Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove errant WinSCP entry, standardize UsrClass #77

Merged
merged 1 commit into from
Sep 7, 2024
Merged

remove errant WinSCP entry, standardize UsrClass #77

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 1 addition & 8 deletions BatchExamples/DFIRBatch.reb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
Version: 2.06
Id: 2e1589f5-e31a-4bef-822f-075d56afdddd
Keys:
#

Check warning on line 6 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

6:1 [comments-indentation] comment not indented like content
# DFIRBatch README: https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/DFIRBatch.md
# => Add changelog in this readme after additions.
#
Expand Down Expand Up @@ -44,7 +44,7 @@
Recursive: false
Comment: "Displays the username of the last user logged in to this system"

# https://windowsir.blogspot.com/2013/04/plugin-winlogon.html

Check warning on line 47 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

47:1 [comments-indentation] comment not indented like content

-
Description: WinLogon
Expand All @@ -55,7 +55,7 @@
Recursive: false
Comment: "Displays the SID of the user who is set to auto login to Windows"

# https://windowsir.blogspot.com/2013/04/plugin-winlogon.html

Check warning on line 58 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

58:1 [comments-indentation] comment not indented like content

-
Description: WinLogon
Expand Down Expand Up @@ -130,7 +130,7 @@
Recursive: false
Comment: "Identifies the system volume where Windows booted from"

# https://www.microsoftpressstore.com/articles/article.aspx?p=2201310

Check warning on line 133 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

133:1 [comments-indentation] comment not indented like content
# https://stackoverflow.com/questions/15361617/retrieve-the-partition-number-of-bootmgr-on-windows-vista-and-later

-
Expand All @@ -142,7 +142,7 @@
Recursive: false
Comment: "Displays value for the current ControlSet"

# https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/

Check warning on line 145 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

145:1 [comments-indentation] comment not indented like content
# https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/

-
Expand All @@ -154,7 +154,7 @@
Recursive: false
Comment: "Displays value for the default ControlSet"

# https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/

Check warning on line 157 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

157:1 [comments-indentation] comment not indented like content
# https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/

-
Expand All @@ -166,7 +166,7 @@
Recursive: false
Comment: "Displays value for the ControlSet that was unable to boot Windows successfully"

# https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/

Check warning on line 169 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

169:1 [comments-indentation] comment not indented like content
# https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/

-
Expand All @@ -178,7 +178,7 @@
Recursive: false
Comment: "Displays value for the last known good ControlSet"

# https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/

Check warning on line 181 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

181:1 [comments-indentation] comment not indented like content
# https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/

-
Expand All @@ -192,7 +192,7 @@
BinaryConvert: FILETIME
Comment: "Last system shutdown time"

# https://www.winhelponline.com/blog/how-to-determine-the-last-shutdown-date-and-time-in-windows/

Check warning on line 195 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

195:1 [comments-indentation] comment not indented like content

-
Description: Windows OS Language
Expand All @@ -203,7 +203,7 @@
Recursive: false
Comment: "Default OS Language, 0409 is English"

# https://serverfault.com/questions/957167/windows-10-1809-region-language-registry-keys

Check warning on line 206 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

206:1 [comments-indentation] comment not indented like content
# https://www.itprotoday.com/windows-78/where-registry-language-setting-each-user-stored

-
Expand Down Expand Up @@ -2591,13 +2591,6 @@
KeyPath: Software\Martin Prikryl
Recursive: true
Comment: "WinSCP"
-
Description: WinSCP
HiveType: Other
Category: Third Party Applications
KeyPath: Software\Martin Prikryl
Recursive: true
Comment: "WinSCP"
-
Description: WinSCP
HiveType: SOFTWARE
Expand Down Expand Up @@ -3579,7 +3572,7 @@

-
Description: Exefile Shell Open Command
HiveType: usrclass
HiveType: UsrClass
Category: Threat Hunting
KeyPath: Exefile\Shell\Open\Command
ValueName: (default)
Expand Down