Taking Registry Analysis to the Next Level - SANS Computer ...

More documents

Recommendations

Info

Trawling the Symantec Site - Compare 6360 SOFTWARE\Microsoft\Windows\CurrentVersion\Run 283 SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 2521 SYSTEM\CurrentControlSet\Services 7 SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shared Task Scheduler 365 SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 423 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogin 110 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogin\Notify 5 SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts 20 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs 3 SOFTWARE\Microsoft\Command Processor\Auto Run 0 SYSTEM\CurrentControlSet\Control\BootVerificationProgram 3 SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
Keys to Keep Keep Downgrade Add • Run • Services • WinLogon • Browser Helper Objects • AppInit_DLLs • BootVerification • Command Processor\Auto Run • BootExecute • Explorer\FileExts • Shared Task Scheduler • RunServices • RunOnce • Winlogin\Notify • VB and VBA Program Settings • Internet Settings\ Connections • Internet Settings\ Zones\* • ZoneMap\Domains • Classes\{CLSID}\In ProcServer32
Page 1 and 2: Taking Registry Analysis to the Nex
Page 3 and 4: Malware Related Keys Run, RunOnce
Page 5 and 6: Malware Related Keys, cont. Applica
Page 7 and 8: Then how do you know they're useful
Page 9 and 10: Trawling the Symantec Site
Page 11 and 12: Trawling the Symantec Site - HKCU N
Page 13: Trawling the Symantec Site - HKLM
Page 17 and 18: RegRipper • PERL program with EXE
Page 19 and 20: Registry Decoder - Plugins
Page 21 and 22: GRR - Look at a Registry Entry
Page 23 and 24: How do They Rate? Compare and contr
Page 25 and 26: Jean NPS GRR RegistryDecoder RegRip
Page 27 and 28: Tool Recap GRR Registry Decoder Reg
Page 29 and 30: Analysis at Scale
Page 31 and 32: Acknowledgments NPS and Simson Garf

Taking Registry Analysis to the Next Level - SANS Computer ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?