topic Run Endpoint Script - registry_get in Cortex XDR Discussions

Run Endpoint Script - registry_get

Chilla — Mon, 08 May 2023 06:26:42 GMT

Hi all,

I try to run registry_get in the action center, but always fails to run.

I check the administrator guide

and learned that doesn't seem to work when running specific hives (e.g. /HKEY_CURRENT_USER/ )

So I try to get some registry information in \HKEY_LOCAL_MACHINE\SYSTEM\Cyvera, the content of this script mentions support for accepting registry paths starting with 'COMPUTER\\', but no matter if I add "COMPUTER\\", the final execution result is a failure, then the exception logs all show the following：

Syntax error when running function ' run ' in script: Traceback (most recent call last): File "script_execution.py", line 463, in _execute_script File "C:\ProgramData\Cyvera\Administrators\Temp\payload_execution\26caf6\script.py", line 27, in run with winreg.OpenKey(map_key(registry_hkey), registry_key_path) as key: File "C:\ProgramData\Cyvera\Administrators\Temp\payload_execution\26caf6\script.py", line 61, in map_key return eval(f"winreg.{hkey}") File "<string>", line 1 winreg. ^ SyntaxError: unexpected EOF while parsing

I would like to know what is the correct input method to execute this endpoint script (registry_get).
Is there some sample input and running results for reference?

Thanks.

Re: Run Endpoint Script - registry_get

PiyushKohli — Mon, 08 May 2023 10:22:19 GMT

Hi @Chilla

Thank you for writing to live community!

registry_get script is looking for an individual value instead of the key/subkey name.

For example: To grab 'Security Health' value data under run once in Registry_Path look for that value name- "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth"

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Thank You

Re: Run Endpoint Script - registry_get

Chilla — Wed, 10 May 2023 03:33:43 GMT

@PiyushKohli

Thank you for your response. 😃