Function RegistryAnalysisRoutine

windowsregistry.go:21–45

RegistryAnalysisRoutine analyse registry persistence keys every 15 seconds

(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, pInfiniteLoop bool, rules *yara.Rules)

// RegistryAnalysisRoutine analyse registry persistence keys every 15 seconds
func RegistryAnalysisRoutine(pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, pInfiniteLoop bool, rules *yara.Rules) {
	for {
		values, errors := EnumRegistryPeristence()

		if pVerbose {
			for _, err := range errors {
				logMessage(LOG_ERROR, "[ERROR]", err)
			}
		}

		for _, k := range values {
			paths := FormatPathFromComplexString(k.value)
			for _, p := range paths {
				FileAnalysis(p, pQuarantine, pKill, pNotifications, pVerbose, rules, "REGISTRY")
			}
		}

		if !pInfiniteLoop {
			wg.Done()
			break
		} else {
			time.Sleep(15 * time.Second)
		}
	}
}

// EnumRegistryPeristence get all the potential registry values used for persistence
func EnumRegistryPeristence() (values []RegistryValue, errors []error) {