Adjust regf glob to account for dot before instance name

fox-it · Dec 20, 2024 · c26288a · c26288a
1 parent 70c037b
commit c26288a
Showing 1 changed file with 7 additions and 7 deletions.
diff --git a/dissect/target/plugins/os/windows/log/mssql.py b/dissect/target/plugins/os/windows/log/mssql.py
@@ -35,7 +35,7 @@ class MssqlPlugin(Plugin):
 
     __namespace__ = "mssql"
 
-    MSSQL_KEY_GLOB = "HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQL*"
+    MSSQL_KEY_GLOB = "HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQL*.*"
     FILE_GLOB = "ERRORLOG*"
 
     def __init__(self, target: Target):
@@ -92,12 +92,12 @@ def errorlog(self) -> Iterator[MssqlErrorlogRecord]:
     def _find_instances(self) -> set[str, TargetPath]:
         instances = set()
 
+        import ipdb; ipdb.set_trace()
         for subkey in self.target.registry.glob_ext(self.MSSQL_KEY_GLOB):
-            if "." in subkey.name:
-                instances.add(
-                    (
-                        subkey.name,
-                        self.target.fs.path(subkey.subkey("SQLServerAgent").value("ErrorLogFile").value).parent,
-                    )
+            instances.add(
+                (
+                    subkey.name,
+                    self.target.fs.path(subkey.subkey("SQLServerAgent").value("ErrorLogFile").value).parent,
                 )
+            )
         return instances