCF-4F6D-848E-B2E99266FA86}` | Push Notification Provider          |
| `{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}` | Application Resource Usage Provider |
| `{DD6636C4-8929-4683-974E-22C046A43763}` | Network Connectivity Usage Monitor  |
| `{FEE4E14F-02A9-4550-B5CE-5FA2DA202E37}` | Energy Usage Provider               |

The following information is available from these providers:

* Network Data Usage Monitor
  * *Tracks network usage on a per-application basis*
  * Application ID
  * User SID
  * Type of interface network traffic traversed (i.e., Ethernet, loopback, IEEE 802.11 wireless, etc.)
  * Bytes sent and received
* Push Notification Provider
  * *Tracks push notification (WPM) activity on a per-application basis*
  * Application Name
  * User SID
  * Push notification payload size
* Application Resource Usage
  * Application Name
  * User SID
  * Performance metrics such as CPU time, disk write/read bytes, etc.
* Network Connectivity Usage Monitor
  * *Tracks each network the endpoint has been connected to.*
  * Time of first connection
  * Duration of connection
  * Type of interface network traffic traversed (i.e., Ethernet, loopback, IEEE 802.11 wireless, etc.)

### Network Data Usage Monitor

This artifact is useful for identifying potential data exfiltration events from Windows systems, as it captures network utilization over time, providing insight into the magnitude of the data transfer. Note that this artifact provides an **hourly, bucketed** count of how many bytes were sent and received by an application, therefore, the first and last SRUM entry will not correspond exactly to the first and last execution time. This can, however, be used to provide a rough estimate of the timeline of execution for an application.

{% hint style="warning" %}
Data collected is written to the SRUM database on the filesystem once per hour to reflect what is stored in the registry, or during system shutdown/reboot events. In the event that a proper shutdown was not conducted, the SRUM filesystem database may need to be repaired using a utility such as `esentutl`.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/srum-db.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.