Difference between revisions of "Registry"
Jump to navigation
Jump to search
| Line 57: | Line 57: | ||
* [[Entity Types|ENTITY_TYPE_MACHINE_GUID]] | * [[Entity Types|ENTITY_TYPE_MACHINE_GUID]] | ||
* [[Entity Types|ENTITY_TYPE_MACHINE_NAME]] | * [[Entity Types|ENTITY_TYPE_MACHINE_NAME]] | ||
| + | * [[Entity Types|ENTITY_TYPE_PRODUCT_KEY]] | ||
* [[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]] | * [[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]] | ||
* [[Entity Types|ENTITY_TYPE_SSID]] | * [[Entity Types|ENTITY_TYPE_SSID]] | ||
| Line 65: | Line 66: | ||
* [[Event Types|EVENT_TYPE_PASSWORD_CREATED]] | * [[Event Types|EVENT_TYPE_PASSWORD_CREATED]] | ||
* [[Event Types|EVENT_TYPE_PROGRAM_EXECUTED]] | * [[Event Types|EVENT_TYPE_PROGRAM_EXECUTED]] | ||
| + | * [[Event Types|EVENT_TYPE_RDP_CONNECTION]] | ||
* [[Event Types|EVENT_TYPE_SHUTDOWN]] | * [[Event Types|EVENT_TYPE_SHUTDOWN]] | ||
* [[Event Types|EVENT_TYPE_SOFTWARE_INSTALLED]] | * [[Event Types|EVENT_TYPE_SOFTWARE_INSTALLED]] | ||
| + | * File - [[Type_Windows_Link]] | ||
Revision as of 14:11, 6 September 2025
| Executable | Registry.exe
|
| Stage | 9 |
| Percent Complete | 48% |
| Message Queue | registry
|
The Registry ETL is responsible for pulling information out of registry files.
File Types
Registry processes the following types of files.
Items Produced
The way that this Truxton ETL processes registry files is generic. It doesn't care what specific type of registry file is being exploited. It will produce the following types of items:
- ENTITY_TYPE_MAC_ADDRESS
- ENTITY_TYPE_MACHINE_GUID
- ENTITY_TYPE_MACHINE_NAME
- ENTITY_TYPE_PRODUCT_KEY
- ENTITY_TYPE_SERIAL_NUMBER
- ENTITY_TYPE_SSID
- ENTITY_TYPE_VOLUME_NAME
- ENTITY_TYPE_VOLUME_SERIAL_NUMBER
- ENTITY_TYPE_WAID
- EVENT_TYPE_CONNECTED_TO_NETWORK
- EVENT_TYPE_PASSWORD_CREATED
- EVENT_TYPE_PROGRAM_EXECUTED
- EVENT_TYPE_RDP_CONNECTION
- EVENT_TYPE_SHUTDOWN
- EVENT_TYPE_SOFTWARE_INSTALLED
- File - Type_Windows_Link
