matthieu

matthieu / Obtain Protected Files

Last active 3 months ago

Obtaining registry files with KAPE.EXE

0 0 1

1	kape.exe --tsource <WIN_INSTALL_DRIVE> --tdest <DESTINATION_FOLDER> --tflush --target RegistryHives -gui

matthieu / Powershell Hashing

Last active 3 months ago

0 0 1

1	Get-FileHash <file> -Algorithm <SHA1|SHA256|SHA384|SHA512|MD5> | Format-List

matthieu / CMD Hashing

Last active 3 months ago

0 0 1

1	certutil -hashfile <file> <MD5|SHA1|SHA256>

matthieu / GabeShear Query

Last active 3 months ago

0 0 1

1	*[EventData[Data[@Name='TargetUserName'] and (Data='gabe.shear@hotmail.com')]]
2	and
3	*[System[(EventID='4624')]]
4	</Select>
5	</Query>
6	</QueryList>