Difference between revisions of "Registry"
Jump to navigation
Jump to search
| Line 64: | Line 64: | ||
* [[Entity Types|ENTITY_TYPE_WAID]] | * [[Entity Types|ENTITY_TYPE_WAID]] | ||
* [[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] | * [[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]] | ||
| + | * [[Event Types|EVENT_TYPE_OPENED_A_FILE]] | ||
* [[Event Types|EVENT_TYPE_PASSWORD_CREATED]] | * [[Event Types|EVENT_TYPE_PASSWORD_CREATED]] | ||
* [[Event Types|EVENT_TYPE_PROGRAM_EXECUTED]] | * [[Event Types|EVENT_TYPE_PROGRAM_EXECUTED]] | ||
| Line 69: | Line 70: | ||
* [[Event Types|EVENT_TYPE_SHUTDOWN]] | * [[Event Types|EVENT_TYPE_SHUTDOWN]] | ||
* [[Event Types|EVENT_TYPE_SOFTWARE_INSTALLED]] | * [[Event Types|EVENT_TYPE_SOFTWARE_INSTALLED]] | ||
| + | * File - [[Type_Media_Snippet]] | ||
* File - [[Type_Windows_Link]] | * File - [[Type_Windows_Link]] | ||
Latest revision as of 14:13, 6 September 2025
| Executable | Registry.exe
|
| Stage | 9 |
| Percent Complete | 48% |
| Message Queue | registry
|
The Registry ETL is responsible for pulling information out of registry files.
File Types
Registry processes the following types of files.
Items Produced
The way that this Truxton ETL processes registry files is generic. It doesn't care what specific type of registry file is being exploited. It will produce the following types of items:
- ENTITY_TYPE_MAC_ADDRESS
- ENTITY_TYPE_MACHINE_GUID
- ENTITY_TYPE_MACHINE_NAME
- ENTITY_TYPE_PRODUCT_KEY
- ENTITY_TYPE_SERIAL_NUMBER
- ENTITY_TYPE_SSID
- ENTITY_TYPE_VOLUME_NAME
- ENTITY_TYPE_VOLUME_SERIAL_NUMBER
- ENTITY_TYPE_WAID
- EVENT_TYPE_CONNECTED_TO_NETWORK
- EVENT_TYPE_OPENED_A_FILE
- EVENT_TYPE_PASSWORD_CREATED
- EVENT_TYPE_PROGRAM_EXECUTED
- EVENT_TYPE_RDP_CONNECTION
- EVENT_TYPE_SHUTDOWN
- EVENT_TYPE_SOFTWARE_INSTALLED
- File - Type_Media_Snippet
- File - Type_Windows_Link
