<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Registry Files and the Custom Software feature]]></title><description><![CDATA[<p dir="auto">The <strong>Custom Software</strong> feature now supports loading .reg files.</p>
<p dir="auto">Or rather, when you upload a <code>.reg</code> file, it will automatically run <code>reg.exe</code> with the parameters you supply.</p>
<p dir="auto">One possible use case for this, is to update the "ignorePaths" settings for the SecTeer VulnDetect Agent:</p>
<p dir="auto">First you need to load this file on one machine with the VulnDetect Agent:<br />
<code>vulndetect-ignorePaths.reg</code></p>
<pre><code>Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SecTeer\Agent]
"inspectionPaths"=hex(7):00,00
"ignorePaths"=hex(7):00,00
</code></pre>
<p dir="auto">You can load it using this command:<br />
<code>reg IMPORT ignorePaths.reg</code></p>
<p dir="auto">Now open regedt32 and go to <code>HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SecTeer\Agent</code></p>
<p dir="auto">Now double click <code>ignorePaths</code> and edit it, you enter data like this:</p>
<pre><code>D:\
C:\Users\test\Downloads\
C:\Users\test\SysInternals\
</code></pre>
<p dir="auto">You may get a warning about empty strings, it is safe to ignore, as regedt32 will remove them automatically.</p>
<p dir="auto">Now you need to export this:<br />
<code>reg export HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SecTeer\Agent ignorePaths.reg</code></p>
<p dir="auto">It is IMPORTANT to edit this file!</p>
<p dir="auto">It will look like this:</p>
<pre><code>Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SecTeer\Agent]
"LogFile"="C:\\WINDOWS\\Logs\\SecTeer\\secteer.log"
"LogLevel"=dword:00000006
"authToken"="1111111-2222-3333-4444-aaaaaaaaaaaa"
"inspectionPaths"=hex(7):00,00
"ignorePaths"=hex(7):44,00,3a,00,5c,00,00,00,43,00,3a,00,5c,00,55,00,73,00,65,\
  00,72,00,73,00,5c,00,74,00,65,00,73,00,74,00,5c,00,44,00,6f,00,77,00,6e,00,\
  6c,00,6f,00,61,00,64,00,73,00,5c,00,00,00,43,00,3a,00,5c,00,55,00,73,00,65,\
  00,72,00,73,00,5c,00,74,00,65,00,73,00,74,00,5c,00,53,00,79,00,73,00,49,00,\
  6e,00,74,00,65,00,72,00,6e,00,61,00,6c,00,73,00,5c,00,00,00,00,00
</code></pre>
<p dir="auto"><strong>If you import this to the wrong host, then you will create a clash between the hosts. Deleting the unnecessary lines is vital:</strong></p>
<pre><code>Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SecTeer\Agent]
"inspectionPaths"=hex(7):00,00
"ignorePaths"=hex(7):44,00,3a,00,5c,00,00,00,43,00,3a,00,5c,00,55,00,73,00,65,\
  00,72,00,73,00,5c,00,74,00,65,00,73,00,74,00,5c,00,44,00,6f,00,77,00,6e,00,\
  6c,00,6f,00,61,00,64,00,73,00,5c,00,00,00,43,00,3a,00,5c,00,55,00,73,00,65,\
  00,72,00,73,00,5c,00,74,00,65,00,73,00,74,00,5c,00,53,00,79,00,73,00,49,00,\
  6e,00,74,00,65,00,72,00,6e,00,61,00,6c,00,73,00,5c,00,00,00,00,00
</code></pre>
<p dir="auto">This file is safe to import.</p>
<p dir="auto">You can simply select it in <strong>Custom Software</strong>, remember to set the <strong>Installer Arguments</strong> to <code>IMPORT</code>.</p>
<p dir="auto">The package tool will run the following:<br />
<code>reg.exe IMPORT yourfile.reg</code></p>
<p dir="auto">It is important to understand, that this registry entry will prevent the agent from inspecting those folders and the contents will be completely hidden from the VulnDetect backend. This feature was originally intended for developers, IT-enthusiasts and users with e.g. old archive/backup drives attached.</p>
]]></description><link>https://vulndetect.org/topic/2388/registry-files-and-the-custom-software-feature</link><generator>RSS for Node</generator><lastBuildDate>Sun, 10 May 2026 04:49:36 GMT</lastBuildDate><atom:link href="https://vulndetect.org/topic/2388.rss" rel="self" type="application/rss+xml"/><pubDate>Mon, 16 May 2022 11:55:05 GMT</pubDate><ttl>60</ttl></channel></rss>