Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DEFAULT: Add artifacts for stored identities on a host #81

Closed
AndrewRathbun opened this issue Nov 25, 2024 · 1 comment · Fixed by #83
Closed

DEFAULT: Add artifacts for stored identities on a host #81

AndrewRathbun opened this issue Nov 25, 2024 · 1 comment · Fixed by #83
Assignees
@AndrewRathbun
Labels
enhancement

Comments

@AndrewRathbun
Copy link
Collaborator

Example:
default: Software\Microsoft\IdentityCRL\StoredIdentities\[email protected]\S-1-5-21-2501235465-2372679116-1501238901-1001

We could probably get away with doing a Recursive: true at StoredIdentities

StoredIdentities\*

Value Name
AccountsCount
AssociatedCount
CID
Keywords
LatestDPAPIKeyVersion
PUID

StoredIdentities\*\*

Value Name
AccountType
AgeGroup
CertHash
ChildFlags
ContainerName
Country
DefaultCredSaved
FamilyID
Flags
HasPassword
Keywords
LatestDPAPIKeyVersion
FirstName
LastName
DisplayName
@AndrewRathbun AndrewRathbun self-assigned this Nov 25, 2024
@AndrewRathbun AndrewRathbun mentioned this issue Nov 26, 2024
Merged
6 tasks
@AndrewRathbun
Copy link
Collaborator Author

Closed by #83

@AndrewRathbun AndrewRathbun linked a pull request Nov 26, 2024 that will close this issue
update DFIRBatch.reb to 2.07 - add various artifacts from DEFAULT hive #83
Merged
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@AndrewRathbun AndrewRathbun

Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

update DFIRBatch.reb to 2.07 - add various artifacts from DEFAULT hive AndrewRathbun/RECmd
1 participant
@AndrewRathbun