Advanced registry parameters
Jump to navigation
Jump to search
Advanced registry parameters are additional conditions that have to be met by the scanner if identified. An easy example would be Value=Data which would need the value "Value" to be a string containing the text "Data". Value=dword:755 would be similar, but referencing to a DWORD of the value 755. In addition to the equals sign, you can use negations. Value!=Data would detect only if "Value" is NOT "Data". And Value=exists: would be true whenever "Value" exists. You can also add relative paths (for checking values in subkeys), and absolute paths (beginning with a backslash, starting in the same root key).