41554 blogs · 4,417,066 posts Claim your blog

Record · corpus.blog/posts/01a08787-f2db-71d9-933b-e1799f5bb96d

Malicious Registry Timestamp Manipulation Technique: Detecting Registry Timestomping

inversecos.com · published 6 April 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at inversecos.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 15
Words captured: 1,907

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaS74AJb0c1hOca1yZCMXbXgW-U9loQYLFombudC8hrD-dkdZDoSIstSwvtdN3988e3NhoT8mSRqA78kEOLKmg7-kEbQqBWSaQjN1lmNBCYHawwOKFuISUBLpxyPTBoyFnllpp2toz2FIp7PlBqTtgB-CWM5WR6UrC-DcLzrlAaYS2LTmnjvg8EAfIZA/s948/SHOW.png

blogger.googleusercontent.com

http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FKey%2FNtSetInformationKey.html

undocumented.ntinternals.net

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAVzz86FFEFbrUcVRCZ4693u-YtFZugaQwTlg4JpZGr6GNwH4bJMg3zSUJBV51zj7cLwiVa2XgH53iJyQGNrJq9_2yHkxJzFViWXMNHIqxFdbVw-bRiMzKBhsxh3BqjYmzBE5cGf_sLEUMj6Vpm9oikPMIXKeDP0kiimMmfLJqtTacYDr6z14l_2UzAQ/s917/0.png

blogger.googleusercontent.com

https://github.com/jschicht

github.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi04vLJ3oLGNrEBlEf1Y8qZevXEvXJiq06dPXUsrQD_1egyuzZOfARvYm1nVi38QMAyr9eY_kNkE43UdbYiXZc2PVwHsi3hcLV_GOBqPTkppgiqffh3GQh-MvicvpN2sfq12nmabimjohj8PjLgX_XbQ1MMP37g1bcvz2JN9-OfYiMi_hwbZHnHyAIdMA/s1046/1.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWsTg1iv4MA6dSAHwZZMEGQ5Ll9hZWLK8eZEn23vcIXgchsjvplYmGuY8dK2f9SCVcF-fbfYQ-N258vjG5GpODSxFSnvfLaAhMwJb41ZSXfx0FYCdzEODDGM8BO48BXSHEPjhqqPwMBPHBEC95x6L3tNAzniL4SLCSGmOuR8SS4bG9Kp4NhikyxgUaVw/s964/2.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjG8lCr2PQUaBkccB2s5MwcObTjqSZ4jSh5_Rl8JjQWsVzTNtjw-9bs1KhtVwpwIjjHctDx8NoZk48czglLYqi_IJpwpvj8pI0O3ffynqHiiOYhxJ6sU4sVWF3Ot6e8xW7b9P5_63J86FLPxdp-UOeyqyauVd5C7veRTWnvHy0zLV-xl4vahsII5Dp0mA/s925/3.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiP9vhcEiDNu2EIz89b953_s2sX6hB5yTrXV6_laRo6NCjzAhxG_B9dzfDb4a6zcqE35OpllTosviD-KCxlFi-PcAfv0FnldrdMxvvQQgyEkX52y5PhRgdy9dkmSpfj4E2t95GCAkJHD9djTgtzDv8MGviZYbUdO-3mqLCC2PUD4cOx0f9IkqkGAZJmjg/s1164/4.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTiW6sLlRdhDNQrAcPjIgtrjPUslXEZ3BUCDcPYJDuiuul1qCCs6smJOgXkPYOf0vfPNPxqONn8b4WaT_2xeSjicCaE_-Yn8T-NbNzMRbcsQefrAvO1J04-bHAkebSHhzz6soWTpZnHNKnQEpu0pCSDvOHRRisSGTx_96d7irPL64q38o8-rqZPPl9Ig/s1028/5.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiX_Z2y9YCBI4PF4j0GL1PWfsDjEHJiaC9i8YhSSDcCXggIM2vpSJ_-BcDKc2khmzR7TDC3zlHwvr2tVEryMdLSLOXQt1_dgLi6tGeZ8WD9J-W7g-Jl3n85EiA_Wn2ubmY7XS2V7EbPpYut39rbhtREg_i9TFk1N0ogIPp2WKp5XyDEBJ--c7CTuuCpig/s948/6.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-y8HStKeqNRyavtYzX46PgStMxUqJeZ1qZV_yTU7VWVReY17EqbnKcQ1A7Q_TqUbX2fUQpgldjaRzD0errIfoFc4aUFNbb9p0zrZwFW6Rsaiw-a6ODcSdfmkTD0ttVIvCaIVssZrtV31CnR_obNFNxm_Yj5LSVErYCIulVtW37jlOLxCLZGIZYbjFmQ/s881/7.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQGBVl7DOyEgwVzZJKEytrNKCWMEmkNQXpJ3P647nAIxerclETlYl8D6gRhw_O7iIK1qoemeaT1O9KXXMFVT6hYkW55R2YRKQ3JTgTvxJHnBp48xTQstTmKTaFpPDFYBDheN7ifroaZBCmpXw-LVqVAjq8ch31SWIQ9VbcTVXIMIRXQ2Vzb_W7YbK9zw/s1468/x.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9YDU7rMBbQRlnJ2ABXFYBwLvCD1E71NWwQHw439KfCwhkXI2A3ktxn8Xo37xtEgasetPQv7F6ZHOr7g8smnywuWHP3B9d8ANOKZC5SJAvDayPr8hN4IIDd2vuN5Xtk0XcyRCQUIyjLpgjEWpohr4STRK2FNDNlndmzZ_cR7vQts9hBpzCQ5WbXqw36Q/s948/SHOW.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqiNupr25sluOzEmt2Ssafx5JFQhqJXyoySLL02jdEGDL20CLfRkvYqDn7y97lB2c9r8fN26PdOKhdT8hrhoq9UDrCF4tHauyrJ4cvKTi-UBj8_FADmgF8sB7Z-kWu5qYd5FUzKRZHgXqLB2DvaO3C0bM0w6bxHmoZIbXa8oClIUyz6k6EHBRAAN4nfw/s1345/8.png

blogger.googleusercontent.com

Windows Event Log Evasion via Native APIs Read at the source ↗