Can you give me an example of the HKLU key? is it just the user that has a SID or does the software reside in its own GUID under that? Here's some keys you should be able to scan (you can scan HKLU keys which will scan whatever user that's logged on at the time's SID), though its formatted weird: https://www.malwarebytes.com/blog/detections/pup-optional-wave
Also, if it actually installs under the user profile, versus a complete standalone, the software would show up under software as a profile-based software (it will have the little person avatar), but will disappear if it scans while another user is logged on.. so if that applies you could make a 'seen within last 5 minutes' and email it out on a 5 minute schedule...
Also, you could create a deployment package that does an xcopy wildcard search or something that deploys on machines that were scanned within the past X minutes at a similar schedule, then creates a registry key or txt file if found that you could scan with Lansweeper, or perhaps appends a network share file... just throwing out some ideas that come to mind if you want to do a wildcard search with lansweeper.... or, make a scheduled task with a GPO that executes a search upon user logon that searches for it and makes a file or registry key to then scan with Lansweeper to get info...
you could also make a report of running processes and filter for the .exe seen for assets scanned within the past 5 minutes and have it email you on a 5 minute schedule...
or you could use applocker i think...
just spitballing 🙂
