Registry

Details

Executable	Registry.exe
Stage	9
Percent Complete	48%
Message Queue	registry

The Registry ETL is responsible for pulling information out of registry files.

File Types

Registry processes the following types of files.

File Type	Produces
Type_Windows_Registry	Artifacts
Type_SAM_Registry	Artifacts
Type_System_Registry	Artifacts
Type_Boot_Registry	Artifacts
Type_User_Registry	Artifacts
Type_Software_Registry	Artifacts
Type_Amcache	Artifacts
Type_Security_Registry	Artifacts

Items Produced

The way that this Truxton ETL processes registry files is generic. It doesn't care what specific type of registry file is being exploited. It will produce the following types of items:

• ENTITY_TYPE_MAC_ADDRESS
• ENTITY_TYPE_MACHINE_GUID
• ENTITY_TYPE_MACHINE_NAME
• ENTITY_TYPE_PRODUCT_KEY
• ENTITY_TYPE_SERIAL_NUMBER
• ENTITY_TYPE_SSID
• ENTITY_TYPE_VOLUME_NAME
• ENTITY_TYPE_VOLUME_SERIAL_NUMBER
• ENTITY_TYPE_WAID
• EVENT_TYPE_CONNECTED_TO_NETWORK
• EVENT_TYPE_OPENED_A_FILE
• EVENT_TYPE_PASSWORD_CREATED
• EVENT_TYPE_PROGRAM_EXECUTED
• EVENT_TYPE_RDP_CONNECTION
• EVENT_TYPE_SHUTDOWN
• EVENT_TYPE_SOFTWARE_INSTALLED
• File - Type_Media_Snippet
• File - Type_Windows_Link