คำสั่งรีจิสทรี¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry <COMMAND> [OPTIONS]
Commands:
amcache Parse Amcache inventories
app-compat Parse application compatibility data
app-history Parse third-party tools' traces
auditpol Parse the audit policy
bam Parse BAM and DAM last runs
bcd Parse boot configuration
feature-usage Parse Explorer use counts and pins
help Print this message or the help of the given subcommand(s)
installed-programs Parse installed programs
lsa-secrets Parse LSA secrets' names and times
mru Parse most-recently-used lists
muicache Parse MuiCache program names
networks Parse network profiles, interfaces, shares, port proxies and routes
office Parse Office recent files, trusted documents and macro settings
open-save-mru Parse Open and Save As dialog history
persistence Parse autostart locations
read Read keys and values
recent-docs Parse recent documents
remote-access Parse outbound RDP, PuTTY, WinSCP and mapped drive connections
sam Parse local accounts
security-settings Parse security settings: Defender, UAC, credentials, RDP, firewall, logging
services Parse services
shell-bags Parse ShellBags (folders opened in Explorer)
shimcache Parse ShimCache entries
system-info Parse system information
taskcache Parse scheduled tasks
usb Parse USB devices and volumes
user-assist Parse UserAssist entries
Options:
-h, --help Print help
คำสั่งมาตรฐาน (canonical) คือ app-compat, feature-usage, open-save-mru, recent-docs,
user-assist และ shell-bags ชื่อเดิมของคำสั่งเหล่านี้ (appcompat, featureusage,
opensavemru, recentdocs, userassist และ shellbags) ยังคงใช้ได้ในฐานะ alias ที่ซ่อนไว้
เพื่อรองรับสคริปต์ที่มีอยู่ การวิเคราะห์อัตโนมัติใช้ชื่อมาตรฐาน ส่วนตัวระบุอาร์ติแฟกต์
สคีมาของผลลัพธ์ และชื่อไฟล์เอาต์พุตไม่มีการเปลี่ยนแปลง
คำสั่งรีจิสทรีรับ -f <HIVE> หรือ -d <COLLECTION> และตัวเลือกเอาต์พุตแบบมีโครงสร้าง
amcache เล่นซ้ำ transaction log ของ Amcache ที่อยู่ข้างเคียงโดยอัตโนมัติเมื่อไฮฟ์อยู่ในสถานะ dirty แต่ไม่มีตัวเลือกสำหรับระบุ log หรือข้ามการเล่นซ้ำ ส่วน shimcache
เล่นซ้ำ log ของ SYSTEM ที่อยู่ข้างเคียงตามค่าเริ่มต้น และยังรับค่า AppCompatCache ดิบที่ส่งออกมาได้ด้วย
คำสั่งรีจิสทรีอื่น ๆ เล่นซ้ำ log ที่อยู่ข้างเคียงโดยอัตโนมัติ ให้ใช้ --log1 / --log2 เพื่อระบุ
log อย่างชัดเจน หรือ --no-logs เพื่อตรวจดูไฮฟ์หลักโดยไม่เล่นซ้ำ
parse-registry amcache¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry amcache <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for Amcache hives (Amcache.hve)
-f, --file <FILE> File path to one Amcache.hve
Records:
--files Include every inventoried executable (InventoryApplicationFile)
--devices Include every inventoried PnP device (InventoryDevicePnp)
-a, --all Include executables and devices (default for -o and for json, jsonl, csv)
Output:
-o, --output <PATH> Save the results to a file (text, json, jsonl) or a directory (csv)
-t, --output-type <TYPE> Output type: csv (default with -o), json, jsonl, text (default on the terminal)
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
juntei parse-registry amcache -f Amcache.hve --files
juntei parse-registry amcache -d evidence/ -o amcache-csv
juntei parse-registry amcache -f Amcache.hve -t jsonl | jq 'select(.RecordType == "file")'
ดู Amcache
parse-registry bam¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry bam <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM hives
-f, --file <FILE> File path to one SYSTEM hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--all-control-sets Every control set (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
ชื่อผู้ใช้ได้มาจาก SAM และ SOFTWARE (ProfileList) ของระบบ ซึ่งค้นหาในลักษณะเดียวกับโฮสต์
ดู BAM / DAM
parse-registry installed-programs¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry installed-programs <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE and NTUSER.DAT hives
-f, --file <FILE> File path to one SOFTWARE or NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
รายการ Uninstall ผลิตภัณฑ์ของ Windows Installer, App Paths, ดิสทริบิวชัน WSL และแอปแบบแพ็กเกจ
ผู้ใช้ของไฮฟ์ผู้ใช้ได้มาจากโฟลเดอร์โปรไฟล์และ ProfileList ของระบบ ดู
โปรแกรมที่ติดตั้ง
parse-registry muicache¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry muicache <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for UsrClass.dat and NTUSER.DAT hives
-f, --file <FILE> File path to one UsrClass.dat (Windows Vista and later) or NTUSER.DAT (Windows XP) hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
ชื่อผู้ใช้ได้มาจากตำแหน่งของไฮฟ์ในข้อมูลที่เก็บรวบรวม และ SID ได้มาจากคีย์รากของ UsrClass.dat
หรือ SOFTWARE (ProfileList) ของระบบ ดู MuiCache
parse-registry open-save-mru¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry open-save-mru <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
--code-page <CP> Code page of shell item names that aren't Unicode (8.3 names, network shares): the system's ANSI code page (932 for Japanese) [default: 1252]
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
รายการ shell item แต่ละรายการถูกถอดรหัสด้วย ys-lnk-parser และนำมาต่อกันเป็นพาธ ดู กล่องโต้ตอบเปิดและบันทึกเป็น
parse-registry remote-access¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry remote-access <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
SID ของผู้ใช้ได้มาจาก SOFTWARE (ProfileList) ของระบบ ซึ่งค้นหาในลักษณะเดียวกับโฮสต์ รหัสผ่าน
ที่จัดเก็บไว้จะรายงานเพียงว่ามีอยู่ และไม่มีการถอดรหัสเลย ดู
การเข้าถึงระยะไกล (ฝั่งผู้ใช้)
parse-registry system-info¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry system-info <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM, SOFTWARE, SAM and SECURITY hives (those in one directory are one system's)
-f, --file <FILE> File path to a SYSTEM, SOFTWARE, SAM or SECURITY hive of one system; repeat for each (the others are looked for next to them)
--no-logs Read dirty hives as they are, without their transaction logs (default: <hive>.LOG, .LOG1 and .LOG2 next to each are replayed)
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
หนึ่งระเบียนต่อหนึ่งระบบ: ชื่อ โดเมนหรือเวิร์กกรุ๊ป เวอร์ชันและวันที่ติดตั้ง Windows เขต
เวลา การปิดเครื่องครั้งล่าสุด ผู้ใช้ล่าสุด โปรไฟล์ และ SID ไฮฟ์ในไดเรกทอรีเดียวกันถือเป็นของระบบเดียว
เมื่อใช้ -f จะใช้ไฮฟ์ที่ระบุ และไฮฟ์อื่นในสี่ไฮฟ์ที่พบอยู่ข้างเคียง
ดู ข้อมูลระบบ
parse-registry mru¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry mru <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--list <LISTS> Only these lists (comma separated): runmru, typedpaths, wordwheelquery, typedurls, paint, wordpad, acmru
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
ดู รายการ MRU
parse-registry app-history¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry app-history <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
ประวัติของเครื่องมือ Sysinternals, WinRAR, 7-Zip และ WinZip บัญชี OneDrive ไฟล์ล่าสุดของ Adobe TeamViewer และ CCleaner ดู ประวัติแอปพลิเคชัน
parse-registry feature-usage¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry feature-usage <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
อ่าน FeatureUsage, RecentApps, Taskband และ ProgramsCache ดู
FeatureUsage, RecentApps และรายการที่ปักหมุดบนแถบงาน
parse-registry security-settings¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry security-settings <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE, SYSTEM and NTUSER.DAT hives
-f, --file <FILE> File path to one SOFTWARE, SYSTEM or NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--all-control-sets Every control set of a SYSTEM hive (ControlSet001, ControlSet002, ...), not only the one Windows used last
--weakened-only Only settings whose value weakens what Windows does by default
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
การตั้งค่าแต่ละรายการที่พบเป็นหนึ่งระเบียน พร้อมค่า ความหมาย และค่านั้นลดระดับสิ่งที่ Windows
ทำตามค่าเริ่มต้นหรือไม่ --weakened-only จะเก็บเฉพาะรายการที่ลดระดับ ดู
การตั้งค่าความปลอดภัย
parse-registry office¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry office <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
ตัวอย่าง¶
juntei parse-registry services -f SYSTEM -o services.csv
juntei parse-registry services -f SYSTEM --service ExampleSvc -t jsonl
juntei parse-registry recent-docs -f NTUSER.DAT -o recentdocs.csv
juntei parse-registry office -d collection/ -o office.csv
juntei parse-registry taskcache -f SOFTWARE --task ScheduledDefrag -t jsonl
juntei parse-registry sam -f SAM --rid 500 -t jsonl
juntei parse-registry persistence -d collection/ -o persistence.csv
juntei parse-registry user-assist -d collection/ -o userassist.csv
ตัวเลือกทั้งหมดและความหมายของฟิลด์อยู่ในหน้า ไฮฟ์รีจิสทรี, บริการ Windows, RecentDocs, Microsoft Office, แคช Task Scheduler, บัญชีภายในเครื่อง SAM, การเริ่มอัตโนมัติผ่านรีจิสทรี และ UserAssist
parse-registry auditpol¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry auditpol <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SECURITY hives
-f, --file <FILE> File path to one SECURITY hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
หนึ่งระเบียนต่อหนึ่งหมวดหมู่ย่อย (Windows Vista ขึ้นไป) หรือหมวดหมู่ (XP และ 2003) ของนโยบาย
การตรวจสอบใน Policy\PolAdtEv: สิ่งที่บันทึก GUID และ message ID และเหตุการณ์หลัก ดู
นโยบายการตรวจสอบ
parse-registry app-compat¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry app-compat <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE and NTUSER.DAT hives
-f, --file <FILE> File path to one SOFTWARE or NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
compatibility layer, Store และ Persisted ของ Program Compatibility Assistant, CIT และฐานข้อมูล shim
แบบกำหนดเอง ShimCache เป็นหน้าที่ของ parse-registry shimcache ดู
ความเข้ากันได้ของแอปพลิเคชัน
parse-registry bcd¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry bcd <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for BCD hives (and BCD-Template)
-f, --file <FILE> File path to one BCD hive (\Boot\BCD, \EFI\Microsoft\Boot\BCD)
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
หนึ่งระเบียนต่อหนึ่งออบเจ็กต์ของ store พร้อม test signing การตรวจสอบความสมบูรณ์ การกู้คืน นโยบาย boot status และ safe mode ที่ระบุค่าผ่านการสืบทอดแล้ว ดู การกำหนดค่าบูต (BCD)
parse-registry lsa-secrets¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry lsa-secrets <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SECURITY hives
-f, --file <FILE> File path to one SECURITY hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
หนึ่งระเบียนต่อหนึ่งความลับ LSA (Policy\Secrets\<name>) พร้อมประเภท บริการหรือผู้ใช้ที่
ระบุ เวลาที่ตั้งค่า และค่ามีข้อมูลหรือไม่ และอีกหนึ่งระเบียนสำหรับการเข้าสู่ระบบที่แคชไว้
(Cache) อ่านเฉพาะชื่อและเวลา: ไม่มีการถอดรหัสใด ๆ ดู ความลับ LSA
parse-registry networks¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry networks <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE and SYSTEM hives
-f, --file <FILE> File path to one SOFTWARE or SYSTEM hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--all-control-sets Every control set of a SYSTEM hive (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
เวลาของโปรไฟล์จะถูกแปลงเป็น UTC ด้วยเขตเวลาจากไฮฟ์ SYSTEM ของระบบ ซึ่งค้นหาในลักษณะเดียวกับ
โฮสต์ และยังคงเก็บค่าตามที่พบไว้ด้วย ดู เครือข่าย
parse-registry persistence¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry persistence <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE, SYSTEM, NTUSER.DAT and UsrClass.dat hives
-f, --file <FILE> File path to one SOFTWARE, SYSTEM, NTUSER.DAT or UsrClass.dat hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--all-control-sets Every control set of a SYSTEM hive (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry read¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry read <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for registry hives (every file that is one, logs aside)
-f, --file <FILE> File path to one registry hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
-k, --key <PATH> Only the key at this path (in any case; ex: Microsoft\Windows\CurrentVersion\Run). It may start with HKLM\ and the hive's name, and CurrentControlSet is the control set Windows used last
--key-regex <REGEX> Only keys whose path matches REGEX (ignoring case)
--value <NAME> Only the value named NAME (in any case; "" is the key's default value). With --key or --key-regex, a key without it gives an absent_value record
--value-regex <REGEX> Only values whose name matches REGEX (ignoring case; the default value's name is empty)
--data-regex <REGEX> Only values whose data, as written, matches REGEX (ignoring case, so a GUID matches in any case; binary data in hex)
--timeline-start <DATE> Only keys last written on or after DATE, in UTC unless an offset is given (ex: 2025-10-19, 2025-10-19T13:45:30Z)
--timeline-end <DATE> Only keys last written on or before DATE
--recover-deleted Also deleted keys and values: in free cells, the slack of cells in use and the data past the hive bins, and what only the transaction logs kept (allocation_status says how complete; recovered_from where found)
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
--raw-data Write every value's bytes in hex (value_data_raw), not only those that don't decode as their type
--qword-as-filetime Also write REG_QWORD values as FILETIMEs (value_filetime_utc), keeping the number (value_data, value_u64)
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
juntei parse-registry read -f SYSTEM --key 'CurrentControlSet\Services' -o services-raw.csv
juntei parse-registry read -f NTUSER.DAT --recover-deleted -t jsonl | jq .
parse-registry recent-docs¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry recent-docs <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry sam¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry sam <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SAM hives
-f, --file <FILE> File path to one SAM hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--rid <RID> Only the account with this RID (ex: 500, the built-in Administrator)
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry services¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry services <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM hives
-f, --file <FILE> File path to one SYSTEM hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--service <NAME> Only the service of this name (its key's name, in any case)
--all-control-sets Every control set (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry shell-bags¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry shell-bags <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for UsrClass.dat and NTUSER.DAT hives
-f, --file <FILE> File path to one UsrClass.dat or NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Parsing:
--code-page <NUMBER> Windows code page for the ANSI names of shell items (8.3 names, network shares) [default: 1252]
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry shimcache¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry shimcache <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM hives
-f, --file <FILE> File path to one SYSTEM hive, or an AppCompatCache value saved to a file
--no-logs Read a dirty hive as it is, without its transaction logs (SYSTEM.LOG1, SYSTEM.LOG2)
Output:
-o, --output <FILE> Save every entry to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. Without -o, the entries are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
juntei parse-registry shimcache -f SYSTEM
juntei parse-registry shimcache -d evidence/ -o shimcache.csv
ดู ShimCache
parse-registry taskcache¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry taskcache <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SOFTWARE hives
-f, --file <FILE> File path to one SOFTWARE hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Filtering:
--task <NAME> Only the task of this name, in any case: its whole name (\Microsoft\Windows\Defrag\ScheduledDefrag) or its last part (ScheduledDefrag)
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry usb¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry usb <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for SYSTEM hives (each system's SOFTWARE and users' NTUSER.DAT hives are read with it)
-f, --file <FILE> File path to one SYSTEM hive (its system's SOFTWARE and users' NTUSER.DAT hives are read with it)
--log1 <FILE> The SYSTEM hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The SYSTEM hive's second transaction log (.LOG2), for -f
--no-logs Read dirty hives as they are, without their transaction logs
Filtering:
--all-control-sets Every control set (ControlSet001, ControlSet002, ...), not only the one Windows used last
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
parse-registry user-assist¶
Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)
Usage:
juntei parse-registry user-assist <INPUT> [OPTIONS]
Input:
-d, --directory <DIR> Directory to search recursively for NTUSER.DAT hives
-f, --file <FILE> File path to one NTUSER.DAT hive
--log1 <FILE> The hive's first transaction log (.LOG1), for -f. With --log1 or --log2, only the logs given are replayed (default: <hive>.LOG, .LOG1 and .LOG2 next to it)
--log2 <FILE> The hive's second transaction log (.LOG2), for -f
--no-logs Read a dirty hive as it is, without its transaction logs
Output:
-o, --output <FILE> Save every record to a file
-t, --output-type <TYPE> Output type: csv (default), json, jsonl. With -t and without -o, the records are written to stdout
-C, --clobber Overwrite files when saving
General Options:
-h, --help Show the help menu
Display Settings:
-K, --no-color Disable color output
-q, --quiet Quiet mode: do not display the launch banner
ตัวอย่าง¶
juntei parse-registry services -f SYSTEM -o services.csv
juntei parse-registry services -f SYSTEM --service ExampleSvc -t jsonl
juntei parse-registry recent-docs -f NTUSER.DAT -o recentdocs.csv
juntei parse-registry taskcache -f SOFTWARE --task ScheduledDefrag -t jsonl
juntei parse-registry sam -f SAM --rid 500 -t jsonl
juntei parse-registry persistence -d collection/ -o persistence.csv
juntei parse-registry usb -d collection/ -o usb.csv
juntei parse-registry user-assist -d collection/ -o userassist.csv
juntei parse-registry open-save-mru -d collection/ -o opensavemru.csv
juntei parse-registry bam -d collection/ --all-control-sets -o bam.csv
juntei parse-registry installed-programs -d collection/ -o installed.csv
juntei parse-registry muicache -d collection/ -o muicache.csv
juntei parse-registry shell-bags -d collection/ -o shellbags.csv
ตัวเลือกทั้งหมดและความหมายของฟิลด์อยู่ในหน้า ไฮฟ์รีจิสทรี, บริการ Windows, RecentDocs, แคช Task Scheduler, บัญชีภายในเครื่อง SAM, การเริ่มอัตโนมัติผ่านรีจิสทรี, UserAssist, BAM / DAM, โปรแกรมที่ติดตั้ง, MuiCache, ShellBags และ อุปกรณ์ USB
ดูเพิ่มเติม: กล่องโต้ตอบเปิดและบันทึกเป็น
ดูเพิ่มเติม: remote-access
ดูเพิ่มเติม: system-info
ดูเพิ่มเติม: mru
ดูเพิ่มเติม: app-history
ดูเพิ่มเติม: featureusage
ดูเพิ่มเติม: security-settings
ดูเพิ่มเติม: office
ดูเพิ่มเติม: auditpol
ดูเพิ่มเติม: appcompat
ดูเพิ่มเติม: bcd
ดูเพิ่มเติม: lsa-secrets
ดูเพิ่มเติม: networks