RegPathReputationBasicLists Deprecated

Deprecated. No available replacement.

python · D2 (Deprecated)

Details

IDRegPathReputationBasicLists
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.10.6.33415
Tagsregistry reputation

README

Checks the given registry path against a small block list (score 3), all (score 1), and suspicious list (score 2). If the key matches none of these, it will return an answer of 0.

Script Data

Name Description
Script Type python
Tags registry, reputation

Inputs

Argument Name Description
input The registry path to be checked.

Outputs

There are no outputs for this script.

Source

RegPathReputationBasicLists.py RegPathReputationBasicLists_test.py RegPathReputationBasicLists.yml
Download History Raw 
import pytest
import demistomock as demisto  # noqa: F401
from RegPathReputationBasicLists import main

LIST_ARGS = [
    (r'HKEY_CURRENT_USER\Software\Locky', 3),
    (r"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", 2),
    (r'HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run\vmware-tray.exe', 1),
    (r'test', 0)
]


@pytest.mark.parametrize('reg_path, score', LIST_ARGS)
def test_mimecast_find_email(reg_path, score, mocker):
    mocker.patch.object(demisto, 'args', return_value={'input': reg_path})
    mocker.patch.object(demisto, 'results')

    main()
    results = demisto.results.call_args[0][0]

    assert results.get('HumanReadable') == "The Registry Path reputation for: {} is: {}".format(reg_path.upper(), score)
    assert results.get('Contents') == score