cuckoobox/cuckoo — pull request #194 by ikiril01 (2013-11-15 20:35:06+00:00)
Title: Normalization of Nt* Registry API Call Hive/Key Values in MAEC 4.0.1 Reports

This is a fix to normalize how registry hive and key values are captured in MEAC 4.0.1 reports. The native Nt* API calls use the syntax \Registry\\Key, so this fix parses this out and properly converts into HKEY_LOCAL_MACHINE (etc.)\Key. Doing so allows for correlation across all registry calls, Nt* and Reg*, observed by Cuckoo and reported in the MAEC output.