I’d avoid using the ‘descendants’ inspectors. Using Relevance to scan the whole disk can be problematic, either timing-out with no results or locking up the client so it can’t process anything else.
I’d look to use either BigFix Inventory (which already has the tools for scanning the disk), or creating a distinct scan action like the examples we built for the SolarWinds detections in the thread at DHS Emergency Directive 21-01 - Sunburst - SolarWinds thread
Basically an action that runs ‘dir /s’ on Windows or "find / " on Linux to look for the files, output the results to a text file, and then perform relevance to look at versions/vulnerabilities from the text file results list.
