forensicnomicon-data 1.4.0

// AUTO-GENERATED by forensicnomicon ingest pipeline.
// Source: regedit
// Entries: 17
// Do not edit manually — re-run `cargo run -p ingest` to regenerate.
#![allow(clippy::too_many_lines)]

use super::super::super::types::{
    ArtifactDescriptor, ArtifactLocation, DataScope, Decoder, HiveTarget, OsScope, TriagePriority,
};
pub(crate) static REGEDIT_EXPLORER_COMDLG32_LASTVISITEDPIDLMRULEGACY: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_explorer_comdlg32_lastvisitedpidlmrulegacy",
    name: "LastVisitedPidlMRULegacy",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\LastVisitedPidlMRULegacy",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "LastVisitedPidlMRULegacy",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_MICROSOFT_TERMINAL_SERVER_CLIENT: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_microsoft_terminal_server_client",
    name: "Terminal Server Client",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: "Software\\Microsoft\\Terminal Server Client",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Terminal Server Client",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_CONTROLSET00_CONTROL_TIMEZONEINFORMATION: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_controlset00_control_timezoneinformation",
    name: "TimeZoneInformation",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Control\\TimeZoneInformation",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "TimeZoneInformation",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_PARAMETERS_INTERFACES: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_parameters_interfaces",
    name: "Network Interfaces",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Services\\Tcpip\\Parameters\\Interfaces\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Network Interfaces",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_MICROSOFT_WINDOWS_PORTABLE_DEVICES_DEVICES: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_microsoft_windows_portable_devices_devices",
    name: "Portable Devices",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Microsoft\\Windows Portable Devices\\Devices\\",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Portable Devices",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_EXPLORER_COMDLG32_FIRSTFOLDER: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_explorer_comdlg32_firstfolder",
    name: "FirstFolder",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\FirstFolder",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "OpenSavePidlMRU",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_CONTROL_SESSION_MANAGER_APPCOMPATCACHE: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_control_session_manager_appcompatcache",
    name: "AppCompatCache",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Control\\Session Manager\\AppCompatCache",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "AppCompatCache",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_SERVICES_LANMANSERVER_SHARES: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_services_lanmanserver_shares",
    name: "Network Shares",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Services\\lanmanserver\\Shares",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Network Shares",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_CONTROL_COMPUTERNAME_COMPUTERNAME: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_control_computername_computername",
    name: "ComputerName",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Control\\ComputerName\\ComputerName",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Computer name",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_CONTROLSET00_CONTROL_WINDOWS: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_controlset00_control_windows",
    name: "Shutdown Time",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Control\\Windows",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Shutdown Time",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_USER_MRU: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_user_mru",
    name: "MS Office MRU",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: "SOFTWARE\\Microsoft\\Office\\*\\*\\User MRU\\*\\*",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "MS Office MRU",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_WINDOWS_NT_CURRENTVERSION_NETWORKLIST: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_windows_nt_currentversion_networklist",
    name: "Network List",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSoftware),
    key_path: "Microsoft\\Windows NT\\CurrentVersion\\NetworkList",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Network List",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_EXPLORER_COMDLG32_CIDSIZEMRU: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_explorer_comdlg32_cidsizemru",
    name: "CIDSizeMRU",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::NtUser),
    key_path: "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\CIDSizeMRU",
    value_name: None,
    file_path: None,
    scope: DataScope::User,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "CIDSizeMRU",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Medium,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_TCPIP_PARAMETERS_INTERFACES: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_tcpip_parameters_interfaces",
    name: "DHCP Network Hints",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Services\\Tcpip\\Parameters\\Interfaces",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DHCP Hints",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_SYSTEM_CONTROLSET00_SERVICES: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_system_controlset00_services",
    name: "Services",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Services",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "Services",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::High,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_SERVICES_BAM_USERSETTINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_services_bam_usersettings",
    name: "BAM",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Services\\bam\\UserSettings",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "BAM",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

pub(crate) static REGEDIT_SERVICES_DAM_USERSETTINGS: ArtifactDescriptor = ArtifactDescriptor {
    id: "regedit_services_dam_usersettings",
    name: "DAM",
    artifact_type: ArtifactLocation::RegistryKey,
    hive: Some(HiveTarget::HklmSystem),
    key_path: "ControlSet00*\\Services\\dam\\UserSettings",
    value_name: None,
    file_path: None,
    scope: DataScope::System,
    os_scope: OsScope::Win7Plus,
    decoder: Decoder::Identity,
    meaning: "DAM",
    mitre_techniques: &[],
    fields: &[],
    retention: None,
    triage_priority: TriagePriority::Low,
    related_artifacts: &[],
    sources: &["https://raw.githubusercontent.com/EricZimmerman/RECmd/master/BatchExamples/RECmd_Batch_MC.reb"],
    evidence_strength: None,
    evidence_caveats: &[],
    volatility: None,
    volatility_rationale: "",
};

// ── Generated entries (17) ─────────────────────────────────────────────────
// pub(crate) static GENERATED_REGEDIT_ENTRIES: &[&ArtifactDescriptor] = &[
//     &REGEDIT_EXPLORER_COMDLG32_LASTVISITEDPIDLMRULEGACY,
//     &REGEDIT_MICROSOFT_TERMINAL_SERVER_CLIENT,
//     &REGEDIT_CONTROLSET00_CONTROL_TIMEZONEINFORMATION,
//     &REGEDIT_PARAMETERS_INTERFACES,
//     &REGEDIT_MICROSOFT_WINDOWS_PORTABLE_DEVICES_DEVICES,
//     &REGEDIT_EXPLORER_COMDLG32_FIRSTFOLDER,
//     &REGEDIT_CONTROL_SESSION_MANAGER_APPCOMPATCACHE,
//     &REGEDIT_SERVICES_LANMANSERVER_SHARES,
//     &REGEDIT_CONTROL_COMPUTERNAME_COMPUTERNAME,
//     &REGEDIT_CONTROLSET00_CONTROL_WINDOWS,
//     &REGEDIT_USER_MRU,
//     &REGEDIT_WINDOWS_NT_CURRENTVERSION_NETWORKLIST,
//     &REGEDIT_EXPLORER_COMDLG32_CIDSIZEMRU,
//     &REGEDIT_TCPIP_PARAMETERS_INTERFACES,
//     &REGEDIT_SYSTEM_CONTROLSET00_SERVICES,
//     &REGEDIT_SERVICES_BAM_USERSETTINGS,
//     &REGEDIT_SERVICES_DAM_USERSETTINGS,
// ];