google / google/grr

No access to variables in knowledgebase after update

Open
#630 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
5.1k
Forks
796
PR merge metrics
No merged PRs in 30d

Description

Hi all,

while debugging with @sruester on #627 , we encoutered the following behavior:

The knowledge base for users is only fully filled for currently logged in users. So amongst other things the variable `Localappdata` is only available if an user is or was logged in.

When the knowledgebase is refreshed (for example due to an "Interogate" flow) at an later point in time, these information is not shown any more in the knowledgebase and only these "default values" are visible:

- `Username`,
- `Sid`,
- `Userprofile`,
- `Homedir`.

Nevertheless the values are still available (due to the history view in full details for systems) they don't seem to be evaluated while executing flows. i.e. the default flow "WindowsUserRegistryFiles" does not provide a `UsrClass.dat`.

Changing `%%users.localappdata%%\Microsoft\Windows\UsrClass.dat` to `%%users.homedir%%\AppData\Local\Microsoft\Windows\UsrClass.dat` would fix this temporarily.

Is this the intended behavior?

Thx
Mathias

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.