Taking Registry Analysis to the Next Level - SANS Computer ...

More documents

Recommendations

Info

Summary Judgement How can Registry Analysis help you find the badness on your systems? There are more keys to look at and research... But a few to probably not worry about If you aren't using RegRipper and Registry Decoder for your analysis -- start Normalizing your Run keys will help you know
Acknowledgments NPS and Simson Garfinkle for the Digital Corpora project and images: http://digitalcorpora.org/ The GRR Development Team! http://code.google.com/p/grr/ Harlan Carvey for RegRipper All the RegRipper plugin writters! http://regripper.wordpress.com/regripper/ http://code.google.com/p/winforensicaanalysis/downloads/list http://code.google.com/p/regripperplugins/ Digital Forensics Solutions for Registry Decoder Andrew Case and Vico Marziale http://www.digitalforensicssolutions.com/registrydecoder/
Page 1 and 2: Taking Registry Analysis to the Nex
Page 3 and 4: Malware Related Keys Run, RunOnce
Page 5 and 6: Malware Related Keys, cont. Applica
Page 7 and 8: Then how do you know they're useful
Page 9 and 10: Trawling the Symantec Site
Page 11 and 12: Trawling the Symantec Site - HKCU N
Page 13 and 14: Trawling the Symantec Site - HKLM
Page 15 and 16: Keys to Keep Keep Downgrade Add •
Page 17 and 18: RegRipper • PERL program with EXE
Page 19 and 20: Registry Decoder - Plugins
Page 21 and 22: GRR - Look at a Registry Entry
Page 23 and 24: How do They Rate? Compare and contr
Page 25 and 26: Jean NPS GRR RegistryDecoder RegRip
Page 27 and 28: Tool Recap GRR Registry Decoder Reg
Page 29: Analysis at Scale

Taking Registry Analysis to the Next Level - SANS Computer ...

Create successful ePaper yourself

Delete template?

Save as template?