Detection:
# Specify the registry path and key to check
$registryPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
$keyToCheck = "CiscoSpark"
# Check if the registry path exists
if (Test-Path $registryPath) {
# Get the registry key
$key = Get-ItemProperty -Path $registryPath -Name $keyToCheck -ErrorAction SilentlyContinue
if ($key -ne $null) {
Write-Host "Key '$keyToCheck' is present in the registry path '$registryPath'."
Exit 1
} else {
Write-Host "Key '$keyToCheck' is not present in the registry path '$registryPath'."
Exit 0
}
} else {
Write-Host "Registry path '$registryPath' does not exist."
Exit 0
}
Remediation:
$registryPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" $keyToDelete = "CiscoSpark" Remove-ItemProperty -Path $registryPath -Name $keyToDelete -ErrorAction SilentlyContinue