# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Brutal Kangaroo

# Shadow v1.0 - User Guide

31 August, 2012

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 13
- 14

Shadow v1.0 User Guide SECRET
• "File Collection" task:
o (S) For each file pattern entered, collection criteria is created and saved as a row
in the collection priorities table. Wildcards and environment variables may be
used in the file pattern field. For example, a file pattern of *.doc will collect all
Microsoft Word docs off of all fixed drives in the system. A file pattern of
C:\*.doc will collect all Microsoft Word docs off of the C drive. Note that 2007
Office docs have an x on the extension, so to include all 2007 Word docs search
with C:\*.docx or C:\*.doc*. To search for specific files, enter the entire path to
the file: C:\Program Files\sample.txt.
o (S) To enable the date controls and the min/max file size fields, the appropriate
check boxes must be selected.
o (S) Once collection criteria are set, click the Add Row button. This will add a row
to the table on the lower part of the screen. To add additional file patterns with
different collection criteria, change the entries in the Collection Criteria area of
the screen, and then click Add Row again to add a new entry to the table.
o (S) Entries may be moved up and down within the table by clicking on the row of
interest to move (it will be highlighted once it is selected), and then clicking the
Up and Down buttons until the row is in the desired position. Note that collection
will occur based on the priority of entries in the table, with the highest priority
collection set starting at the top. Each collection set will run individually.
o (S) To delete a row in the table, click on a row, (again it will be highlighted when
selected), and then hit the Delete Row button.
3.3 (U) Packet Deployment
• (S) Once you've built your .dat file, you must drop it in a Shadow outbox directory, as
configured in the ConfigureShadow program ("Default Tasking Directory"). Shadow will
then eat the packet, and determine what to do with it.
• (S) Shadow will forward the packet to the intended recipient if known, or broadcast the
message to all Shadow instances on the network if the recipient is not known. If the recipient
is designated "ALL_SHADOW", then a broadcast will be sent to all currently known
recipients of the forwarding system.
• (S) If configured, Shadow will Watermark all removable media it discovers;
Unbeknownst to the user, the drive will be repartitioned and space allocated for a Shadow
covert storage area. Prior to Shadow using these drives, they must come into contact with
other Shadow machines. Until the drive has been read by multiple other Shadow devices, the
drive will not be used, nor partitioned but for 8MB. After it has been deemed usable, Shadow
will allocate 10% of the drive for usage. You must select to "Convert all USB drives to
Shadow drives" in the Shadow configure tool for this to occur. The only reason you wouldn't
want to do this is if you already have Shadow drives on the closed network that you want
SECRET
4

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 13
- 14