Windows Registry for Threat Hunting | CySA+ CS0-003 Domain 1.1 #examprep #comptia #cysa

The Windows Registry shows up under CySA+ CS0-003 Domain 1.1 OS concepts — but the exam tests it from the defender lens, not the hardening lens. This Short covers what a SOC analyst does with the registry: hunt persistence, baseline Run keys, and correlate Sysmon writes.
What you will learn:

Why CySA+ frames the registry as a detection source
MITRE ATT&CK T1547.001 — Registry Run Keys and Startup Folder
The exact Run keys to know by name for the exam
A three-step hunt workflow analysts use in the SOC
Sysmon Event ID 13 — RegistryValueSet — and why it matters

This concept maps to CompTIA CySA+ CS0-003 Domain 1.1 (Explain the importance of system and network architecture concepts in security operations) under Operating system (OS) concepts - Windows Registry.
Free CySA+ study resources:
https://kandibrian.com
More CySA+ CS0-003 Shorts:
https://www.youtube.com/@kandi-brian
#CySAPlus #CS0003 #CompTIA #ThreatHunting #SOCAnalyst

Видео Windows Registry for Threat Hunting | CySA+ CS0-003 Domain 1.1 #examprep #comptia #cysa канала Kandi Brian