SpecterOps-Nemesis/sample_files/structured/registry_value.json

{
    "data": [
        {
            "key": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
            "value_name": "DefaultDomainName",
            "value_kind": 1,
            "value": "THESHIRE",
            "sddl": "O:SYG:SYD:AI(A;ID;KA;;;SY)(A;CIIOID;GA;;;SY)(A;ID;KA;;;BA)(A;CIIOID;GA;;;BA)(A;ID;KR;;;BU)(A;CIIOID;GR;;;BU)(A;ID;KR;;;AC)(A;CIIOID;GR;;;AC)S:AINO_ACCESS_CONTROL"
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon2",
            "value_name": "DefaultDomainName",
            "value_kind": 1,
            "value": "THESHIRE",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "___ignoreme",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "description",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-1",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKLM\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "imagepath",
            "value_kind": 1,
            "value": "%SystemRoot%\\system32\\svchost.exe -k LocalServiceNetworkRestricted -p",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "ObjectName",
            "value_kind": 1,
            "value": "NT AUTHORITY\\LocalService",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "Type",
            "value_kind": 4,
            "value": "32",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter\\Parameters",
            "value_name": "ServiceDll",
            "value_kind": 1,
            "value": "%SystemRoot%\\System32\\AJRouter.dll",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter\\Security",
            "value_name": "Security",
            "value_kind": 3,
            "value": "AQAUgKAAAACsAAAAFAAAADAAAAACABwAAQAAAAKAFAD/AQ8AAQEAAAAAAAEAAAAAAgBwAAUAAAAAABQA/QECAAEBAAAAAAAFEgAAAAAAGAD/AQ8AAQIAAAAAAAUgAAAAIAIAAAAAFACNAQIAAQEAAAAAAAUEAAAAAAAUAI0BAgABAQAAAAAABQYAAAAAABQAAAEAAAEBAAAAAAAFCwAAAAEBAAAAAAAFEgAAAAEBAAAAAAAFEgAAAA==",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        },
        {
            "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\AJRouter",
            "value_name": "DisplayName",
            "value_kind": 1,
            "value": "@%SystemRoot%\\system32\\AJRouter.dll,-2",
            "sddl": null
        }
    ],
    "metadata": {
        "agent_id": "339429212",
        "agent_type": "beacon",
        "automated": false,
        "data_type": "registry_value",
        "expiration": "2024-04-03T10:08:40.000Z",
        "source": "DC",
        "project": "ASSESS-X",
        "timestamp": "2023-04-03T10:08:40.000Z"
    }
}