PS-Remote Get Registry
This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire and export the registry as forensic evidence for further analysis. The capture can be for the entire registry or for a specific hive or path.
Windows Forensics · 12 tasks · 5 inputs · 1 output
Inputs
Host— A single hostname or IP address from which to export the registry file. For example, testpc01.RegistryHive— The registry hive/path to export. If no value is specified, the entire registry will be exported.FilePath— The path on the hostname on which to create the registry file. The default path will be c:\registry.reg. If the AddHostNameToFile input is "true", the file downloaded to XSOAR will contain the hostname.ZipRegistry— Specify "true" to zip the reg file before sending it to XSOAR.AddHostNameToFile— Specify "true" for the downloaded filename to contain the hostname, or "false" to keep the filename as configured in the FilePath argument.
Outputs
RegistryDetails— The Registry file details.
Commands used
ps-remote-download-file
ps-remote-export-registry
setEntriesTags