Adjusted typo of CurrentControlSet

[marcurdy]

Small change.

[codecov]

Codecov Report

Merging #347 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #347   +/-   ##
=======================================
  Coverage   91.19%   91.19%           
=======================================
  Files           7        7           
  Lines         420      420           
=======================================
  Hits          383      383           
  Misses         37       37

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ff2ea0c...65219df. Read the comment docs.

[joachimmetz]

Thx, for the corrections

[marcurdy]

YW. I've created a script to use your yamls as input and create plaso tag files.

…

On Tue, Jun 11, 2019 at 10:50 PM Joachim Metz ***@***.***> wrote: Thx, for the corrections — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#347?email_source=notifications&email_token=ABL52RC6TP2TQQKFVOXBL6LP2BW7FA5CNFSM4HXC53Y2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODXPFK3Y#issuecomment-501110127>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABL52RB6X45OG63L4UHZMQLP2BW7FANCNFSM4HXC53YQ> .

[joachimmetz]

Ack, know that plaso directly supports artifacts as collection filters as well

[marcurdy]

I only learned this 20 minutes ago. Thank you for your huge contributions! One question on the windows yaml. WindowsCOMLocalServers contains different description styles. One places the LocalServer as a value. The second puts it alongside the key and leaves the value empty. Is this intentional? "key": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\*", "value": "LocalServer" }, { "key": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\*\\LocalServer32", "value": "" WindowsCOMInprocServers puts all values in the key leaving value along. Cheers

…

On Wed, Jun 12, 2019 at 9:06 AM Joachim Metz ***@***.***> wrote: Ack, know that plaso directly supports artifacts as collection filters as well — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#347?email_source=notifications&email_token=ABL52RCROWJNOK7GPXY6SHDP2D7E3A5CNFSM4HXC53Y2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODXQRB5A#issuecomment-501289204>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABL52RG6SCC2A7AZWRNWQQ3P2D7E3ANCNFSM4HXC53YQ> .

[joachimmetz]

The first means key with value LocalServer, the second means default value of key. I'll double check but the second could be an error (#348). For GRR historically this does not make a difference because the value is appended to the key path (which can cause issues with e.g. bagmru paths where subkey and value names are the same).