fix(processors): Overwrite KCB handle

rabbitstack · Feb 25, 2025 · 818fa7b · 818fa7b
1 parent 361ed84
commit 818fa7b
Showing 1 changed file with 1 addition and 3 deletions.
diff --git a/internal/etw/processors/registry_windows.go b/internal/etw/processors/registry_windows.go
@@ -87,9 +87,7 @@ func (r *registryProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, erro
 	switch e.Type {
 	case ktypes.RegKCBRundown, ktypes.RegCreateKCB:
 		khandle := e.Kparams.MustGetUint64(kparams.RegKeyHandle)
-		if _, ok := r.keys[khandle]; !ok {
-			r.keys[khandle], _ = e.Kparams.GetString(kparams.RegPath)
-		}
+		r.keys[khandle] = e.Kparams.MustGetString(kparams.RegPath)
 		kcbCount.Add(1)
 	case ktypes.RegDeleteKCB:
 		khandle := e.Kparams.MustGetUint64(kparams.RegKeyHandle)