Skip to content

Update UserAssist and _ExpandedTransforms#32

Open
mgreen27 wants to merge 6 commits into
Velocidex:masterfrom
mgreen27:master
Open

Update UserAssist and _ExpandedTransforms#32
mgreen27 wants to merge 6 commits into
Velocidex:masterfrom
mgreen27:master

Conversation

@mgreen27
Copy link
Copy Markdown
Contributor

@mgreen27 mgreen27 commented May 5, 2026

Update UserAssist and _ExpandedTransforms

Comment thread Rules/AppCompatCache.yaml Outdated
Comment thread compiler/template.yaml
)
`^c:`="C:",

`\\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE\\}\\\\`="%APPDATA%\\Microsoft\\Windows\\AccountPictures\\",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extract these to the AppCompatCache rule

Copy link
Copy Markdown
Contributor Author

@mgreen27 mgreen27 May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WDYM? I updated these to resolve the UserAssist guid mapping.
I think we will also need to add to add a seperate RecentApps section as I can see guids in results
image

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thats what I mean - the logic should live with the rule and not be in the global template.

You can manipulate the _ExpandedTransforms after the fact by adding this in the preamble:

 LET _ExpandedTransforms <= _ExpandedTransform + dict(.....)

Comment thread Rules/Velociraptor-Rules.yaml Outdated
Comment thread compiler/template.yaml
`\\{DE92C1C7-837F-4F69-A3BB-86E631204A23\\}\\\\`="%USERPROFILE%\\Music\\Playlists\\",
`\\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4\\}\\\\`="%APPDATA%\\Microsoft\\Windows\\Printer Shortcuts\\",
`\\{5E6C858F-0E22-4760-9AFE-EA3317B67173\\}\\\\`="%USERPROFILE%\\",
`\\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97\\}\\\\`="%ALLUSERSPROFILE%\\",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Many of these env variables wont be available in dead disk mode, maybe add them into the Environment default parameter?

Copy link
Copy Markdown
Contributor Author

@mgreen27 mgreen27 May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in my testing all the guids worked in UserAssist
image

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we might need t add in some
image

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@scudette I added more, not sure if %USERNAME% will work but we can remove/edit those lines as needed

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we need some special logic to replace some env vars with the current username as extracted from OSPath - so we can be smart about resolving %USERPROFILE% and %APPDATA% - otherwise I dont think this will work at all

Copy link
Copy Markdown
Contributor Author

@mgreen27 mgreen27 May 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I ended up removing:
APPDATA,C:\Users%USERNAME%\AppData\Roaming
LOCALAPPDATA,C:\Users%USERNAME%\AppData\Local
USERPROFILE,C:\Users%USERNAME%

I tink its still worth having the guid conversion as the %env var% is nicer to read than the GUID imho

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants