Channels
#general
Title
# general
n
Nacho Rivera
11/24/2021, 4:05 PMHi, I'am trying to get the values associated to a windows registry subkey, for example:
select * from registry where key='HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion' and name like '%Run%'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runtypedataf
fritz
11/24/2021, 6:38 PM@Nacho Rivera you need to descend into the various directories below CurrentVersion if you want to read their contents.
When you see values that are empty it is because you are seeing 'folders' not actual keys
For example:
Copy code
osquery> SELECT key,name,type,data,mtime FROM registry WHERE key = 'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion' AND name LIKE '%Run%';
W1124 13:44:00.364002 5608 registry.cpp:528] CURRENT_USER hives are not queryable by osqueryd; query HKEY_USERS with the desired users SID instead
+-------------------------------------------------------------+-----------------+--------+------+------------+
| key | name | type | data | mtime |
+-------------------------------------------------------------+-----------------+--------+------+------------+
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion | Run | subkey | | 1637471399 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion | RunNotification | subkey | | 1634648734 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion | RunOnce | subkey | | 1637777695 |
+-------------------------------------------------------------+-----------------+--------+------+------------+RunRunOnceRunNotificationRecursive searching on the registry is not the best but you can accomplish it with workarounds at times (in this case it is fine because these directories do not contain subdirectories). If you wanted the contents of all keys in all three of those directories, you could run something like:
Copy code
SELECT path,name,type,data,mtime FROM registry WHERE path LIKE 'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\%Run%\%%';Additionally, you should take note of the error produced when querying the HKCU hive:
W1124 13:44:00.364002 5608 registry.cpp:528] CURRENT_USER hives are not queryable by osqueryd; query HKEY_USERS with the desired users SID insteadIf you are querying these things using a fleet manager / osqueryd, you will need to rework your query to instead query the users hive.
203 Views