Ok so to clarify - the

appcompat_shims

table looks for app compatibility shims. The

shimcache

table uses a byproduct of the appcompat shim functionality, which is a listing of recently executed apps I've tested the

shimcache

table on multiple W10 systems and I am seeing the same duplicate results. Looking at the

shimcache

code, it looks like it is pulling from multiple places in the registry & not de-duping the resulting data: https://github.com/osquery/osquery/blob/master/osquery/tables/system/windows/shimcache.cpp#L35 In fact,

CurrentControlSet

is a pointer to the currently used

ControlSet001

So I'm thinking this wildcard that is in use

%ControlSet%

is causing the duplicates.

Second… It’s going to match the full key. So you need the wildcard for

HKEY_LOCAL_MACHINE\\SYSTEM\\

I’d have to test with code, but I’d expect you to be able to match the

\

there. Something like

%\\

. But I’m not totally sure how escaping it would work. (

\\

or

\\\\

? I dunno)

I’m also not sure if you’re in sql wildcards or regex. I assume sql? In sqlite,

_

matches a single character, while

%

matches any range of characters. This can be used to more narrowly create a filter

When I query the registry table for ControlSet001, ProcMon is showing that it is actually pulling from CurrentControlSet. Again, CurrentControlSet maps to whatever ControlSet is active (ControlSet001, ControlSet002 etc).

Wondering if Windows is intercepting the request for 001 and just mapping it under CurrentControlSet.

If that makes any kind of sense

I think there’s something here I’m missing

CurrentControlSet

is a symbolic link to either `ControlSet001`or

ControlSet002

and Windows alternates which one of those it is. The other key is a backup for a "Last Known Good" feature.

If osquery is producing two identical results that is not helpful, obviously. Maybe it should only look at

CurrentControlSet

.

I think this is enough to open an issue on the osquery repo, as a

bug

and then the desired/expected behavior. One of us can at least confirm.

To clarify - the shimcache process exec logs are only written to the registry when the system is being shutdown/rebooted. So when you query the table right now, you are actually seeing the logs up to

now minus uptime

I think pulling just from

CurrentControlSet

is a good place to land - if that is agreeable, I can submit a PR for that. We should also notate that in the schema notes.

PR: https://github.com/osquery/osquery/pull/7832