From aa48d100464017c2b884adab1f8e6b5db57cd0b4 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Sun, 1 Mar 2026 16:09:56 +0200 Subject: [PATCH 01/13] ahhh --- dissect/target/plugins/os/windows/firewall.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dissect/target/plugins/os/windows/firewall.py b/dissect/target/plugins/os/windows/firewall.py index d19b1a8a56..3c2a4e931e 100644 --- a/dissect/target/plugins/os/windows/firewall.py +++ b/dissect/target/plugins/os/windows/firewall.py @@ -63,9 +63,9 @@ class WindowsFirewallPlugin(Plugin): LOGGING_KEYS = ( # Defaults - "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Defaults\\FirewallPolicy\\PublicProfile\\Logging" - "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Defaults\\FirewallPolicy\\StandardProfile\\Logging" - "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Defaults\\FirewallPolicy\\DomainProfile\\Logging" + "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Defaults\\FirewallPolicy\\PublicProfile\\Logging", + "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Defaults\\FirewallPolicy\\StandardProfile\\Logging", + "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Defaults\\FirewallPolicy\\DomainProfile\\Logging", # Parameters "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile\\Logging", "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\Logging", From 30155abec94074e095dde5059f53f5f9e567fb71 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Sun, 1 Mar 2026 16:30:28 +0200 Subject: [PATCH 02/13] huh --- dissect/target/plugins/apps/ssh/openssh.py | 10 ++++------ dissect/target/plugins/apps/ssh/opensshd.py | 6 ++++-- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/dissect/target/plugins/apps/ssh/openssh.py b/dissect/target/plugins/apps/ssh/openssh.py index 931674912b..1954bed91e 100644 --- a/dissect/target/plugins/apps/ssh/openssh.py +++ b/dissect/target/plugins/apps/ssh/openssh.py @@ -27,15 +27,15 @@ from dissect.target.target import Target -def find_sshd_directory(target: Target) -> TargetPath: +def find_sshd_directory(target: Target) -> TargetPath | None: + """finds which sshd directory exists on a given target, returns None if none exist""" SSHD_DIRECTORIES = ["/sysvol/ProgramData/ssh", "/etc/ssh"] for sshd in SSHD_DIRECTORIES: if (target_path := target.fs.path(sshd)).exists(): return target_path - # A default, so there is no need to check for None - return target.fs.path("/etc/ssh/") + return None class OpenSSHPlugin(SSHPlugin): @@ -43,8 +43,6 @@ class OpenSSHPlugin(SSHPlugin): __namespace__ = "openssh" - SSHD_DIRECTORIES = ("/sysvol/ProgramData/ssh", "/etc/ssh") - def __init__(self, target: Target): super().__init__(target) self.sshd_directory = find_sshd_directory(target) @@ -54,7 +52,7 @@ def check_compatible(self) -> None: user_details.home_path.joinpath(".ssh").exists() for user_details in self.target.user_details.all_with_home() ) - if not ssh_user_dirs and not self.sshd_directory.exists(): + if not ssh_user_dirs and not self.sshd_directory: raise UnsupportedPluginError("No OpenSSH directories found") def ssh_directory_globs(self, glob_user: str, glob_sshd: str) -> Iterator[tuple[UserDetails | None, TargetPath]]: diff --git a/dissect/target/plugins/apps/ssh/opensshd.py b/dissect/target/plugins/apps/ssh/opensshd.py index 4d831d9a19..2e803e6650 100644 --- a/dissect/target/plugins/apps/ssh/opensshd.py +++ b/dissect/target/plugins/apps/ssh/opensshd.py @@ -85,10 +85,12 @@ class SSHServerPlugin(SSHPlugin): def __init__(self, target: Target): super().__init__(target) self.sshd_directory = find_sshd_directory(target) - self.sshd_config_path = self.sshd_directory.joinpath("sshd_config") + self.sshd_config_path = ( + self.sshd_directory.joinpath("sshd_config") if self.sshd_directory else None + ) def check_compatible(self) -> None: - if not self.sshd_config_path.exists(): + if not (self.sshd_config_path and self.sshd_config_path.exists()): raise UnsupportedPluginError("No sshd config found") @export(record=DynamicDescriptor(["datetime", "path"])) From 08c6d58127a2b7909ffbcbc5e623fd3a341edc19 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Sun, 1 Mar 2026 16:31:41 +0200 Subject: [PATCH 03/13] glob should only return existing items --- dissect/target/plugins/os/windows/ual.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dissect/target/plugins/os/windows/ual.py b/dissect/target/plugins/os/windows/ual.py index c2eecd7663..0a37f668bd 100644 --- a/dissect/target/plugins/os/windows/ual.py +++ b/dissect/target/plugins/os/windows/ual.py @@ -181,7 +181,7 @@ def find_mdb_files(self) -> list[Path]: return [ path for path in self.target.resolve(base).glob(f"*{glob}") - if path.exists() and path.name != self.IDENTITY_DB_FILENAME + if path.name != self.IDENTITY_DB_FILENAME ] def populate_role_guid_map(self) -> None: From 30c53c929b32a87cfb64db8cbabf69a3328b0c6e Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Sun, 1 Mar 2026 16:45:28 +0200 Subject: [PATCH 04/13] improved variables i think --- dissect/target/plugins/os/windows/ual.py | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/dissect/target/plugins/os/windows/ual.py b/dissect/target/plugins/os/windows/ual.py index 0a37f668bd..93779e001c 100644 --- a/dissect/target/plugins/os/windows/ual.py +++ b/dissect/target/plugins/os/windows/ual.py @@ -156,15 +156,13 @@ class UalPlugin(Plugin): """ __namespace__ = "ual" - - LOG_DB_GLOB = "%windir%/System32/LogFiles/Sum/*.mdb" - - IDENTITY_DB_FILENAME = "SystemIdentity.mdb" - IDENTITY_DB_PATH = f"%windir%/System32/LogFiles/Sum/{IDENTITY_DB_FILENAME}" + LOG_DIR = "%windir%/System32/LogFiles/Sum/" + LOG_DB_GLOB = "*.mdb" + IDENTITY_FILE_NAME = f"SystemIdentity.mdb" def __init__(self, target: Target): super().__init__(target) - + self.identity_db_path = Path(self.LOG_DIR).joinpath(self.IDENTITY_FILE_NAME) self.mdb_paths = self.find_mdb_files() self.role_guid_map = {} @@ -176,16 +174,14 @@ def check_compatible(self) -> None: raise UnsupportedPluginError("No MDB files found") def find_mdb_files(self) -> list[Path]: - base, _, glob = self.LOG_DB_GLOB.partition("*") - return [ path - for path in self.target.resolve(base).glob(f"*{glob}") - if path.name != self.IDENTITY_DB_FILENAME + for path in self.target.resolve(self.LOG_DIR).glob(self.LOG_DB_GLOB) + if path.name != self.identity_db_path.name ] def populate_role_guid_map(self) -> None: - identity_db = self.target.resolve(self.IDENTITY_DB_PATH) + identity_db = self.target.resolve(self.identity_db_path) if not identity_db.exists(): return @@ -270,7 +266,7 @@ def system_identities(self) -> Iterator[SystemIdentityRecord]: for record in self.identity_db_parser.get_table_records("SYSTEM_IDENTITY"): values = {FIELD_NAME_MAP.get(key, key): value for key, value in record.items()} yield SystemIdentityRecord( - path=self.target.fs.path(self.IDENTITY_DB_PATH), + path=self.target.fs.path(self.identity_db_path), _target=self.target, **values, ) From f84fc5ec705a0cd97d146ae899e373fa0dabfa38 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Sun, 1 Mar 2026 16:46:29 +0200 Subject: [PATCH 05/13] very slight performance boost --- dissect/target/plugins/apps/webserver/iis.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dissect/target/plugins/apps/webserver/iis.py b/dissect/target/plugins/apps/webserver/iis.py index 186b4ee6c9..7bde27fc90 100644 --- a/dissect/target/plugins/apps/webserver/iis.py +++ b/dissect/target/plugins/apps/webserver/iis.py @@ -119,8 +119,8 @@ def _read_config_log_paths(self, dirs: dict[str, set[str]]) -> None: try: xml_data = ElementTree.fromstring(self.config.read_bytes(), forbid_dtd=True) for log_file_element in xml_data.findall("*/sites/*/logFile"): - log_format = log_file_element.get("logFormat") or "W3C" if log_dir := log_file_element.get("directory"): + log_format = log_file_element.get("logFormat") or "W3C" if log_format not in dirs: self.target.log.warning("Unsupported log format %s, skipping %s", log_format, log_dir) continue From d182ef70b21cb5bd8b39b97a139e84f5d83ec246 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Mon, 2 Mar 2026 18:56:20 +0200 Subject: [PATCH 06/13] fixed the types --- dissect/target/plugins/os/windows/regf/clsid.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/dissect/target/plugins/os/windows/regf/clsid.py b/dissect/target/plugins/os/windows/regf/clsid.py index 10c17ab3ad..e76ad9d69c 100644 --- a/dissect/target/plugins/os/windows/regf/clsid.py +++ b/dissect/target/plugins/os/windows/regf/clsid.py @@ -67,12 +67,10 @@ def create_records(self, keys: list[RegistryKey]) -> Iterator[CLSIDRecord]: Yields CLSIDRecords with fields: .. code-block:: text - - hostname (string): The target hostname. - domain (string): The target domain. ts (datetime): Last modified timestamp of the registry key. clsid (string): The CLSID key name. - path (uri): The CLSID path value. + name (string): + value (string): The target hostname. """ names = [ "InprocServer32", From e1616a9e4048665a66fffcf1966f716846863214 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Mon, 2 Mar 2026 19:09:55 +0200 Subject: [PATCH 07/13] fixes --- .../target/plugins/os/windows/regf/clsid.py | 78 ++++++++----------- 1 file changed, 34 insertions(+), 44 deletions(-) diff --git a/dissect/target/plugins/os/windows/regf/clsid.py b/dissect/target/plugins/os/windows/regf/clsid.py index e76ad9d69c..3ac51aea0b 100644 --- a/dissect/target/plugins/os/windows/regf/clsid.py +++ b/dissect/target/plugins/os/windows/regf/clsid.py @@ -47,31 +47,24 @@ class CLSIDPlugin(Plugin): """ __namespace__ = "clsid" - - KEYS: Final[dict[str, str]] = { - "user": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID", - "machine": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID", - } + USER_KEY = "HKEY_CURRENT_USER\\Software\\Classes\\CLSID" + MACHINE_KEY = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID" def __init__(self, target: Target): super().__init__(target) def check_compatible(self) -> None: - if not len(list(self.target.registry.keys(list(self.KEYS.values())))) > 0: + if not len(list(self.target.registry.keys((self.USER_KEY, self.MACHINE_KEY)))) > 0: raise UnsupportedPluginError("No CLSID key found") - def create_records(self, keys: list[RegistryKey]) -> Iterator[CLSIDRecord]: - """Iterate all CLSID keys from HKEY_CURRENT_USER\\Software\\Classes\\CLSID and - HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID. - - Yields CLSIDRecords with fields: - - .. code-block:: text - ts (datetime): Last modified timestamp of the registry key. - clsid (string): The CLSID key name. - name (string): - value (string): The target hostname. + def create_records(self, key: RegistryKey) -> Iterator[CLSIDRecord]: + """Iterates all CLSID keys from any CLSID registry + Args: + key: the ``RegistryKey`` to run on + Yields: + ``CLSIDRecords`` for each entry """ + names = [ "InprocServer32", "InprocServer", @@ -79,38 +72,35 @@ def create_records(self, keys: list[RegistryKey]) -> Iterator[CLSIDRecord]: "LocalServer32", ] - for reg in self.target.registry.keys(keys): - user = self.target.registry.get_user(reg) - - for subkey in reg.subkeys(): - try: - name = subkey.value("(default)").value - except RegistryError: - name = None - - for entry in subkey.subkeys(): - if entry.name in names: - try: - subkey_value = entry.value("(default)") - except RegistryError: - continue - - yield CLSIDRecord( - ts=entry.ts, - clsid=subkey.name, - name=name, - value=subkey_value.value, - _target=self.target, - _user=user, - _key=entry, - ) + for subkey in key.subkeys(): + try: + name = subkey.value("(default)").value + except RegistryError: + name = None + + for entry in subkey.subkeys(): + if entry.name in names: + try: + subkey_value = entry.value("(default)") + except RegistryError: + continue + + yield CLSIDRecord( + ts=entry.ts, + clsid=subkey.name, + name=name, + value=subkey_value.value, + _target=self.target, + _user=user, + _key=entry, + ) @export(record=CLSIDRecord) def user(self) -> Iterator[CLSIDRecord]: """Return only the user CLSID registry keys.""" - yield from self.create_records(self.KEYS["user"]) + yield from self.create_records(self.USER_KEY) @export(record=CLSIDRecord) def machine(self) -> Iterator[CLSIDRecord]: """Return only the machine CLSID registry keys.""" - yield from self.create_records(self.KEYS["machine"]) + yield from self.create_records(self.MACHINE_KEY) From ae43cf7bbff91512d37138566a44f43f32283c67 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Mon, 2 Mar 2026 19:16:13 +0200 Subject: [PATCH 08/13] temp fix --- dissect/target/plugins/os/windows/regf/clsid.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dissect/target/plugins/os/windows/regf/clsid.py b/dissect/target/plugins/os/windows/regf/clsid.py index 3ac51aea0b..66b605a1c8 100644 --- a/dissect/target/plugins/os/windows/regf/clsid.py +++ b/dissect/target/plugins/os/windows/regf/clsid.py @@ -71,7 +71,8 @@ def create_records(self, key: RegistryKey) -> Iterator[CLSIDRecord]: "LocalServer", "LocalServer32", ] - + print(dir(self.target.registry)) + key = self.target.registry.key(key) for subkey in key.subkeys(): try: name = subkey.value("(default)").value From f4b221bc13f74fc562f07ebdd5386b1eab0bdf61 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Mon, 2 Mar 2026 19:18:25 +0200 Subject: [PATCH 09/13] fixed. --- dissect/target/plugins/os/windows/regf/clsid.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dissect/target/plugins/os/windows/regf/clsid.py b/dissect/target/plugins/os/windows/regf/clsid.py index 66b605a1c8..ac69a5c4bf 100644 --- a/dissect/target/plugins/os/windows/regf/clsid.py +++ b/dissect/target/plugins/os/windows/regf/clsid.py @@ -1,6 +1,6 @@ from __future__ import annotations -from typing import TYPE_CHECKING, Final +from typing import TYPE_CHECKING from dissect.target.exceptions import RegistryError, UnsupportedPluginError from dissect.target.helpers.descriptor_extensions import ( @@ -57,10 +57,10 @@ def check_compatible(self) -> None: if not len(list(self.target.registry.keys((self.USER_KEY, self.MACHINE_KEY)))) > 0: raise UnsupportedPluginError("No CLSID key found") - def create_records(self, key: RegistryKey) -> Iterator[CLSIDRecord]: + def create_records(self, key_path: RegistryKey) -> Iterator[CLSIDRecord]: """Iterates all CLSID keys from any CLSID registry Args: - key: the ``RegistryKey`` to run on + key: a ``str`` representing the path to the key Yields: ``CLSIDRecords`` for each entry """ @@ -71,8 +71,8 @@ def create_records(self, key: RegistryKey) -> Iterator[CLSIDRecord]: "LocalServer", "LocalServer32", ] - print(dir(self.target.registry)) - key = self.target.registry.key(key) + key = self.target.registry.key(key_path) + user = self.target.registry.get_user(key) for subkey in key.subkeys(): try: name = subkey.value("(default)").value From 743ee2c06f0eb669c636cef48d497bef8e2b8ee9 Mon Sep 17 00:00:00 2001 From: loaflover <34983803+loaflover@users.noreply.github.com> Date: Mon, 2 Mar 2026 19:19:19 +0200 Subject: [PATCH 10/13] ruff --- dissect/target/plugins/apps/ssh/opensshd.py | 4 +--- dissect/target/plugins/os/windows/ual.py | 4 ++-- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/dissect/target/plugins/apps/ssh/opensshd.py b/dissect/target/plugins/apps/ssh/opensshd.py index 2e803e6650..e4ab4d74cd 100644 --- a/dissect/target/plugins/apps/ssh/opensshd.py +++ b/dissect/target/plugins/apps/ssh/opensshd.py @@ -85,9 +85,7 @@ class SSHServerPlugin(SSHPlugin): def __init__(self, target: Target): super().__init__(target) self.sshd_directory = find_sshd_directory(target) - self.sshd_config_path = ( - self.sshd_directory.joinpath("sshd_config") if self.sshd_directory else None - ) + self.sshd_config_path = self.sshd_directory.joinpath("sshd_config") if self.sshd_directory else None def check_compatible(self) -> None: if not (self.sshd_config_path and self.sshd_config_path.exists()): diff --git a/dissect/target/plugins/os/windows/ual.py b/dissect/target/plugins/os/windows/ual.py index 93779e001c..e3ec6376cf 100644 --- a/dissect/target/plugins/os/windows/ual.py +++ b/dissect/target/plugins/os/windows/ual.py @@ -1,5 +1,6 @@ from __future__ import annotations +from pathlib import Path from typing import TYPE_CHECKING, Any from dissect.database.ese.tools import ual @@ -11,7 +12,6 @@ if TYPE_CHECKING: from collections.abc import Iterator - from pathlib import Path from dissect.target.target import Target @@ -158,7 +158,7 @@ class UalPlugin(Plugin): __namespace__ = "ual" LOG_DIR = "%windir%/System32/LogFiles/Sum/" LOG_DB_GLOB = "*.mdb" - IDENTITY_FILE_NAME = f"SystemIdentity.mdb" + IDENTITY_FILE_NAME = "SystemIdentity.mdb" def __init__(self, target: Target): super().__init__(target) From 40821e57f8956c6a62375b5e95b8c3cbe79c23af Mon Sep 17 00:00:00 2001 From: nir Date: Wed, 11 Mar 2026 12:53:45 +0200 Subject: [PATCH 11/13] fix --- dissect/target/plugins/apps/ssh/openssh.py | 4 ++-- tests/plugins/apps/ssh/test_opensshd.py | 9 ++++++--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/dissect/target/plugins/apps/ssh/openssh.py b/dissect/target/plugins/apps/ssh/openssh.py index bdca68c53c..1dd32c0937 100644 --- a/dissect/target/plugins/apps/ssh/openssh.py +++ b/dissect/target/plugins/apps/ssh/openssh.py @@ -58,8 +58,8 @@ def check_compatible(self) -> None: def ssh_directory_globs(self, glob_user: str, glob_sshd: str) -> Iterator[tuple[UserDetails | None, TargetPath]]: for user_details in self.target.user_details.all_with_home(): yield from product([user_details], user_details.home_path.glob(f".ssh/{glob_user}")) - - yield from product([None], self.sshd_directory.glob(glob_sshd)) + if self.sshd_directory is not None: + yield from product([None], self.sshd_directory.glob(glob_sshd)) @export(record=AuthorizedKeysRecord) def authorized_keys(self) -> Iterator[AuthorizedKeysRecord]: diff --git a/tests/plugins/apps/ssh/test_opensshd.py b/tests/plugins/apps/ssh/test_opensshd.py index e07508c110..de51a3cc89 100644 --- a/tests/plugins/apps/ssh/test_opensshd.py +++ b/tests/plugins/apps/ssh/test_opensshd.py @@ -13,9 +13,11 @@ def test_sshd_config_plugin(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None: + config_file = absolute_path("_data/plugins/apps/ssh/opensshd/sshd_config") + fs_unix.map_file("/etc/ssh/sshd_config", config_file) plugin = SSHServerPlugin(target_unix_users) - fs_unix.map_file(str(plugin.sshd_config_path), config_file) + target_unix_users.add_plugin(SSHServerPlugin) results = list(target_unix_users.opensshd.config()) @@ -41,11 +43,12 @@ def test_sshd_config_plugin_multiple_definitions(target_unix_users: Target, fs_u ListenAddress 9.8.7.6 """ - plugin = SSHServerPlugin(target_unix_users) + fs_unix.map_file_fh( - str(plugin.sshd_config_path), + "/etc/ssh/sshd_config", BytesIO(textwrap.dedent(config).encode()), ) + plugin = SSHServerPlugin(target_unix_users) target_unix_users.add_plugin(SSHServerPlugin) results = list(target_unix_users.opensshd.config()) From 5b87807834ebaad343fc957c917d73a8984765ea Mon Sep 17 00:00:00 2001 From: nir Date: Wed, 11 Mar 2026 13:04:26 +0200 Subject: [PATCH 12/13] fix..? --- dissect/target/plugins/os/windows/ual.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dissect/target/plugins/os/windows/ual.py b/dissect/target/plugins/os/windows/ual.py index 5e4f5b5e28..8ab3656768 100644 --- a/dissect/target/plugins/os/windows/ual.py +++ b/dissect/target/plugins/os/windows/ual.py @@ -163,7 +163,7 @@ class UalPlugin(Plugin): def __init__(self, target: Target): super().__init__(target) - self.identity_db_path = Path(self.LOG_DIR).joinpath(self.IDENTITY_FILE_NAME) + self.identity_db_path = f"{self.LOG_DIR}{self.IDENTITY_FILE_NAME}" self.mdb_paths = self.find_mdb_files() self.role_guid_map = {} @@ -182,7 +182,7 @@ def find_mdb_files(self) -> list[Path]: ] def populate_role_guid_map(self) -> None: - identity_db = self.target.resolve(self.identity_db_path) + identity_db = self.target.resolve(str(self.identity_db_path)) if not identity_db.exists(): return From e6e00604c8456758a6aaf1d6f4f908b168ce6780 Mon Sep 17 00:00:00 2001 From: nir Date: Wed, 11 Mar 2026 13:13:54 +0200 Subject: [PATCH 13/13] maybe the end --- dissect/target/plugins/os/windows/ual.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dissect/target/plugins/os/windows/ual.py b/dissect/target/plugins/os/windows/ual.py index 8ab3656768..3d69ab9bc0 100644 --- a/dissect/target/plugins/os/windows/ual.py +++ b/dissect/target/plugins/os/windows/ual.py @@ -178,7 +178,7 @@ def find_mdb_files(self) -> list[Path]: return [ path for path in self.target.resolve(self.LOG_DIR).glob(self.LOG_DB_GLOB) - if path.name != self.identity_db_path.name + if path.name != Path(self.identity_db_path).name ] def populate_role_guid_map(self) -> None: