theflakes/reg_hunter

Issues

• Add hunt for rlo char

  #28 opened 2 years ago by theflakes
  1

• Add trying to decode any possible base64 encode to then run hunts against

  #29 opened 2 years ago by theflakes
  0

• [Enhancement] Include option for output

  #27 opened 3 years ago by gs3cl
  1

• Add "--depth" option to limit recursing of reg keys

  #25 opened 4 years ago by theflakes
  0

• Update hunts' regex error output to specify which regex failed to compile

  #26 opened 4 years ago by theflakes
  0

• Add Json field to registry and file logs containing ACL entries

  #24 opened 4 years ago by theflakes
  0

• Registry key symbolic link detection doesn't work

  #11 opened 4 years ago by theflakes
  0

• Add ScheduledTask examination and collection

  #12 opened 4 years ago by theflakes
  0

• Add device primary ip to every log

  #13 opened 4 years ago by theflakes
  0

• Inspect files contents

  #14 opened 4 years ago by theflakes
  0

• Collect group membership and local account info

  #15 opened 4 years ago by theflakes
  0

• Add file owner information to "File" json logs

  #16 opened 4 years ago by theflakes
  0

• Add FN timestamps to file logs

  #17 opened 4 years ago by theflakes
  0

• Detect and report on alternate data streams

  #18 opened 4 years ago by theflakes
  0

• Examine WMI persistence

  #19 opened 4 years ago by theflakes
  0

• Examine and report on Bitsadmin jobs

  #20 opened 4 years ago by theflakes
  0

• Hunt and report files in more interesting directories

  #21 opened 4 years ago by theflakes
  0

• Report on Web Browser extensions for all web browsers.

  #22 opened 4 years ago by theflakes
  0

• Help develop WinReg crate further

  #23 opened 4 years ago by theflakes
  0

• Keep TCP conn open on network log comms

  #7 opened 4 years ago by theflakes
  0

• Unable to get null prefixed value name created by "RegHide.exe"

  #10 opened 4 years ago by theflakes
  1

• Custom hunt won't search REG_BINARY

  #8 opened 4 years ago by theflakes
  2

• When searching all the registry, complete key path is not being reported.

  #9 opened 4 years ago by theflakes
  0

• Mounted Image

  #3 opened 4 years ago by rocket-ops
  2

• Add time window options

  #6 opened 4 years ago by theflakes
  1

• 32 bit binary

  #5 opened 4 years ago by theflakes
  1

• Not understanding how to specify docopt cmd option requirements

  #4 opened 4 years ago by theflakes
  0

• Add an option for a custom regex search

  #2 opened 4 years ago by theflakes
  1

• Encoding regex needs work.

  #1 opened 4 years ago by theflakes
  1