Registry
The module matches registry accesses done by the sample
Fields
Field name |
Required |
Variables |
Regex |
Type |
---|---|---|---|---|
key |
True |
True |
True |
str |
action |
False |
False |
False |
enum[“read”, “create”, “delete”, “list”] |
value_name |
False |
True |
True |
str |
value_data |
False |
True |
True |
str |
Example
{
module: "Registry",
key: "HKEY_CURRENT_USER\\Keyboard Layout\\Preload",
value_name: "1",
value_data: 3,
}