RE: Dynamicism Of Windows Registry

["Roger A. Grimes" <roger () banneretcs com>]

It is incredibly dynamic, often hundreds of changes been made every
second. Move your mouse, click a file, and you'll generate hundreds of
events...more reading than writing though.

Just run regmon from www.sysinternals.com for a few minutes. It will
tell you all you need to know.

Roger

*****************************************************************
*Roger A. Grimes, InfoWorld, Security Columnist 
*CPA, CISSP, MCSE: Security (2000/2003/MVP), CEH, yada...yada...
*email: roger_grimes () infoworld com or roger () banneretcs com
*Author of Professional Windows Desktop and Server Hardening (Wrox)
*http://www.amazon.com/gp/product/0764599909
*****************************************************************

 

-----Original Message-----
From: Jason T. Hallahan [mailto:jthallah () gmail com] 
Sent: Wednesday, June 21, 2006 2:57 PM
To: security-basics () securityfocus com
Subject: Dynamicism Of Windows Registry

Hello and good day:

I have a question. Exactly how dynamic is the Windows Registry?
Specifically, if you were somehow able to monitor in real-time the
changes made to the registry of a system on your network (HW/SW
installation, Processes running, websites visited, etc.) would you be
able to thwart an attack by that system (user), or would it be too
little information, too late?

Thanks for your help.

Best regards,
Jason

------------------------------------------------------------------------
---
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has
designated Norwich University a center of Academic Excellence in
Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting
experience. 
Using interactive e-Learning technology, you can earn this esteemed
degree, without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------