Changed definition of WindowsUninstallKeys ForensicArtifacts#329

joachimmetz · Mar 30, 2019 · d443538 · d443538
1 parent bf5cd59
commit d443538
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/data/windows.yaml b/data/windows.yaml
@@ -2130,10 +2130,7 @@ name: WindowsUninstallKeys
 doc: Uninstall Registry keys
 sources:
 - type: REGISTRY_KEY
-  attributes:
-    keys:
-      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*'
-      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Userdata\%%users.sid%%\Products\*\InstallProperties'
+  attributes: {keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*']}
 supported_os: [Windows]
 urls: ['https://msdn.microsoft.com/en-us/library/aa372105(v=vs.85).aspx']
 ---