Run Endpoint Script - registry_get

[Chilla]

Hi all,

I try to run registry_get in the action center, but always fails to run.

I check the administrator guide

and learned that doesn't seem to work when running specific hives (e.g. /HKEY_CURRENT_USER/ )

So I try to get some registry information in \HKEY_LOCAL_MACHINE\SYSTEM\Cyvera, the content of this script mentions support for accepting registry paths starting with 'COMPUTER\\', but no matter if I add "COMPUTER\\", the final execution result is a failure, then the exception logs all show the following：

Syntax error when running function ' run ' in script:
 Traceback (most recent call last):
  File "script_execution.py", line 463, in _execute_script
  File "C:\ProgramData\Cyvera\Administrators\Temp\payload_execution\26caf6\script.py", line 27, in run
    with winreg.OpenKey(map_key(registry_hkey), registry_key_path) as key:
  File "C:\ProgramData\Cyvera\Administrators\Temp\payload_execution\26caf6\script.py", line 61, in map_key
    return eval(f"winreg.{hkey}")
  File "<string>", line 1
    winreg.
          ^
SyntaxError: unexpected EOF while parsing

I would like to know what is the correct input method to execute this endpoint script (registry_get).
Is there some sample input and running results for reference?

Thanks.

[PiyushKohli · Accepted solution]

Hi @Chilla 

Thank you for writing to live community!

registry_get script is looking for an individual value instead of the key/subkey name.

For example: To grab 'Security Health' value data under run once in Registry_Path look for that value name- "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth" 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Thank You

[Chilla · Accepted solution]

@PiyushKohli 

Thank you for your response. 😃