dissect.target.plugins.os.windows.regf.runkeys
#
Module Contents#
Classes#
Plugin that iterates various Runkey locations. |
Attributes#
- dissect.target.plugins.os.windows.regf.runkeys.RunKeyRecord#
- class dissect.target.plugins.os.windows.regf.runkeys.RunKeysPlugin(target: dissect.target.Target)#
Bases:
dissect.target.plugin.Plugin
Plugin that iterates various Runkey locations.
- KEYS = ['HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run',...#
- check_compatible()#
Perform a compatibility check with the target.
This function should return
None
if the plugin is compatible with the current target (self.target
). For example, check if a certain file exists. Otherwise it should raise anUnsupportedPluginError
.- Raises:
UnsupportedPluginError – If the plugin could not be loaded.
- runkeys()#
Iterate various run key locations. See source for all locations.
Run keys (Run and RunOnce) are registry keys that make a program run when a user logs on. a Run key runs every time the user logs on and the RunOnce key makes the program run once and deletes the key after. Often leveraged as a persistence mechanism.
References
- Yields RunKeyRecords with fields:
hostname (string): The target hostname. domain (string): The target domain. ts (datetime): The registry key last modified timestamp. name (string): The run key name. path (string): The run key path. key (string): The source key for this run key.