Report on Registry Keys for DNSChanger

[kcdinga]

Hello,

Our Security team has asked for a report on two registry keys, but the problem I am having is the CLSID's are random.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\[RANDOM CLSID]\"DhcpNameServer" = "IP Address of Rogue DHCP Server 1, IP Address of Rogue DHCP Server 2"

We would like to report on the "DhcpNameServer"

Is there a way to use a wildcard for the CLSID in the path above?

[Hemoco]

kcdinga wrote:
Is there a way to use a wildcard for the CLSID in the path above?

This is not currently possible. You must submit exact file paths or registry locations for file and registry scanning.
Wildcard file and registry scanning may be included in a future update.