windows-registry-analysis

What problem does it solve?

This Skill enables comprehensive small-to-large scale registry triage on Windows images by executing Velociraptor's Registry.Hunter artifact, streamlining the process of forensic analysis.

Core Features & Use Cases

• Broad Registry Triage: Run Velociraptor's Registry.Hunter with specific parameters to target multiple registry categories efficiently.
• Targeted Investigations: Split collection waves by registry category to focus on relevant areas like installed software, user accounts, or system info.
• Use Case: For incident response, quickly gather registry data from remote systems to identify anomalies such as unauthorized software or suspicious user accounts.

Quick Start

Confirm the Velociraptor server is set up locally, verify the target system is online, then run Registry.Hunter with RemappingStrategy set to None to obtain registry details.