mudocs
Repo ↗

Workshop · 4

Registry persistence

Before you can spot the entry that does not belong, you need to read a hive: its keys, their values, what was deleted and when things changed.

Written for Mutant v2.6.1. Every program and output on this page is that release’s own file.

Preview. This module is not published yet: it opens once every builtin it uses has cleared review at the pinned release.

beginner

Reading a hive

Open a hive model, walk its keys and values, and pull out deleted keys and the write timeline.

  1. Why the registry

    Current

    Windows keeps its configuration in the registry, a tree of keys. Each key holds named values and records when it was last written.

    Persistence lives there too. Before you can tell a planted entry from a normal one, you need to be able to read a hive and say what is in it.

  2. From power-on to the planted process

    Locked

    Finish or skip the stage above to open this one.

  3. What a hive holds

    Locked

    Finish or skip the stage above to open this one.

  4. Read it with Mutant

    Locked

    Finish or skip the stage above to open this one.

  5. Build it

    Locked

    Finish or skip the stage above to open this one.

  6. Check yourself

    Locked

    Finish or skip the stage above to open this one.

  7. Takeaways

    Locked

    Finish or skip the stage above to open this one.

  8. Run it yourself

    Locked

    Finish or skip the stage above to open this one.

intermediate

Run keys

What starts at logon, since when, and from where: Run and RunOnce in a user’s hive.

  1. What starts at logon

    Locked

    Finish or skip the stage above to open this one.

  2. Hunt them with Mutant

    Locked

    Finish or skip the stage above to open this one.

  3. Build the hunt

    Locked

    Finish or skip the stage above to open this one.

  4. Check yourself

    Locked

    Finish or skip the stage above to open this one.

  5. Run it yourself

    Locked

    Finish or skip the stage above to open this one.