WinRegistry collector

The WinRegistry collector gathers Windows registry data from devices.

Collector output

Field	Type	Description
keypath	Win Registry String	A path to a registry key. The path does not include the key name. Only `equals` and `starts_with` operators are valid for this output field.
keyvalue	Win Registry String	The key value name.
valuedata	Win Registry String	The data stored by the key value.
valuetype	Win Registry String	The data type of the registry data.

Supported versions

Windows	Linux	macOS
3.0 and later	n/a	n/a

Example: Show registry data related to installation on managed devices.

WinRegistry where WinRegistry keypath equals "hkey_local_machine\software\mcafee\mar"

Strings in conditions and filters are case insensitive: "software" and "SOFTWARE" match the same registry entries.

User registered startup items

WinRegistry
    WHERE WinRegistry keypath equals "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"

Specify - single IoC simulation

WinRegistry
    WHERE WinRegistry keypath equals "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
        AND WinRegistry keyvalue equals "foo"

Specify - many IoC simulation

WinRegistry
    WHERE WinRegistry keypath equals "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
        AND WinRegistry keyvalue equals "Skype"
            OR WinRegistry keyvalue contains "Google"
            OR WinRegistry keyvalue contains "zoom"
            OR WinRegistry keyvalue contains "Zoom"

User registered software CLSIDs

WinRegistry
    WHERE WinRegistry keypath equals "HKEY_CURRENT_USER\Software\Classes\CLSID\"

User registered chrome browser extensions

WinRegistry
    WHERE WinRegistry keypath
        equals "HKEY_CURRENT_USER\Software\Google\Chrome\Extensions"
        OR WinRegistry keypath equals "HKEY_CURRENT_USER\Software\Wow6432Node\Google\Chrome\Extensions"

Globally registered services

WinRegistry
    WHERE WinRegistry keypath equals "HKLM\SYSTEM\CurrentControlSet\Services"

Globally registered system startup & device configuration

WinRegistry
    WHERE WinRegistry keypath equals "HKLM\SYSTEM\CurrentControlSet\HardwareProfiles"

Globally registered audit policy settings

WinRegistry
    WHERE WinRegistry keypath equals "HKEY_LOCAL_MACHINE\SECURITY\Policy\PolAdtEv"

Globally registered browser helper objects - BHO

WinRegistry
    WHERE WinRegistry keypath
        equals "HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects"
            OR WinRegistry keypath
                equals "HKEY_LOCAL_MACHINE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\\Browser Helper Objects"

Globally registered software CLSIDs

WinRegistry
    WHERE WinRegistry keypath starts with "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\"

Specify a CLSID

WinRegistry
    WHERE WinRegistry keypath starts with "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\"
        AND WinRegistry keyvalue contains "{42aedc87-2188-41fd-b9a3-0c966feabec1}"

Globally registered scheduled tasks

WinRegistry
    WHERE WinRegistry keypath
        equals "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule"

Globally registered chrome browser extensions

WinRegistry
    WHERE WinRegistry keypath
        equals "HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions"
        OR WinRegistry keypath equals "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Google\Chrome\Extensions"

Globally registered local user accounts

WinRegistry
    WHERE WinRegistry keypath
        equals "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"

Confirming enterprise powershell settings

Here we want to find endpoints that have the unrestricted execution policy set. This is a weakness the company would like to avoid.

WinRegistry 
    WHERE WinRegistry keypath equals "HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell"
        AND WinRegistry valuedata equals "Unrestricted"

Hunting for Indicators Of Compromise - IoCs: hashes

WinRegistry
    WHERE WinRegistry keypath equals "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UoOfbM"
        OR WinRegistry keypath equals "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\UoOfbM"