Difference between revisions of "Registry"
Jump to navigation
Jump to search
| (One intermediate revision by the same user not shown) | |||
| Line 57: | Line 57: | ||
* [[Entity Types|ENTITY_TYPE_MACHINE_GUID]] | * [[Entity Types|ENTITY_TYPE_MACHINE_GUID]] | ||
* [[Entity Types|ENTITY_TYPE_MACHINE_NAME]] | * [[Entity Types|ENTITY_TYPE_MACHINE_NAME]] | ||
| + | * [[Entity Types|ENTITY_TYPE_PRODUCT_KEY]] | ||
* [[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]] | * [[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]] | ||
* [[Entity Types|ENTITY_TYPE_SSID]] | * [[Entity Types|ENTITY_TYPE_SSID]] | ||
| Line 63: | Line 64: | ||
* [[Entity Types|ENTITY_TYPE_WAID]] | * [[Entity Types|ENTITY_TYPE_WAID]] | ||
* [[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] | * [[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] | ||
| + | * [[Event Types|EVENT_TYPE_OPENED_A_FILE]] | ||
* [[Event Types|EVENT_TYPE_PASSWORD_CREATED]] | * [[Event Types|EVENT_TYPE_PASSWORD_CREATED]] | ||
* [[Event Types|EVENT_TYPE_PROGRAM_EXECUTED]] | * [[Event Types|EVENT_TYPE_PROGRAM_EXECUTED]] | ||
| + | * [[Event Types|EVENT_TYPE_RDP_CONNECTION]] | ||
* [[Event Types|EVENT_TYPE_SHUTDOWN]] | * [[Event Types|EVENT_TYPE_SHUTDOWN]] | ||
* [[Event Types|EVENT_TYPE_SOFTWARE_INSTALLED]] | * [[Event Types|EVENT_TYPE_SOFTWARE_INSTALLED]] | ||
| + | * File - [[Type_Media_Snippet]] | ||
| + | * File - [[Type_Windows_Link]] | ||
Latest revision as of 14:13, 6 September 2025
| Executable | Registry.exe
|
| Stage | 9 |
| Percent Complete | 48% |
| Message Queue | registry
|
The Registry ETL is responsible for pulling information out of registry files.
File Types
Registry processes the following types of files.
Items Produced
The way that this Truxton ETL processes registry files is generic. It doesn't care what specific type of registry file is being exploited. It will produce the following types of items:
- ENTITY_TYPE_MAC_ADDRESS
- ENTITY_TYPE_MACHINE_GUID
- ENTITY_TYPE_MACHINE_NAME
- ENTITY_TYPE_PRODUCT_KEY
- ENTITY_TYPE_SERIAL_NUMBER
- ENTITY_TYPE_SSID
- ENTITY_TYPE_VOLUME_NAME
- ENTITY_TYPE_VOLUME_SERIAL_NUMBER
- ENTITY_TYPE_WAID
- EVENT_TYPE_CONNECTED_TO_NETWORK
- EVENT_TYPE_OPENED_A_FILE
- EVENT_TYPE_PASSWORD_CREATED
- EVENT_TYPE_PROGRAM_EXECUTED
- EVENT_TYPE_RDP_CONNECTION
- EVENT_TYPE_SHUTDOWN
- EVENT_TYPE_SOFTWARE_INSTALLED
- File - Type_Media_Snippet
- File - Type_Windows_Link
