Run Endpoint Script - registry_get

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Run Endpoint Script - registry_get

L1 Bithead

Hi all,

I try to run registry_get in the action center, but always fails to run.

I check the administrator guide

and learned that doesn't seem to work when running specific hives (e.g. /HKEY_CURRENT_USER/ )

 

So I try to get some registry information in \HKEY_LOCAL_MACHINE\SYSTEM\Cyvera, the content of this script mentions support for accepting registry paths starting with 'COMPUTER\\', but no matter if I add "COMPUTER\\", the final execution result is a failure, then the exception logs all show the following:

Syntax error when running function ' run ' in script:
 Traceback (most recent call last):
  File "script_execution.py", line 463, in _execute_script
  File "C:\ProgramData\Cyvera\Administrators\Temp\payload_execution\26caf6\script.py", line 27, in run
    with winreg.OpenKey(map_key(registry_hkey), registry_key_path) as key:
  File "C:\ProgramData\Cyvera\Administrators\Temp\payload_execution\26caf6\script.py", line 61, in map_key
    return eval(f"winreg.{hkey}")
  File "<string>", line 1
    winreg.
          ^
SyntaxError: unexpected EOF while parsing

I would like to know what is the correct input method to execute this endpoint script (registry_get).
Is there some sample input and running results for reference?

Thanks.

 

 

2 ACCEPTED SOLUTIONS

Accepted Solutions

L3 Networker

Hi @Chilla 

 

Thank you for writing to live community!

registry_get script is looking for an individual value instead of the key/subkey name.

 

For example: To grab 'Security Health' value data under run once in Registry_Path look for that value name- "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth" 

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

 

Thank You

View solution in original post

L1 Bithead

@PiyushKohli 

Thank you for your response. 😃

View solution in original post

2 REPLIES 2

L3 Networker

Hi @Chilla 

 

Thank you for writing to live community!

registry_get script is looking for an individual value instead of the key/subkey name.

 

For example: To grab 'Security Health' value data under run once in Registry_Path look for that value name- "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth" 

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

 

Thank You

L1 Bithead

@PiyushKohli 

Thank you for your response. 😃

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!