Change WindowsServices to include subkeys and values#619
Change WindowsServices to include subkeys and values#619chb2mn wants to merge 1 commit intoForensicArtifacts:mainfrom
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #619 +/- ##
=======================================
Coverage 69.70% 69.70%
=======================================
Files 9 9
Lines 769 769
=======================================
Hits 536 536
Misses 233 233 ☔ View full report in Codecov by Sentry. |
|
@chb2mn I recall that the intent of this artifact definition has been to get the names of the services and drivers (https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html) only, not the full hierarchy under them. Do you have additional context on why you want to make this change? |
This is the original intent. This can likely be made more clear in the docstring this change would change the definition to services subkeys and values. isn't the config a hierarchy so |
HKLM\System\CurrentControlSet\Services\ is a listing of all service names and that's about it. Adding a * includes the config data