Add WinSCP DEFAULT Artifact back and Advanced Port Scanner and Advanced IP Scanner

BatchExamples/DFIRBatch.md

@@ -54,6 +54,7 @@ Example entry, please follow this format:
 | 2.05 | 2024-09-01 | Added new artifacts related to the third party application MobaTek MobaXTerm |
 | 2.06 | 2024-09-06 | Added various JPCert artifacts around remote access tools, Added LogonStats and an example of DEFAULT registry hive use with WinSCP  |
 | 2.07 | 2024-11-26 | Added new artifacts from the DEFAULT registry hive  |
+| 2.08 | 2024-12-07 | Added WinSCP DEFAULT artifact back and added Advanced IP Scanner and Advanced Port Scanner Artifacts |
 
 # Documentation
 

BatchExamples/DFIRBatch.reb

@@ -1,9 +1,9 @@
 Description: DFIR RECmd Batch File
 Author: Andrew Rathbun
-Version: 2.07
+Version: 2.08
 Id: 2e1589f5-e31a-4bef-822f-075d56afdddd
 Keys:
 #
 # DFIRBatch README: https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/DFIRBatch.md
 #  => Add changelog in this readme after additions.
 #
@@ -44,7 +44,7 @@
         Recursive: false
         Comment: "Displays the username of the last user logged in to this system"
 
 # https://windowsir.blogspot.com/2013/04/plugin-winlogon.html
 
     -
         Description: WinLogon
@@ -55,7 +55,7 @@
         Recursive: false
         Comment: "Displays the SID of the user who is set to auto login to Windows"
 
 # https://windowsir.blogspot.com/2013/04/plugin-winlogon.html
 
     -
         Description: WinLogon
@@ -130,7 +130,7 @@
         Recursive: false
         Comment: "Identifies the system volume where Windows booted from"
 
 # https://www.microsoftpressstore.com/articles/article.aspx?p=2201310
 # https://stackoverflow.com/questions/15361617/retrieve-the-partition-number-of-bootmgr-on-windows-vista-and-later
 
     -
@@ -142,7 +142,7 @@
         Recursive: false
         Comment: "Displays value for the current ControlSet"
 
 # https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/
 # https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/
 
     -
@@ -154,7 +154,7 @@
         Recursive: false
         Comment: "Displays value for the default ControlSet"
 
 # https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/
 # https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/
 
     -
@@ -166,7 +166,7 @@
         Recursive: false
         Comment: "Displays value for the ControlSet that was unable to boot Windows successfully"
 
 # https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/
 # https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/
 
     -
@@ -178,7 +178,7 @@
         Recursive: false
         Comment: "Displays value for the last known good ControlSet"
 
 # https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/
 # https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/
 
     -
@@ -192,7 +192,7 @@
         BinaryConvert: FILETIME
         Comment: "Last system shutdown time"
 
 # https://www.winhelponline.com/blog/how-to-determine-the-last-shutdown-date-and-time-in-windows/
 
     -
         Description: Windows OS Language
@@ -203,7 +203,7 @@
         Recursive: false
         Comment: "Default OS Language, 0409 is English"
 
 # https://serverfault.com/questions/957167/windows-10-1809-region-language-registry-keys
 # https://www.itprotoday.com/windows-78/where-registry-language-setting-each-user-stored
 
     -
@@ -2617,6 +2617,13 @@
         KeyPath: WOW6432Node\Martin Prikryl
         Recursive: true
         Comment: "WinSCP"
+    -
+        Description: WinSCP
+        HiveType: DEFAULT
+        Category: Third Party Applications
+        KeyPath: Software\Martin Prikryl
+        Recursive: true
+        Comment: "WinSCP"
 
 # Third Party Applications -> Ares - https://www.ares.net/
 
@@ -2922,6 +2929,42 @@
 
 # https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_1_1_yamashige-nakatani-tanaka_en.pdf
 
+# Third Party Applications -> Advanced Port Scanner - https://www.advanced-port-scanner.com/
+
+    -
+        Description: Advanced Port Scanner
+        HiveType: NTUSER
+        Category: Third Party Applications
+        KeyPath: Software\Famatech\advanced_port_scanner
+        Recursive: true
+        Comment: "Displays artifacts relating to Advanced Port Scanner"
+
+    -
+        Description: Advanced Port Scanner
+        HiveType: DEFAULT
+        Category: Third Party Applications
+        KeyPath: Software\Famatech\advanced_port_scanner
+        Recursive: true
+        Comment: "Displays artifacts relating to Advanced Port Scanner"
+
+# Third Party Applications -> Advanced IP Scanner - https://www.advanced-ip-scanner.com/
+
+    -
+        Description: Advanced IP Scanner
+        HiveType: NTUSER
+        Category: Third Party Applications
+        KeyPath: Software\Famatech\advanced_ip_scanner
+        Recursive: true
+        Comment: "Displays artifacts relating to Advanced IP Scanner"
+
+    -
+        Description: Advanced IP Scanner
+        HiveType: DEFAULT
+        Category: Third Party Applications
+        KeyPath: Software\Famatech\advanced_ip_scanner
+        Recursive: true
+        Comment: "Displays artifacts relating to Advanced IP Scanner"
+
 # --------------------
 # CLOUD STORAGE
 # --------------------