System, Users and Network Information
Key Registry Artifacts for Forensic Analysis
The Windows Registry contains critical artifacts that can provide invaluable insights during forensic investigations. Below is a detailed breakdown of essential registry hives, key paths, and their forensic applications.
1. User Information
Registry Hive: SAM
Key Path:
SAM\Domains\Account\Users
Details:
Active Users: Lists all currently active user accounts on the system.
Deleted Accounts: Tracks previously deleted accounts, which could indicate attacker activity.
Names Subkey: Links usernames with their corresponding SIDs.
Use Case:
Identify Unauthorized Users: Detect accounts created by attackers to maintain persistence.
Track Deleted Accounts: Investigate potential insider threats or compromised accounts that were deleted to cover tracks.
2. System Information
Registry Hives: SYSTEM and SOFTWARE
Key Paths:
Control Sets:
SYSTEM\ControlSet001(Current configuration)SYSTEM\ControlSet002(Last known good configuration)SYSTEM\CurrentControlSet(Live configuration visible in Regedit)
Operating System Details:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Details:
Control Sets: Compare configurations across different control sets to troubleshoot system failures or analyze configuration changes.
OS Information: Provides details such as OS version, build number, and system architecture.
Use Case:
Troubleshooting Failures: Compare configurations to understand what might have caused system failures or misconfigurations.
Vulnerability Assessment: Determine the OS version and architecture to identify potential vulnerabilities or targeted exploits.
3. Network Information
Registry Hives: SYSTEM and SOFTWARE
Key Paths:
Network Connections:
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkListTracks connected networks:
SSID
Connection Type
First/Last Connection Timestamps
Router MAC Address
Open Network Shares:
SYSTEM\CurrentControlSet\Services\LanmanServer\SharesLists all shared folders accessible over the network.
TCP/IP Configuration and Interfaces:
SYSTEM\CurrentControlSet\Services\Tcpip\ParametersSYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
Details:
Network History: Provides insights into Wi-Fi networks the system has connected to.
Shared Folders: Identifies shared folders that might have been used for lateral movement or data exfiltration.
Network Configuration: Retrieves IP addresses, DNS configurations, and active interfaces.
Use Case:
Unauthorized Connections: Track connections to suspicious or unauthorized networks.
Lateral Movement Analysis: Investigate shared resources that might have been exploited by attackers.
Network Misconfigurations: Review current network settings to identify vulnerabilities or improperly secured interfaces.
Practical Forensic Applications
These registry artifacts can help investigators:
Trace Unauthorized Users: Pinpoint unauthorized accounts or deleted profiles indicative of malicious activity.
Analyze Network Connectivity: Investigate whether the system connected to known malicious networks or rogue access points.
Investigate Lateral Movement: Examine shared folders and network activity logs for evidence of data exfiltration or attacker movement.
Identify Misconfigurations: Spot vulnerabilities in system or network settings that could have been exploited.
Next Steps
In the next lessons, we'll explore using tools like Registry Explorer and RegRipper to automate the analysis of these key registry artifacts, streamlining the forensic investigation process.
Last updated