New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unable to open key created with Sysinternals reghide.exe #40

Open

theflakes opened this issue Dec 6, 2020 · 0 comments

theflakes commented Dec 6, 2020

Registry malicious trickery and Reghide.exe: https://www.tripwire.com/state-of-security/mitre-framework/evade-detection-hiding-registry/

Key is created here on x64 Windows: HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\WOW6432Node\Systems Internals\Can’t touch me!

I can use error catching with a match statement to find this evil but would love to be able to open that and keys like it and read all values.

If I can help in any way with this crate I would love to. Just have never worked with crates and Rust Win API access directly either.

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment