Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//NOFORN
6.2 Contains
The “contains” verb states that a registry key contains a key or value of a given
name.
A depth is provided to perform a recursive search on subkeys. A depth of 0 will
not search any subkeys, a depth of 1 will search the first level of subdirectories,
etc.
Usage
reg_key(<hive_name>, <key_path>).contains(<val_name>, <depth>)
hive_name
Name of registry hive
key_path
Path of registry key within the hive
val_name
Name of value or subkey within key
depth
Recursive search depth
Truth Table
TRUE
hive_name\key_path contains a value or key val_name within depth
levels
FALSE
hive_name\key_path does not contain a value or key val_name within
depth levels
INVALID
Key does not exist or error occurred while collecting registry
information
122
SECRET//NOFORN