Relevance statment

Content Authoring
1

(imported topic written by hanspjacobsen)

I’m looking at writing a relevance that checks if the value in th registry exists but not getting it to work.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

“Run load”="%WINDIR%\uninstall\rundl123.exe"

2

(imported comment written by brolly3391)

Hello handspjacobsen,

Give this a try and see if it does what you wanted:

exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion” whose (exists value “Run load” whose (it as string ends with “\uninstall\rundl123.exe”) of it) of registry

You might need to play with the string value “\uninstall\rundl123.exe” to get it to accuratly give you the true/false that you wanted.

Cheers,

Brolly

3

(imported comment written by hanspjacobsen)

Thanks for the help it worked when doing some miner adjustments

exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion”

whose (exists value “Run load” whose (it as string ends with “\uninstall\rundl123.exe”) of it) of registry

The Only issue i have is that the relavance statments don’t support %WINDIR% as it is in the registry.

So I would like it if the statment could have lookied something like this.

exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion”

whose (exists value “Run load” whose (it as string ends with “%WINDIR%\uninstall\rundl123.exe”) of it) of registry

Thanks

Hans Petter

4

(imported comment written by jessewk)

Hans,

Did you want the literal string %windir% or do you want the actual path to the windows folder?

This will do the first:

exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion” whose (exists value “Run load” whose (it as string ends with “%25WINDIR%25\uninstall\rundl123.exe”) of it) of registry

Notice that I changed % to %25. %25 is the hex character code for the percent character. You need to escape any precent characters in literal strings by using the hex code.

This will actually substitute %windir% with the path to the windows folder:

exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion” whose (exists value “Run load” whose (it as string ends with (pathname of windows folder & “\uninstall\rundl123.exe”)) of it) of registry

5

(imported comment written by hanspjacobsen)

This statment worked

exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion” whose (exists value “Run load” whose (it as string ends with “%25WINDIR%25\uninstall\rundl123.exe”) of it) of registry

Is there somewhere %25 and other features are documenteted?

Thanks

Hans Petter

6

(imported comment written by jessewk)

Documentation is in the inspector guides for various operating systems available here:

http://support.bigfix.com/fixlet

-Jesse