This artifact enumerates the service binaries from the registry and locates their binaries. We then calculate hashes of the binaries.

Windows.Services.Hashes.yaml

name: Windows.Services.Hashes
description: |
    This artifact enumerates the service binaries from the registry and locates their 
    binaries. We then calculate hashes of the binaries.

parameters:
  - name: serviceKeys
    default: |
        HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\**\ImagePath
  - name: pathRegex
    default: >-
      ^(?P<path>"[^"]+"|[^ ]+)
 
sources:
  - precondition:
      SELECT OS From info() where OS = 'windows'
    queries:
      - LET paths = SELECT FullPath,Name, Data.value AS Value,
               parse_string_with_regex(string=Data.value, 
                                       regex=pathRegex) as regData
        FROM glob(globs=split(string=serviceKeys, sep="[, \\n]+"),
                  accessor="reg") 
        WHERE Data.value
        
      - LET normalized = SELECT *, 
           expand(path=
              regex_replace(re='(?i)^system32\\\\', replace="%SystemRoot%\\system32\\",
              source=regex_replace(
                  source=regData.path, re="^\\\\SystemRoot\\\\",
                  replace="%SystemRoot%\\"))) AS RealPath
        FROM paths
        
      - SELECT FullPath, Name, Value, RealPath,
               hash(path=expand(path=RealPath)).SHA256 AS Hash 
        FROM normalized