07 · Persistence
Hunting Windows Persistence: Registry, Tasks, WMI and More
Find attacker persistence on Windows: Run keys, services, scheduled tasks, WMI, Winlogon, IFEO, COM hijacking and BITS, mapped to MITRE ATT&CK, with tools.
Articles tagged: #registry
02 · Registry
Windows Registry Forensics: Hives, Keys and Workflow
Windows registry forensics in practice: hive files, transaction logs, control sets, LastWrite limits, deleted keys, the keys that matter and RECmd workflows.