Add Support for DEFAULT Registry Hive #67
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AndrewRathbun
approved these changes
Aug 31, 2024
|
Really good stuff. Love the documentation and efforts you've taken. Thank you! |
|
done and pushed |
6 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
RECmd does not process the DEFAULT Registry hive when using the -d option. As a result we cannot use it for the Batch Files currently when using KAPE. This adds support which will allow us to create rules for systemprofile. Below is an example of WinSCP being installed as the SYSTEM user and a rule using the DEFAULT Registry hive successfully with the changes.
Checklist:
Please replace every instance of
[ ]with[X]OR click on the checkboxes after you submit your PR- [X] I have generated a uniqueGUIDfor my Batch file(s)- [X] I have tested and validated the new Batch file(s) against test data and achieved the desired output- [X] I have placed the Batch file(s) within the.\RECmd\BatchExamplesdirectory- [X] I have set or updated the version of my Batch file(s)- [X] I have made an attempt to document the artifacts within the Batch file(s)- [X] I have consulted the Guide/Template to ensure my Map(s) follow the same formatThank you for your submission and for contributing to the DFIR community!