PS-Remote Get Registry

This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire and export the registry as forensic evidence for further analysis. The capture can be for the entire registry or for a specific hive or path.

Windows Forensics · 12 tasks · 5 inputs · 1 output

Details

ID	`PS-Remote Get Registry`
From Version	6.0.0
Tasks	12

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

AddEvidence
Set
Sleep
UnzipFile
IsIntegrationAvailable

Commands

ps-remote-download-file
ps-remote-export-registry

Playbook Inputs

Name	Description	Default Value	Required
Host	A single hostname or IP address from which to export the registry file. For example, testpc01.		Optional
RegistryHive	The registry hive/path to export. If no value is specified, the entire registry will be exported.	all	Optional
FilePath	The path on the hostname on which to create the registry file. The default path will be c:\registry.reg. If the AddHostNameToFile input is “true”, the file downloaded to XSOAR will contain the hostname.	c:\registry.reg	Optional
ZipRegistry	Specify “true” to zip the reg file before sending it to XSOAR.	true	Optional
AddHostNameToFile	Specify “true” for the downloaded filename to contain the hostname, or “false” to keep the filename as configured in the FilePath argument.	true	Optional

Playbook Outputs

Path	Description	Type
RegistryDetails	The registry file details.	string

Playbook Image

PS-Remote Get Registry

Inputs

Host — A single hostname or IP address from which to export the registry file. For example, testpc01.
RegistryHive — The registry hive/path to export. If no value is specified, the entire registry will be exported.
FilePath — The path on the hostname on which to create the registry file. The default path will be c:\registry.reg. If the AddHostNameToFile input is "true", the file downloaded to XSOAR will contain the hostname.
ZipRegistry — Specify "true" to zip the reg file before sending it to XSOAR.
AddHostNameToFile — Specify "true" for the downloaded filename to contain the hostname, or "false" to keep the filename as configured in the FilePath argument.

Outputs

RegistryDetails — The Registry file details.

Commands used

ps-remote-download-file ps-remote-export-registry setEntriesTags

Flowchart

Source

playbook-PS-Remote_Get_Registry.yml

Download History Raw

id: PS-Remote Get Registry
version: -1
name: PS-Remote Get Registry
description: This playbook leverages the Windows built-in PowerShell and WinRM capabilities
  to connect to a Windows host to acquire and export the registry as forensic evidence
  for further analysis. The capture can be for the entire registry or for a specific
  hive or path.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 66e0dc4d-1223-4668-8d35-35f645699e76
    type: start
    task:
      id: 66e0dc4d-1223-4668-8d35-35f645699e76
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: eee3be21-cdfb-49e3-8a6b-00ad537bada1
    type: condition
    task:
      id: eee3be21-cdfb-49e3-8a6b-00ad537bada1
      version: -1
      name: Is PowerShell Remoting enabled?
      description: Returns 'yes' if the integration brand is available. Otherwise, returns
        'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: PowerShell Remoting
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 33ae149a-7cfb-4323-8cd8-46ce2ea0a40d
    type: title
    task:
      id: 33ae149a-7cfb-4323-8cd8-46ce2ea0a40d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: ebb866b3-d6a5-41b6-8f84-f45aeeb7f7fe
    type: condition
    task:
      id: ebb866b3-d6a5-41b6-8f84-f45aeeb7f7fe
      version: -1
      name: Was a host specified?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Host
            iscontext: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 093c8c39-ca13-4c1a-8c35-24d95aae0eb6
    type: regular
    task:
      id: 093c8c39-ca13-4c1a-8c35-24d95aae0eb6
      version: -1
      name: PS-Remote export registry
      description: This command exports the specified registry of hive to a file.
      script: '|||ps-remote-export-registry'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      file_path:
        simple: ${inputs.FilePath}
      host:
        simple: ${inputs.Host}
      ip: {}
      reg_key_hive:
        simple: ${inputs.RegistryHive}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 95b830c0-15a0-4f95-83f0-ab00f0d0788d
    type: regular
    task:
      id: 95b830c0-15a0-4f95-83f0-ab00f0d0788d
      version: -1
      name: PS-Remote download file
      description: Download a file from the remote endpoint.
      script: '|||ps-remote-download-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      check_hash:
        simple: "true"
      host:
        simple: ${inputs.Host}
      host_prefix:
        simple: ${inputs.AddHostNameToFile}
      ip: {}
      path:
        simple: ${inputs.FilePath}
      zip_file:
        simple: ${inputs.ZipRegistry}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 71b144fb-c439-4e81-85fa-cd0fe8dce5f0
    type: condition
    task:
      id: 71b144fb-c439-4e81-85fa-cd0fe8dce5f0
      version: -1
      name: Was a registry file path specified?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FilePath
            iscontext: true
    view: |-
      {
        "position": {
          "x": 110,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 23d533b8-20a3-4a66-892c-88a0edb7347b
    type: regular
    task:
      id: 23d533b8-20a3-4a66-892c-88a0edb7347b
      version: -1
      name: Sleep
      description: Sleep for X seconds.
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      seconds:
        simple: "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 87ae39e1-4d19-4098-8b71-f398af90dbd1
    type: condition
    task:
      id: 87ae39e1-4d19-4098-8b71-f398af90dbd1
      version: -1
      name: Was file zipped?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ZipRegistry
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 3180f174-9786-4f3f-89bd-69299956c169
    type: regular
    task:
      id: 3180f174-9786-4f3f-89bd-69299956c169
      version: -1
      name: Unzip file
      description: Unzip a file using fileName or entryID to specify a file. Unzipped
        files will be loaded to the War Room and names will be put into the context.
      scriptName: UnzipFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      entryID:
        complex:
          root: File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: zip
          accessor: EntryID
      fileName: {}
      lastZipFileInWarroom: {}
      password: {}
      zipTool: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -340,
          "y": 1700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: d4e25d33-b379-435f-8b07-4116be9a39cb
    type: regular
    task:
      id: d4e25d33-b379-435f-8b07-4116be9a39cb
      version: -1
      name: Set registry file details
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: RegistryDetails
      stringify: {}
      value:
        complex:
          root: File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: reg
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 7bc93731-ece1-467a-8297-ccbea27db218
    type: regular
    task:
      id: 7bc93731-ece1-467a-8297-ccbea27db218
      version: -1
      name: Mark and tag registry
      description: commands.local.cmd.entriesTags.set
      tags:
      - Registry
      script: Builtin|||setEntriesTags
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      entryIDs:
        complex:
          root: File
          accessor: EntryID
          transformers:
          - operator: LastArrayElement
      entryTags:
        simple: Registry
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 2215,
        "width": 1170,
        "x": -340,
        "y": 90
      }
    }
  }
inputs:
- key: Host
  value: {}
  required: false
  description: A single hostname or IP address from which to export the registry file. For example, testpc01.
  playbookInputQuery: null
- key: RegistryHive
  value:
    simple: all
  required: false
  description: The registry hive/path to export. If no value is specified, the entire
    registry will be exported.
  playbookInputQuery: null
- key: FilePath
  value:
    simple: c:\registry.reg
  required: false
  description: |-
    The path on the hostname on which to create the registry file. The default path will be c:\registry.reg.
    If the AddHostNameToFile input is "true", the file downloaded to XSOAR will contain the hostname.
  playbookInputQuery: null
- key: ZipRegistry
  value:
    simple: "true"
  required: false
  description: Specify "true" to zip the reg file before sending it to XSOAR.
  playbookInputQuery: null
- key: AddHostNameToFile
  value:
    simple: "true"
  required: false
  description: Specify "true" for the downloaded filename to contain the hostname,
    or "false" to keep the filename as configured in the FilePath argument.
  playbookInputQuery: null
outputs:
- contextPath: RegistryDetails
  description: The Registry file details.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.0.0