remove errant WinSCP entry, standardize UsrClass

EricZimmerman · Sep 7, 2024 · 73278da · 73278da
1 parent ce986df
commit 73278da
Showing 1 changed file with 1 addition and 8 deletions.
diff --git a/BatchExamples/DFIRBatch.reb b/BatchExamples/DFIRBatch.reb
@@ -2591,13 +2591,6 @@ Keys:
         KeyPath: Software\Martin Prikryl
         Recursive: true
         Comment: "WinSCP"
-    -
-        Description: WinSCP
-        HiveType: Other
-        Category: Third Party Applications
-        KeyPath: Software\Martin Prikryl
-        Recursive: true
-        Comment: "WinSCP"
     -
         Description: WinSCP
         HiveType: SOFTWARE
@@ -3579,7 +3572,7 @@ Keys:
 
     -
         Description: Exefile Shell Open Command
-        HiveType: usrclass
+        HiveType: UsrClass
         Category: Threat Hunting
         KeyPath: Exefile\Shell\Open\Command
         ValueName: (default)