Taking Registry Analysis to the Next Level - SANS Computer ...

13.07.2013 • Views

Share Embed Flag

Taking Registry Analysis to the Next Level - SANS Computer ...

Taking Registry Analysis to the Next Level - SANS Computer ...

DOWNLOAD ePAPER

computer.forensics.sans.org

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

START NOW

Trawling <strong>the</strong> Symantec Site - HKLM

Building, Maturing & Rocking a Security Operations Center - SANS ...

Sniper Forensics “One Shot, One Kill” - SANS Computer Forensics

exFAT History - SANS Computer Forensics

examples of recent apt persistence mechanisms - SANS Computer ...

Ovie Carroll - SANS Forensic Trends and Futures.pdf

Analysis & Correlation of Mac Logs - SANS

“ANN'S AURORA” - SANS Computer Forensics

Encryption v20.10 - SANS Computer Forensics

Tales from the Crypt - TrueCrypt Analysis - SANS

Digital Forensics for IaaS Cloud Computing - SANS Computer ...

Protecting Privileged Domain Accounts during Live Response

All the Gear..and No Idea.. - Scalable, fast - SANS

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

Mark McKinnon RedWolf Computer Forensics Mark ... - SANS

Trawling <strong>the</strong> Symantec Site - HKCR

Trawling <strong>the</strong> Symantec Site - HKLM

Page 1 and 2: Taking Registry Analysis to the Nex
Page 3 and 4: Malware Related Keys Run, RunOnce
Page 5 and 6: Malware Related Keys, cont. Applica
Page 7 and 8: Then how do you know they're useful
Page 9 and 10: Trawling the Symantec Site
Page 11: Trawling the Symantec Site - HKCU N
Page 15 and 16: Keys to Keep Keep Downgrade Add •
Page 17 and 18: RegRipper • PERL program with EXE
Page 19 and 20: Registry Decoder - Plugins
Page 21 and 22: GRR - Look at a Registry Entry
Page 23 and 24: How do They Rate? Compare and contr
Page 25 and 26: Jean NPS GRR RegistryDecoder RegRip
Page 27 and 28: Tool Recap GRR Registry Decoder Reg
Page 29 and 30: Analysis at Scale
Page 31 and 32: Acknowledgments NPS and Simson Garf