Windows Packages and CVEs
Following section lists the behavior of Windows agent with regard to reporting package information to Secure Workload.
-
Windows applications, PowerShell, IE are reported as packages. .net framework is also reported as a package.
-
Other Windows applications like notepad.exe, cmd.exe, mstsc.exe, and so on are not reported.
-
Windows server configured roles and features are reported as packages but the version may be incorrect. For example: If the DNS server is configured, reported version will either 0 or 8.
-
Windows agent reports 3rd party products installed using MSI installer or exe installer:
-
For MSI installers, MSI APIs are used to retrieve package information. For example, version, publisher, package name.
-
If the exe installer is used to install the package, package information is retrieved from the registry.
-
Package installer fields like version, publisher is optional. If version is missing, the package will not be reported.
-
If a product is extracted from zip file or installed as an app, it will not be reported in the package list.
-