Title
#general
n

Nacho Rivera

11/24/2021, 4:05 PM
Hi, I'am trying to get the values associated to a windows registry subkey, for example:
select * from registry where key='HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion' and name like '%Run%'
To check the values of
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
, but having a subkey as
type
,
data
is empty, and does not include values stored in that subkey ...
f

fritz

11/24/2021, 6:38 PM
@Nacho Rivera you need to descend into the various directories below CurrentVersion if you want to read their contents.
6:42 PM
When you see values that are empty it is because you are seeing 'folders' not actual keys
6:44 PM
For example:
osquery> SELECT key,name,type,data,mtime FROM registry WHERE key = 'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion' AND name LIKE '%Run%';
W1124 13:44:00.364002  5608 registry.cpp:528] CURRENT_USER hives are not queryable by osqueryd; query HKEY_USERS with the desired users SID instead
+-------------------------------------------------------------+-----------------+--------+------+------------+
| key                                                         | name            | type   | data | mtime      |
+-------------------------------------------------------------+-----------------+--------+------+------------+
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion | Run             | subkey |      | 1637471399 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion | RunNotification | subkey |      | 1634648734 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion | RunOnce         | subkey |      | 1637777695 |
+-------------------------------------------------------------+-----------------+--------+------+------------+
6:44 PM
6:45 PM
Run
,
RunOnce
, and
RunNotification
are the parent key directories, vs the actual subkeys or values
6:48 PM
Recursive searching on the registry is not the best but you can accomplish it with workarounds at times (in this case it is fine because these directories do not contain subdirectories). If you wanted the contents of all keys in all three of those directories, you could run something like:
SELECT path,name,type,data,mtime FROM registry WHERE path LIKE 'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\%Run%\%%';
6:49 PM
Additionally, you should take note of the error produced when querying the HKCU hive:
W1124 13:44:00.364002  5608 registry.cpp:528] CURRENT_USER hives are not queryable by osqueryd; query HKEY_USERS with the desired users SID instead
6:50 PM
If you are querying these things using a fleet manager / osqueryd, you will need to rework your query to instead query the users hive.