ECS::LogEntry::Registry::Data

Initialize all values as nil

A chainable setter for bytes

registry.data.bytes

Original bytes written with base64 encoding.

For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by lp_data. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.

Level: Extended Type: Keyword Example:

ZQBuAC0AVQBTAAAAZQBuAAAAAAA=

registry.data.bytes

Original bytes written with base64 encoding.

For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by lp_data. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.

Level: Extended Type: Keyword Example:

ZQBuAC0AVQBTAAAAZQBuAAAAAAA=

A chainable setter for strings

registry.data.strings

Content when writing string types.

Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g "1").

Level: Core Type: Keyword Example:

["C:\rta\red_ttp\bin\myapp.exe"]

registry.data.strings

Content when writing string types.

Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g "1").

Level: Core Type: Keyword Example:

["C:\rta\red_ttp\bin\myapp.exe"]

A chainable setter for type

registry.data.type

Standard registry type for encoding contents

Level: Core Type: Keyword Example:

REG_SZ

registry.data.type

Standard registry type for encoding contents

Level: Core Type: Keyword Example:

REG_SZ