https://github.com/optiv/Registry-Recon

Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon
https://github.com/optiv/Registry-Recon

Last synced: 4 months ago
JSON representation

Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon

• Host: GitHub
• URL: https://github.com/optiv/Registry-Recon
• Owner: optiv
• License: mit
• Created: 2021-07-29T18:47:23.000Z (over 4 years ago)
• Default Branch: main
• Last Pushed: 2022-06-06T14:39:12.000Z (over 3 years ago)
• Last Synced: 2025-05-09T03:02:03.456Z (6 months ago)
• Size: 87.9 KB
• Stars: 326
• Watchers: 21
• Forks: 36
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: License.md

Awesome Lists containing this project

• awesome-hacking-lists - optiv/Registry-Recon - Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon (Others)

README

          
# Registry-Recon

Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon.

Author: Jess Hires

## Description

As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual tooling for this started getting flagged by EDR products, due to the use of Windows CLI commands. This aggressor script aims to solve that problem by only probing the system using native registry queries, no CLI commands.

## Setup

Simply load `reg.cna` into Cobalt Strike using the Script Manager. Then right-click on the beacon you want to run registry recon on, and choose `Registry` then `Recon`, or type `regenum` into the beacon console.

![Installation and Usage](/screenshots/installation-and-usage.png?raw=true "Installation and Usage")

![Sample Output 1](/screenshots/output1.png?raw=true "Sample Output 1")

![Sample Output 2](/screenshots/output2.png?raw=true "Sample Output 2")

## How does this work?

Primarily, using Cobalt Strike's `breg_query` and `breg_queryv` functions. Then, all beacon output is hijacked with `beacon_output`, looking for specific values. When a positive match is made, the output will be highlighted in the beacon output. Since there is no `beacon_output_reg` or something similar, like `beacon_output_ls` and `beacon_output_ps`, all output must be captured for parsing.

## What if my AV/EDR product isn't detected? / How can I help?

This is expected. We couldn't test for every AV/EDR solution, and we knew that many would be missing. You can help us out by submitting a GitHub issue including the following info:

* If this is a System/AV/EDR entry

* The name of the product

* Relevant registry entries that can be used to positively ID the product