Garbage out from running a Hunt for registry values of type REG_BINARY
Open
- Dominant language
- Python
- Stars
- 5.1k
- Forks
- 796
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
When running hunts I am getting garbage from any registry value of type REG_BINARY when exporting CSVs from my Hunts. When performing flows for single machines I can Browse Virtual Filesystem to find the correct value, but this is not efficient in volume.
Example:
RegKey - HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/NetworkList/Signatures/Unmanaged/*/DefaultGatewayMac
Expected value - '\xf8\x18\x97\x1eW\xa9'
Actual value - ø— W©
Contributor guide
Assessment
This issue has not been assessed yet.