topic Re: Any way to scan for specific Registry DWORD entries with a value of 1 under a targeted Hive? in Cortex XDR Discussions

Any way to scan for specific Registry DWORD entries with a value of 1 under a targeted Hive?

J.Suter — Wed, 07 May 2025 18:11:00 GMT

Im trying to figure out how to write a script to search for the DWORD values of "State" and "RefCount" that = 1 in the sub folders (profiles) in the hive: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Then show the hostname, and data in the String "ProfileImagePath" in the results of which has a 1 in State or RefCount

My ultimate goal is to make a list of accounts on machines that are possibly corrupted. These vales seem to be the best way to see what accounts could be corrupted.

Re: Any way to scan for specific Registry DWORD entries with a value of 1 under a targeted Hive?

aspatil — Tue, 13 May 2025 06:34:16 GMT

Hello @J.Suter ,

You may need PS engagement or a Script Expert to create the powershell script to achieve your goal. Once the script is ready:

Go to Action Center > Scripts > Create Script

Upload this PowerShell code under Custom Script

Run against a test endpoint first

Target machines in bulk using filters or incident context

Review results under Script Results tab

Please reach out to Accounts Team for more information:
If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: Any way to scan for specific Registry DWORD entries with a value of 1 under a targeted Hive?

jmazzeo — Tue, 13 May 2025 12:35:38 GMT

Hi @J.Suter,

There is already an OOTB script that allows you to get a registry value, it's called "registry_get".

You can download the script and modify it as needed, it comes with very descriptive comments to let you know what each part of the script does.