Reader small image

You're reading from  PowerShell Automation and Scripting for Cybersecurity

Product typeBook
Published inAug 2023
PublisherPackt
ISBN-139781800566378
Edition1st Edition
Right arrow
Author (1)
Miriam C. Wiesner
Miriam C. Wiesner
author image
Miriam C. Wiesner

Miriam C. Wiesner is a senior security researcher at Microsoft, with over 15 years of experience in IT and IT security. She has held various positions, including administrator/system engineer, software developer, premier field engineer, program manager, security consultant, and pentester. She is also a renowned creator of open source tools based in PowerShell, including EventList and JEAnalyzer. She has been invited multiple times to present the research behind her tools at many international conferences, such as Black Hat (the US, Europe, and Asia), PSConfEU, and MITRE ATT&CK workshop. Outside of work, Miriam is a dedicated wife and mother, residing with her family near Nuremberg, Germany.
Read more about Miriam C. Wiesner

Right arrow

Getting familiar with the Windows Registry

The Windows Registry was introduced with Windows 3.1. Although back then, it primarily stored information for the COM-based components, it was developed over the years. Nowadays, it serves as the hierarchical database as we all know it – storing low-level configuration settings for the Windows operating system, as well as for applications running on it.

Although you can access the registry using multiple ways, we will concentrate in this section on how to access and operate the registry using PowerShell.

The Windows Registry of modern systems usually consists of five root keys. Each of them has their own purpose and contains different settings:

  • HKEY_CLASSES_ROOT (HKCR): Hives underneath this root key contain information about COM class registration information and file associations.
  • HKEY_CURRENT_USER (HKCU): Contains settings that are specific to the user that is currently logged on. Technically, this root key is just...
lock icon
The rest of the page is locked
Previous PageNext Page
You have been reading a chapter from
PowerShell Automation and Scripting for Cybersecurity
Published in: Aug 2023Publisher: PacktISBN-13: 9781800566378

Author (1)

author image
Miriam C. Wiesner

Miriam C. Wiesner is a senior security researcher at Microsoft, with over 15 years of experience in IT and IT security. She has held various positions, including administrator/system engineer, software developer, premier field engineer, program manager, security consultant, and pentester. She is also a renowned creator of open source tools based in PowerShell, including EventList and JEAnalyzer. She has been invited multiple times to present the research behind her tools at many international conferences, such as Black Hat (the US, Europe, and Asia), PSConfEU, and MITRE ATT&CK workshop. Outside of work, Miriam is a dedicated wife and mother, residing with her family near Nuremberg, Germany.
Read more about Miriam C. Wiesner