Skip to content

Add SAL-BOF for remote registry operations#132

Open
MaorSabag wants to merge 1 commit intoAdaptix-Framework:devfrom
MaorSabag:add/registry-commands
Open

Add SAL-BOF for remote registry operations#132
MaorSabag wants to merge 1 commit intoAdaptix-Framework:devfrom
MaorSabag:add/registry-commands

Conversation

@MaorSabag
Copy link
Copy Markdown

Remote Registry Manipulation

Overview

This PR adds a comprehensive suite of Beacon Object Files (BOFs) to the extension-kit, providing native registry interaction capabilities: find, query, write, and delete.

These tools are designed for stealthy, in-memory execution, avoiding the heavy EDR telemetry generated by spawning reg.exe or using high-level API wrappers.


Key Features

The following actions are now supported as modular BOFs:

  • reg_query: Enumerate subkeys and values (supports REG_SZ, REG_DWORD, REG_BINARY, etc.).
  • reg_query_recursive: Recursively enumerate all subkeys and values under a specified key.
  • reg_find: Recursively search for specific keys or values within a hive.
  • reg_write: Create new keys or modify existing values.
  • reg_delete: Remove specific values or entire key trees.

Credits

  • Original CS-Situational-Awareness-BOFs by trustedsec

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant