Trying to write a relevance to grab RUN programs from registry

Content Authoring
1

(imported topic written by SteveC91)

I want to write an analysis that will look at all our clients and pull from them the values from HKLM\Microsoft\Windows\CurrentVersion\Run, and select only systems that have RUNDLL32.EXE in the RUN area. In playing around I’ve been able to retrieve the Run values with:

values of key “hklm\software\microsoft\windows\currentversion\run” of registry

which returns:

C:\Program Files\Apoint\Apoint.exe

RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

nwiz.exe /installquiet

.

.

.

But this is where I get stuck. I’m getting stuck trying to extract the “TRUE” from the existence of RUNDLL32.EXE. Any recommendations on where to go next?

Thanks!

Steve

2

(imported comment written by Lee Wei)

Do you mean that you want to retrieve only the lines with rundll32.exe?

Might this be something you are looking for, or please ask again.

values whose (it as string as lowercase contains “rundll32.exe”) of key “hklm\software\microsoft\windows\currentversion\run” of registry

3

(imported comment written by SteveC91)

Thanks Lee, that’s exactly what I was looking for.