Presented at
CactusCon 12 (2024),
Feb. 17, 2024, 3:30 p.m.
(60 minutes).
In Digital Forensics we use the registry hives to help paint the picture of what a threat actor may have done while in the network. These registry hives can tell us things like what documents were opened, what folders were traversed into and what files may have been opened or saved on the computer. Forensics has traditionally focused on a handful of registry hives. With the introduction of MSIX in Windows 10+, per application registry hives were introduced. These hives contain information that may not be located in the traditional hives that examiners have been looking at, and could contain valuable information not located in other places. In this presentation, I will walk through were to find these, what tools to use to work with them and why they be relevant to your investigations.
Presenters:
-
Mari DeGrazia
- ZeroFox, Director, Incident Response | SANS Instructor
Mari DeGrazia is Director of Incident Response at ZeroFox, which provides cyber security services on a global scale. Throughout her career, Mari has investigated high-profile breach cases, worked civil and criminal cases and provided testimony as an expert witness. She has written and released numerous programs/scripts to the forensics community; presented her research at industry conferences; and is a published author in several magazines. She is also a certified SANS instructor and holds several industry certifications in addition to earning a B.S. in Computer Science from Hawaii Pacific University. In her spare time she runs an e-sports league with a focus on getting women into competitive play.
Links:
Similar Presentations: