Scope checks
On this page
A pivot point checked directly on disk or in the registry.
pivot_check
pivot point checked directly (now). this file is on disk, or this registry key exists, now - not when it arrived, who put it there, or that it ran
Kind | State - something true when Signal read the host |
Built-in rules reading it | 0 |
Fields of pivot_check
Field | Type | Meaning |
|---|---|---|
| string | What was checked directly for a pivot point: the file's path, or the registry key (HKLM\..., HKU\<SID>\...). |
| string | What the direct check found, in words: "the file is on disk now" with its size and times, or "the key exists now" with its last write. A check that found nothing is not a record (the Scope module's pivots table says so). |