KQL Search

Query Details

HomeAI ToolsDevice Query

Lookup Registry Keys Wildcard

Query

Author: Niklas Tinner (@NiklasTinner)

Use Case: Retrieving all software-related configurations and settings from the Windows Registry for system audit or software inventory purposes.

WindowsRegistry('HKEY_LOCAL_MACHINE\SOFTWARE\*')

Explanation

The query is used to retrieve all software-related configurations and settings from the Windows Registry for the purpose of auditing the system or creating a software inventory. It searches for keys in the HKEY_LOCAL_MACHINE\SOFTWARE\ path.

Details

Ugur Koc profile picture

Ugur Koc

Released: February 4, 2024

Tables

WindowsRegistry

Keywords

WindowsRegistry,Software,SystemAudit,SoftwareInventory

Operators

WindowsRegistryHKEY_LOCAL_MACHINESOFTWARE*

Actions