RegistryParse
This command uses the Registry Parse automation to extract critical forensics data from a registry file. The essential values are specified by the argument.
python · Windows Forensics
Details
| ID | RegistryParse |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
README
This command uses the Registry Parse automation to extract critical forensics data from a registry file. The essential values are specified by the argument.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | |
| Cortex XSOAR Version | 6.0.0 |
Used In
This script is used in the following playbooks and scripts.
- Registry Parse Data Analysis
Inputs
| Argument Name | Description |
|---|---|
| entryID | This entry ID for the reg file. |
| registryData | This argument allows the user to specify which of the following objects in the registry to parse. Default is “All”. |
| customRegistryPaths | A comma-separated list of registry paths to parse. Try to keep your searches as exact as possible, for example registry_path=`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList`. |
Outputs
| Path | Description | Type |
|---|---|---|
| RegistryForensicDataRaw.Type | The registry data type. “Custom” for custom registry path. | Unknown |
| RegistryForensicDataRaw.RegistryPath | The registry key path. | Unknown |
| RegistryForensicDataRaw.RegistryKey | The registry key. | Unknown |
| RegistryForensicDataRaw.RegistryValue | The registry value. | Unknown |
| RegistryForensicData.Users.Sid | User SID. | Unknown |
| RegistryForensicData.Users.Guid | User GUID. | Unknown |
| RegistryForensicData.LastLoggedOnUser | Last user to be logged in. | Unknown |
| RegistryForensicData.TimeZone | Registry ime zone. | Unknown |
| RegistryForensicData.Services.DisplayName | Registry service name. | Unknown |
args: - description: This entry ID for the reg file. name: entryID required: true - auto: PREDEFINED defaultValue: All description: This argument allows the user to specify which of the following objects in the registry to parse. Default is "All". name: registryData predefined: - All - None - Users - MachineStartup - UserStartup - MachineRunOnce - UserRunOnce - Services - DelayedServices - UserRecentApps - Timezone - Networks - USB - LastLoggedOnUser - description: A comma-separated list of registry paths to parse. Try to keep your searches as exact as possible, for example registry_path=`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList`. name: customRegistryPaths - description: defines the maximum number of records to return as table to the war-room. name: hrMaxResults defaultValue: "50" comment: "This command uses the Registry Parse automation to extract critical forensics data from a registry file. The essential values are specified by the argument. \n" commonfields: id: RegistryParse version: -1 dockerimage: demisto/python3:3.12.13.10116658 enabled: true name: RegistryParse outputs: - contextPath: RegistryForensicDataRaw.Type description: The registry data type. "Custom" for custom registry path. - contextPath: RegistryForensicDataRaw.RegistryPath description: The registry key path. - contextPath: RegistryForensicDataRaw.RegistryKey description: The registry key. - contextPath: RegistryForensicDataRaw.RegistryValue description: The registry value. - contextPath: RegistryForensicData.Users.Sid description: User SID. - contextPath: RegistryForensicData.Users.Guid description: User GUID. - contextPath: RegistryForensicData.LastLoggedOnUser description: Last user to be logged in. - contextPath: RegistryForensicData.TimeZone description: Registry ime zone. - contextPath: RegistryForensicData.Services.DisplayName description: Registry service name. runas: DBotWeakRole script: '' scripttarget: 0 subtype: python3 tags: [] type: python fromversion: 6.0.0 tests: - No tests (auto formatted)