Difference between revisions of "Registry"
Jump to navigation
Jump to search
(Created page with "{| style="float:right;border:1px solid black" |+ Details | Executable | <code>Registry.exe</code> |- | Stage | style="text-align:center;" | 9 |- | Percent Complete | style="te...") |
|||
| (3 intermediate revisions by the same user not shown) | |||
| Line 11: | Line 11: | ||
|- | |- | ||
| Message Queue | | Message Queue | ||
| − | | <code>registry</code> | + | | style="text-align:center;" | <code>registry</code> |
|} | |} | ||
| Line 48: | Line 48: | ||
| [[Entity Table|Artifacts]] | | [[Entity Table|Artifacts]] | ||
|} | |} | ||
| + | |||
| + | |||
| + | =Items Produced= | ||
| + | The way that this Truxton ETL processes registry files is generic. | ||
| + | It doesn't care what specific type of registry file is being exploited. | ||
| + | It will produce the following types of items: | ||
| + | * [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]] | ||
| + | * [[Entity Types|ENTITY_TYPE_MACHINE_GUID]] | ||
| + | * [[Entity Types|ENTITY_TYPE_MACHINE_NAME]] | ||
| + | * [[Entity Types|ENTITY_TYPE_PRODUCT_KEY]] | ||
| + | * [[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]] | ||
| + | * [[Entity Types|ENTITY_TYPE_SSID]] | ||
| + | * [[Entity Types|ENTITY_TYPE_VOLUME_NAME]] | ||
| + | * [[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]] | ||
| + | * [[Entity Types|ENTITY_TYPE_WAID]] | ||
| + | * [[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] | ||
| + | * [[Event Types|EVENT_TYPE_OPENED_A_FILE]] | ||
| + | * [[Event Types|EVENT_TYPE_PASSWORD_CREATED]] | ||
| + | * [[Event Types|EVENT_TYPE_PROGRAM_EXECUTED]] | ||
| + | * [[Event Types|EVENT_TYPE_RDP_CONNECTION]] | ||
| + | * [[Event Types|EVENT_TYPE_SHUTDOWN]] | ||
| + | * [[Event Types|EVENT_TYPE_SOFTWARE_INSTALLED]] | ||
| + | * File - [[Type_Media_Snippet]] | ||
| + | * File - [[Type_Windows_Link]] | ||
Latest revision as of 14:13, 6 September 2025
| Executable | Registry.exe
|
| Stage | 9 |
| Percent Complete | 48% |
| Message Queue | registry
|
The Registry ETL is responsible for pulling information out of registry files.
File Types
Registry processes the following types of files.
Items Produced
The way that this Truxton ETL processes registry files is generic. It doesn't care what specific type of registry file is being exploited. It will produce the following types of items:
- ENTITY_TYPE_MAC_ADDRESS
- ENTITY_TYPE_MACHINE_GUID
- ENTITY_TYPE_MACHINE_NAME
- ENTITY_TYPE_PRODUCT_KEY
- ENTITY_TYPE_SERIAL_NUMBER
- ENTITY_TYPE_SSID
- ENTITY_TYPE_VOLUME_NAME
- ENTITY_TYPE_VOLUME_SERIAL_NUMBER
- ENTITY_TYPE_WAID
- EVENT_TYPE_CONNECTED_TO_NETWORK
- EVENT_TYPE_OPENED_A_FILE
- EVENT_TYPE_PASSWORD_CREATED
- EVENT_TYPE_PROGRAM_EXECUTED
- EVENT_TYPE_RDP_CONNECTION
- EVENT_TYPE_SHUTDOWN
- EVENT_TYPE_SOFTWARE_INSTALLED
- File - Type_Media_Snippet
- File - Type_Windows_Link
