ForensicArtifacts/artifacts

Clean up WindowsEnvironmentVariableAllUsersProfile

Opened this issue · 0 comments

name: WindowsEnvironmentVariableAllUsersProfile
doc: |
  The %AllUsersProfile% environment variable
  May or may not depend on registry keys - see urls
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'AllUsersProfile'}
provides: [environ_allusersprofile]
supported_os: [Windows]
urls:
- 'https://www.microsoft.com/en-us/wdsi/help/folder-variables'
- 'https://github.com/mirror/reactos/blob/c6d2b35ffc91e09f50dfb214ea58237509329d6b/reactos/boot/bootdata/livecd.inf'
- 'http://support.microsoft.com/kb//214653'