PowerShell for Registry Analysis
Detailed Overview:
PowerShell for Registry Analysis
Modifying the registry can lead to significant system instability or data loss if not handled properly. Always back up your registry before making changes. For more information, refer to these Microsoft guidelines:
- [Windows Registry Advanced Users Guide](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users)
- [How to Backup and Restore the Registry](https://support.microsoft.com/en-us/topic/how-to-back-up-and-restore-the-registry-in-windows-855140ad-e318-2a13-2829-d428a2ab0692)
Registry Query Using PowerShell
The Windows Registry stores settings and options for both the operating system and installed software. You can use PowerShell to query and manipulate these registry keys.
Example 1: Query Programs in the Run Key
To list programs that are configured to run automatically upon login, use the following command:
```powershell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
```
Explanation:
- HKLM refers to HKEY_LOCAL_MACHINE, a registry hive containing system-wide settings.
- The Run key stores values for programs that run when the system starts or a user logs in.
Example 2: Query Programs in the RunOnce Key
This key stores values for programs that should only run once during the next startup.
```powershell
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
```
You can use the same command for HKCU (HKEY_CURRENT_USER) to inspect the Run and RunOnce registry keys for the current user:
```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```
The HKCU key specifically contains registry values for the currently logged-in user.
Registry Startup Keys
Autostart Extensibility Points (ASEPs) are used to define programs that execute at system startup or user login. They are commonly targeted by attackers to maintain persistence on a compromised system.
Here are the four main keys where startup processes are defined:
1. HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Programs listed here are executed at every system startup, for all users.
2. HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Programs listed here are executed only once, the next time the system starts.
3. HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Programs listed here are executed at every login for the current user.
4. HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Programs listed here are executed once at the next login of the current user.
Working with the PowerShell Registry Provider
PowerShell provides access to the Registry via a drive, allowing you to navigate registry keys just like file system directories. You can list, view, and modify registry keys with ease.
Example 3: Listing Items in the HKCU Hive
To explore the HKCU registry hive (HKEY_CURRENT_USER), use:
```powershell
Get-ChildItem HKCU:
```
This will display all the subkeys and values under HKEY_CURRENT_USER, with columns for Name (key names) and Property (registry values).
Example 4: Viewing Properties in Registry Keys
To view the properties (values) of a registry key, run:
```powershell
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```
This will show the programs set to run at startup for the current user.
Investigating and Removing Malicious Registry Keys
If you suspect that your system is infected, you can use PowerShell to look for and remove malicious entries from these registry keys.
Example 5: Checking for Malicious Programs
Use the following commands to examine both Run and RunOnce keys for unusual entries (e.g., a suspicious program named Calcache):
```powershell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```
If you find Calcache or another suspicious entry, the next step is to remove it.
Example 6: Removing a Malicious Registry Entry
To remove the Calcache entry from the Run registry key:
```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Calcache"
```
Running this command will remove the registry value associated with the malicious program.
Example 7: Verifying Removal
After removal, you can verify that the entry no longer exists by attempting to retrieve it:
```powershell
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\Calcache"
```
This will return an error if the entry no longer exists, confirming it was successfully removed.
PowerShell Commands for Registry Management
Here are some additional PowerShell commands for working with the Registry:
List all registry items under a specific key:
```powershell
Get-ChildItem -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```
Get detailed properties of a specific registry key:
```powershell
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
```
Add a new registry value:
```powershell
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "NewProgram" -Value "C:\Program Files\NewProgram.exe"
```
Remove a registry value:
```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "NewProgram"
```
Create a new registry key:
```powershell
New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion" -Name "NewKey"
```
Additional Resources
For more information on persistence techniques and autostart registry keys, refer to the MITRE ATT&CK framework:
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
This page provides details on the attack technique of manipulating startup keys in the Windows Registry to maintain persistence on a system.
Comments