Taking Registry Analysis to the Next Level - SANS Computer ...

More documents

Recommendations

Info

Trawling the Symantec Site http://www.symantec.com/security_response/threatexplorer/azlisting.jsp • All of the malware in alpha order by name • The "Technical Details" page has registry keys listed about 50% of the time o As determined by the presence of the string "HKEY" • 12,000+ writeups, 6100 with registry keys, 47,000+ keys Do they tell us anything new?
Trawling the Symantec Site
Page 1 and 2: Taking Registry Analysis to the Nex
Page 3 and 4: Malware Related Keys Run, RunOnce
Page 5 and 6: Malware Related Keys, cont. Applica
Page 7: Then how do you know they're useful
Page 11 and 12: Trawling the Symantec Site - HKCU N
Page 13 and 14: Trawling the Symantec Site - HKLM
Page 15 and 16: Keys to Keep Keep Downgrade Add •
Page 17 and 18: RegRipper • PERL program with EXE
Page 19 and 20: Registry Decoder - Plugins
Page 21 and 22: GRR - Look at a Registry Entry
Page 23 and 24: How do They Rate? Compare and contr
Page 25 and 26: Jean NPS GRR RegistryDecoder RegRip
Page 27 and 28: Tool Recap GRR Registry Decoder Reg
Page 29 and 30: Analysis at Scale
Page 31 and 32: Acknowledgments NPS and Simson Garf

Taking Registry Analysis to the Next Level - SANS Computer ...

Create successful ePaper yourself

Delete template?

Save as template?