Hello, everyone.
My name is Shoaib Arshad,
and today we will look at this treasure box of information called
Windows Registry using a very popular tool,
RegRipper.
RegRipper was developed by Harlan Carvey
specifically for Windows Registry analysis.
It is a completely open‑source tool that can be used for extracting,
correlating,
and displaying specific information from the Windows Registry by
running a set of plugins against a registry hive in order to
extract data from the registry keys.
And I would like to take this opportunity to thank Harlan
Carvey on behalf of the whole DFIR community.
Thank you, Harlan.
RegRipper has been written in Perl,
and it is the fastest and easiest tool to get actionable
intelligence from the Windows Registry during an incident.
You can download RegRipper from github.com/keydet89.
So what makes RegRipper really special is the plugins‑based modular approach.
Harlan and some other contributors have created a really
huge set of plugins for RegRipper,
and each plugin has been carefully written to get specific
information from specific registry keys.
Using the right plugin really depends on what type
of analysis you are performing, as different plugins serve different purposes.
Some plugins will only fetch the data from a particular registry key,
while some other plugins are capable of analyzing the
data and even producing alerts for you.
Many new analysts have the misconception that RegRipper is a registry viewer,
which it is not.
You cannot just open a registry hive in RegRipper to look around.
Windows Registry is extremely huge, but with the help of RegRipper plugins,
you can extract only the required information from the Windows Registry.
And when it comes to red team versus blue team,
the primary goal for these exercises should be to make the blue team more
effective by improving the detection and response process.
So having a fast and effective tool like RegRipper will definitely give you
an upper hand in detecting attacks from the red team.
Now, if we look at the NIST Cybersecurity Framework,
which is made out of five functions,
we could say that RegRipper is mostly linked to two of them,
detect and respond.
So when you are on the blue team side,
you must have the right tools to detect and respond to an attack.
And RegRipper will help you detect these anomalies in the Windows Registry.
It also proves to be very useful in the respond function when you're
performing forensic analysis to find the root cause of an incident.
So if we look at detect,
RegRipper fits perfectly in the first category of anomalies and events.
And, more specifically, DE.AE‑2,
detected events are analyzed to understand attack targets and methods,
and DE.AE‑3 event data are collected and correlated
from multiple sources and sensors.
The next function in NIST is respond,
and RegRipper proves to be extremely useful in the analysis part.
More specifically in RS.AN‑3, forensics are performed.
Now let's look at the MITRE ATT&CK framework from a blue team perspective.
As you know,
the whole purpose of red teaming and mapping TTPs using my MITRE
ATT&CK is to make the blue team more effective.
So as a blue team,
these are the data analysis types that we can come up
from the MITRE ATT&CK framework.
And RegRipper will help us perform a specific type of analysis,
which is OS analysis, and it helps us detect attacks from the techniques,
T1543, create or modify system process, T1547,
boot or logon autostart execution, T1052,
exfiltration over physical medium.
And some of the sub‑techniques that can be detected are Windows service,
Registry run keys, and exfiltration over USB.
RegRipper itself is portable and pretty easy to use.
You can use it on either a Windows system or even on a Linux box.
First of all, you need the data, which is the registry hive files.
These registry hives will be from the system that you want to analyze.
It can be a Windows‑based end‑user machine or even a
Windows server from your environment.
Basically, any system that is running Windows OS can be analyzed with RegRipper.
And the part where you actually acquire Windows Registry hives is
not covered by this tool or in this course.
Basically, there are two ways to acquire the registry hive files,
one to physically image the system hard drive using a tool like FTK Imager,
or do a remote acquisition on your network using a tool
like F‑Response or Mount Image Pro.
The role of RegRipper begins when you have the
registry hives ready for analysis.
Windows Registry is more than just configuration settings,
and surprisingly,
many new analysts are not fully aware of the role Windows
Registry plays during an investigation, from malware infection cases,
to APTs, or even data theft cases.
So before we go ahead with RegRipper, let's do a quick recap of Windows Registry.
Microsoft defines the Windows Registry as a hierarchical database,
and it contains Windows OS configuration settings,
details for software programs, hardware devices,
user preferences, and more.
And all of this information is saved in files that are called Registry hives,
which are saved in different locations on the system.
So when you are using a live system,
you can access the Windows Registry using the Regedit utility.
But since this is not a live analysis,
we will use RegRipper to perform analysis on the Windows Registry.