iReg command

The iReg command reads information from the local registry.

Note
Exploit Prevention is not supported in the ARM architecture.

iReg [-32] param

To read the 32-bit hive on a 64-bit operating system, specify -32 as the first argument.

Parameter	Description
open `keyname`	Opens a registry key named `keyname` and returns "1" if successful or "0" otherwise. Closes the key when the scanning session is over.
exist `keyname`	Tests to see if a registry key named `keyname` exists and returns "1" if it exists or "0" otherwise.
value `keyname` `valuename`	Reads information from the registry key `keyname` with the value name of `valuename`. If the value is type: `string` — Returns the string value. `int` — Returns the string value. `MULTI_SZ` — Returns a Tcl list.
keys `keyname`	Returns a list of subkeys that exist under the key specified by `keyname`.
v_exists `keyname` `valuename`	Tests to see if the `valuename` item exists under the key specified by `keyname` and returns "1" if exists or "0" otherwise.

You can use the following shortcuts for the registry keyname.

For example, to specify the software hive on the local system, use HKLM\\Software.

For more Expert Rules examples, visit the Trellix Github repository.