Example: registry

• Inputs
• Profile
• Report outputs
  • Triage report (converted from triage_report.json)
  • CSV outputs
    • errors.csv
    • files.csv
    • pattern_matches.csv
    • signature_matches.csv
    • unique_files.csv

Inputs

• examples/inputs/registry-samples/registry_artifacts.txt
• examples/inputs/registry-samples/sample_ntuser.dat

Profile

# Windows Registry Parsing Example
# This demonstrates parsing real Windows Registry hive files
# The sample_ntuser.dat file contains a minimal valid registry hive structure
# Use --parse-registry CLI flag to parse the registry files

decode = []

tag = "registry"

# UserAssist patterns (ROT13 encoded program names)
[[patterns]]
  name = "UserAssist Entry"
  pattern = "HRZR_EHACNGU|HRZR_EHAPCY"
  type = "regex"

# ShimCache patterns
[[patterns]]
  name = "AppCompatCache"
  pattern = "AppCompatCache"
  type = "string"
  case-insensitive = true

# Amcache patterns
[[patterns]]
  name = "Amcache Reference"
  pattern = "Amcache\\.hve"
  type = "regex"
  case-insensitive = true

# Run key patterns
[[patterns]]
  name = "Run Key Path"
  pattern = "Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"
  type = "regex"
  case-insensitive = true

# USB device patterns
[[patterns]]
  name = "USB Device"
  pattern = "USBSTOR"
  type = "string"
  case-insensitive = true

# Recent documents
[[patterns]]
  name = "RecentDocs"
  pattern = "RecentDocs"
  type = "string"
  case-insensitive = true

# Network patterns
[[patterns]]
  name = "Network Profile"
  pattern = "NetworkList\\\\Profiles"
  type = "regex"
  case-insensitive = true

# Registry hive file header pattern (hex for "regf")
[[patterns]]
  name = "Registry Hive Header"
  pattern = "72:65:67:66"
  type = "bytes"

Report outputs

Triage report (converted from triage_report.json)

top_scores

CSV outputs

errors.csv

Empty CSV

files.csv

pattern_matches.csv

signature_matches.csv

Empty CSV

unique_files.csv