Improve registry key searching

misje / opencti-wazuh-connector

OpenCTI–Wazuh connector looking for indicators in Wazuh and creating sightings

https://misje.github.io/opencti-wazuh-connector/

Apache License 2.0

15 stars 1 forks source link

Improve registry key searching #27

Closed misje closed 6 months ago

misje commented 6 months ago

Searching for registry keys in HKU/HKCU etc. is not particularly useful due to SIDs. Add settings that utilises regexp or wildcard to ignore SIDs and/or accept partial paths, similar to DirSearchOption. Suggested options:

MatchSubdirs
RequireAbsPath
IgnoreSID
CaseInsensitive
AllowRegexp or AllowWildcard, depending on implementation