Skip to content

Instantly share code, notes, and snippets.

@mgreen27
Last active March 11, 2021 22:07
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mgreen27/ac3e46bf3db239aeaedefdbfbd569a5e to your computer and use it in GitHub Desktop.
Save mgreen27/ac3e46bf3db239aeaedefdbfbd569a5e to your computer and use it in GitHub Desktop.
Is KB5000871 installed?
name: Custom.Windows.System.KB5000871
author: Matt Green - @mgreen27
description: |
This artifact will check for KB5000871 in system Uninstall keys.
KB5000871 is not visible via Get-Hotfix or Systeminfo so we need to query the
uninstall keys. Modify NameRegex to search for other installed applications.
reference:
- https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-march-2-2021-kb5000871-9800a6bb-0a21-4ee7-b9da-fa85b3e1d23b
type: CLIENT
parameters:
- name: RegGlob
default: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\**
- name: NameRegex
default: KB5000871
sources:
- query: |
LET uninstall = SELECT
timestamp(epoch=Key.Mtime.Sec) AS MTime,
Key.Name as Name,
DisplayName,
DisplayVersion,
InstallLocation,
InstallSource,
Language,
Publisher,
UninstallString,
InstallDate
FROM read_reg_key(globs=RegGlob)
WHERE DisplayName =~ NameRegex
SELECT
if(condition=uninstall,
then= MTime) as PatchTime,
if(condition= uninstall,
then= DisplayName,
else= NameRegex + ' not found.') as DisplayName
FROM if(condition=uninstall,
then= uninstall,
else= scope())
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment