hello, we are using the `programs` to fetch all ap...
# generalc
Chris Stylianidou
12/11/2023, 4:46 PMhello, we are using the
programsFiles\WindowsAppss
Stefano Bonicatti
12/11/2023, 4:56 PMThe
programsregistryregistryStefano Bonicatti
12/11/2023, 5:01 PMMight have some clues: https://chriskyfung.github.io/blog/windows/find-windows10-store-app-path-for-default-program
c
Chris Stylianidou
12/11/2023, 5:03 PMthe apps are registered in registry, but unfortunately their entries from registry are not coming in the results, when we query the
registrys
Stefano Bonicatti
12/11/2023, 5:05 PMSo, you've verified that you have the data under a certain path in the registry but you are unable to query it via osquery?
If so, sounds like a specific issue with the query you're using.
c
Chris Stylianidou
12/11/2023, 5:07 PMthe path in registry is this one: _`HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages`_
Chris Stylianidou
12/11/2023, 5:10 PMI run the following query:
Copy code
SELECT * from registry
where
path like '%HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages%'s
Stefano Bonicatti
12/11/2023, 5:10 PMIf you know that there's data there, then as I mentioned above, it's likely that the issue is the query. I know that the table is a bit particular
Stefano Bonicatti
12/11/2023, 5:10 PMStefano Bonicatti
12/11/2023, 5:10 PM^ I've written a (slightly long) explanation there on what to expect
c
Chris Stylianidou
12/11/2023, 5:11 PMcool, thanks
s
Stefano Bonicatti
12/11/2023, 5:11 PMHum why you have a starting
%Stefano Bonicatti
12/11/2023, 5:14 PMmaybe a TLDR on how you're using the query is that if you want to list all the keys (one level) under Packages, you want to do
[...]\Packages\%Stefano Bonicatti
12/11/2023, 5:15 PMThe "Example 3" on the bottom of the comment has a similar use case
Stefano Bonicatti
12/11/2023, 5:17 PMIn any case you have to assume that writing
Packages%PackagesSomeOtherWordsStefano Bonicatti
12/11/2023, 5:22 PMAh the other thing I see is that HKEY_CURRENT_USER cannot be used. You have to query HKEY_USERS and specify the desired user SID
Stefano Bonicatti
12/11/2023, 5:23 PMIf you test the query locally on a machine, with osqueryi, osquery should print a warning.
Stefano Bonicatti
12/11/2023, 5:27 PMHKEY_USERS\<SID>\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\%c
Chris Stylianidou
12/11/2023, 5:35 PMfollowing query worked... thanks for the help 🙏
Copy code
SELECT * from registry
where
path like 'HKEY_USERS\%\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\%'🎉 1
t
tokcum
11/22/2024, 1:21 AMHi, thanks for exploring this issue with identifying Windows Apps via the registry table. I tried the statement provided above and get results. However, the results are not very helpful because the information is cryptic, e. g. I expected to get Mozilla Firefox but get kind of identifiers.
Is this expected? It would be great if someone could share a result of a properly working query. Thank you.
tokcum
11/27/2024, 4:45 PMHi, we worked on a query to enumerate the software installed in "C:\Program Files\WindowsApps". This is what worked well enough for us:
Copy code
SELECT DISTINCT
SUBSTR(filename, 1, INSTR(filename, '_') - 1 ) AS name,
SUBSTR(filename, INSTR(filename, '_') + 1, INSTR(SUBSTR(filename, INSTR(filename, '_') + 1), '_') - 1) AS version,
CASE
WHEN filename LIKE '%_x64__%' THEN 'x64'
WHEN filename LIKE '%_x86__%' THEN 'x86'
WHEN filename LIKE '%_neutral__%' THEN 'neutral'
ELSE ''
END AS arch
FROM file
WHERE directory = 'C:\Program Files\WindowsApps' AND filename like "%.%_%_%__%"tokcum
11/27/2024, 4:54 PMHey guys, not sure how to get some awareness for this issue. So, I repost it on #C08V7KTJB. Is this worth an issue on Fleet's Github repo?
20 Views