Skip to content

Change WindowsServices to include subkeys and values#619

Open
chb2mn wants to merge 1 commit intoForensicArtifacts:mainfrom
chb2mn:windows_service_pathfix
Open

Change WindowsServices to include subkeys and values#619
chb2mn wants to merge 1 commit intoForensicArtifacts:mainfrom
chb2mn:windows_service_pathfix

Conversation

@chb2mn
Copy link
Copy Markdown
Contributor

@chb2mn chb2mn commented Mar 15, 2024

HKLM\System\CurrentControlSet\Services\ is a listing of all service names and that's about it. Adding a * includes the config data

@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 15, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 69.70%. Comparing base (dcb57f8) to head (9c4573b).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #619   +/-   ##
=======================================
  Coverage   69.70%   69.70%           
=======================================
  Files           9        9           
  Lines         769      769           
=======================================
  Hits          536      536           
  Misses        233      233           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@joachimmetz
Copy link
Copy Markdown
Member

@chb2mn I recall that the intent of this artifact definition has been to get the names of the services and drivers (https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html) only, not the full hierarchy under them. Do you have additional context on why you want to make this change?

@joachimmetz joachimmetz self-assigned this Mar 18, 2024
@joachimmetz
Copy link
Copy Markdown
Member

joachimmetz commented Jan 24, 2026

HKLM\System\CurrentControlSet\Services\ is a listing of all service names and that's about it.

This is the original intent. This can likely be made more clear in the docstring

this change would change the definition to services subkeys and values. isn't the config a hierarchy so ** would be more appropriate in that case? Maybe adding WindowsServicesConfiguration definition for all subkeys and values?

@joachimmetz joachimmetz changed the title fixing missing * in windows_serv path Change WindowsServices to include subkeys and values Jan 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants