Skip to content

Unable to open key created with Sysinternals reghide.exe #40

@theflakes

Description

@theflakes

Registry malicious trickery and Reghide.exe: https://www.tripwire.com/state-of-security/mitre-framework/evade-detection-hiding-registry/

Key is created here on x64 Windows: HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\WOW6432Node\Systems Internals\Can’t touch me!

I can use error catching with a match statement to find this evil but would love to be able to open that and keys like it and read all values.

If I can help in any way with this crate I would love to. Just have never worked with crates and Rust Win API access directly either.

Thanks

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions