Analysis | Certificate Audit - Windows

Root CAs in Windows

Period 12 hours

* Results in a "string"/number

(
    concatenations " ; " of
    (
        preceding text of first "%82%01" of it | it
    )
    whose
    (
        it != "" AND it does not contain "%00%00%00%01%00%00%00"
    )
    of
    (
        preceding text of first "%82%0f" of it | it
    )
    of
    (
        preceding text of first "0%82" of it | it
    )
    of
    (
        preceding text of first "0%81" of it | it
    )
    of
    (
        preceding text of first "0%1e%17" of it | it
    )
    of
    (
        preceding text of last "1" of it | it
    )
    of
    (
        following text of
        (
            start of first
            (
                first matches
                (
                    regex "[\u1300-\u13ff]"
                )
                of it
            )
            of it
        )
        | it
    )
    whose
    (
        exists
        (
            first matches
            (
                regex "[\u1300-\u13ff]"
            )
            of it
        )
    )
    of
    (
        preceding text of first "%06%03" of it | it
    )
    of substrings separated by "U%04" of it
)
of it whose
(
    it contains "U%04"
)
of
(
    hexadecimal string it
)
of
(
    unique values of
    (
        it as string
    )
    of values "blob" of keys of keys "Certificates" of keys whose
    (
        name of it as uppercase contains "CA" OR name of it as uppercase contains "ROOT"
    )
    of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates" of
    (
        x64 registries; x32 registries
    )
)

( concatenations " ; " of (preceding text of first "%82%01" of it | it) whose(it != "" AND it does not contain "%00%00%00%01%00%00%00") of (preceding text of first "%82%0f" of it | it) of (preceding text of first "0%82" of it | it) of (preceding text of first "0%81" of it | it) of (preceding text of first "0%1e%17" of it | it) of (preceding text of last "1" of it | it) of (following text of (start of first (first matches (regex "[\u1300-\u13ff]") of it) of it) | it) whose(exists (first matches (regex "[\u1300-\u13ff]") of it)) of (preceding text of first "%06%03" of it | it) of substrings separated by "U%04" of it) of it whose(it contains "U%04") of (hexadecimal string it) of ( unique values of (it as string) of values "blob" of keys of keys "Certificates" of keys whose(name of it as uppercase contains "CA" OR name of it as uppercase contains "ROOT") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates" of (x64 registries; x32 registries) )

eDellRoot?

Period 6 hours

* Results in a true/false

exists (hexadecimal string it) whose(it contains "eDellRoot") of ( unique values of (it as string) of values "blob" of keys of keys "Certificates" of keys whose(name of it as uppercase contains "CA" OR name of it as uppercase contains "ROOT") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates" of (x64 registries; x32 registries) )

DSDTestProvider?

Period 6 hours

* Results in a true/false

exists (hexadecimal string it) whose(it contains "DSDTestProvider") of ( unique values of (it as string) of values "blob" of keys of keys "Certificates" of keys whose(name of it as uppercase contains "CA" OR name of it as uppercase contains "ROOT") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates" of (x64 registries; x32 registries) )

Search for:	Relevance	Fixlets/Tasks
	Analyses	BFI Signatures
	Dashboard/Wizard

Title	Keywords	Description
Relevance	Domain	ActionScript
Mime	Signature Content	(clear all)

ID	2994825
Status	Alpha - Code that was just developed
Title	Certificate Audit - Windows
Domain	BESC
Added by	jgstew on 11/25/2015 9:15:01 PM
Last Modified by	jgstew on 11/25/2015 9:15:01 PM
Counters	6396 Views / 93 Downloads
User Rating	* Average over 0 ratings. ** Log In or Register to add your rating.


Content Search Share Learn Projects	Utilities View SCM Scripts Base64 Converter Shell to Action Script	About About Us Tour FAQ Terms Contact Us	BigFix Resources Download BigFix Support Forum Github/Bigfix

Certificate Audit - Windows
Log In or Register to download the BES file, and more.

Description

Property Details

Properties

Relevance

Sharing

Comments

Content

Utilities

About

BigFix Resources

Certificate Audit - Windows Log In or Register to download the BES file, and more.