๐ REGISTRY
๐ช Intermediate
๐ What You'll Learn Here
Scanning Windows Registry hives for persistence mechanisms, malware configurations, and forensic artifacts.
Learning Outline
- 1. Registry Hive Extraction โ Exporting SAM, SYSTEM, SOFTWARE, NTUSER.DAT
- 2. Registry File Format โ Understanding registry binary structure
- 3. Persistence Detection โ Run keys, Winlogon, services, scheduled tasks
- 4. Malware Configuration โ Extracting C2 servers from registry keys
- 5. Forensic Timelines โ LastWrite times, transaction logs
- 6. Tools Integration โ `regripper`, `recmd`, `RegistryExplorer`
- 7. YARA for Registry โ Converting hive exports to text or scanning raw hive files
๐ ๏ธ REGISTRY BROWSER (Coming Soon)
Upload and scan registry hive files.
Upload and scan registry hive files.