{
  "win_version": {
    "query": "select tb1.name, tb1.build_version, (case when (arch like '%-bit') then concat('x', replace(arch,'-bit', '')) else arch end) as arch, 'Microsoft' as publisher, tb2.version from (select name, version as build_version, arch from os_version) tb1,(select data as version from registry where path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion') tb2;",
    "name": "win_version",
    "description": "Retrieves the name, version number, build version, and arch of the target Windows system.",
    "purlType": "swid",
    "componentType": "operating-system"
  },
  "kernel_info": {
    "query": "select * from kernel_info;",
    "name": "os-image",
    "description": "Retrieves information from the current kernel in the target system.",
    "purlType": "swid"
  },
  "chrome_extensions": {
    "query": "select chrome_extensions.* from users join chrome_extensions using (uid);",
    "description": "Retrieves the list of extensions for Chrome in the target system.",
    "purlType": "chrome-extension",
    "componentType": "application"
  },
  "firefox_addons": {
    "query": "select firefox_addons.* from users join firefox_addons using (uid);",
    "description": "Retrieves the list of addons for Firefox in the target system.",
    "purlType": "swid",
    "componentType": "application"
  },
  "vscode_extensions": {
    "query": "select vscode_extensions.* from users join vscode_extensions using (uid);",
    "description": "Lists all vscode extensions.",
    "purlType": "vscode-extension",
    "componentType": "application"
  },
  "browser_plugins": {
    "query": "select browser_plugins.* from users join browser_plugins using (uid);",
    "description": "Retrieves the list of C/NPAPI browser plugin in the target system.",
    "purlType": "swid"
  },
  "ie_extensions": {
    "query": "select * from ie_extensions;",
    "description": "Retrieves the list of extensions for IE in the target system.",
    "purlType": "swid"
  },
  "opera_extensions": {
    "query": "select opera_extensions.* from users join opera_extensions using (uid);",
    "description": "Retrieves the list of extensions for opera in the target system.",
    "purlType": "swid"
  },
  "safari_extensions": {
    "query": "select safari_extensions.* from users join safari_extensions using (uid);",
    "description": "Retrieves the list of extensions for safari in the target system.",
    "purlType": "swid"
  },
  "python_packages": {
    "query": "select * from python_packages;",
    "description": "Python packages installed on system.",
    "purlType": "pypi"
  },
  "windows_programs": {
    "query": "select * from programs;",
    "description": "Retrieves the list of products as they are installed by Windows Installer in the target Windows system.",
    "purlType": "swid"
  },
  "windows_patches": {
    "query": "select * from patches;",
    "description": "Retrieves all the information for the current windows drivers in the target Windows system.",
    "purlType": "swid"
  },
  "windows_drivers": {
    "query": "select * from drivers;",
    "description": "Retrieves all the information for the current windows drivers in the target Windows system.",
    "purlType": "swid"
  },
  "windows_shared_resources": {
    "query": "select * from shared_resources;",
    "description": "Retrieves the list of shared resources in the target Windows system.",
    "purlType": "swid",
    "componentType": "data"
  },
  "appcompat_shims": {
    "query": "SELECT * FROM appcompat_shims WHERE description!='EMET_Database' AND executable NOT IN ('setuphost.exe','setupprep.exe','iisexpress.exe');",
    "description": "Appcompat shims (.sdb files) installed on Windows hosts.",
    "purlType": "swid",
    "componentType": "data"
  },
  "system_info_snapshot": {
    "query": "SELECT * FROM system_info;",
    "description": "System info snapshot query.",
    "purlType": "swid",
    "componentType": "data"
  },
  "users_snapshot": {
    "query": "SELECT username as name, uuid as version, description, directory, uid, type, gid FROM users;",
    "description": "Local and domain-backed user account inventory on Windows endpoints.",
    "purlType": "swid",
    "componentType": "data"
  },
  "logged_in_users_snapshot": {
    "query": "SELECT user as name, '' as version, type as description, pid, host, tty, time, sid, registry_hive FROM logged_in_users;",
    "description": "Interactive and remote user sessions active on the endpoint.",
    "purlType": "swid",
    "componentType": "data"
  },
  "logon_sessions": {
    "query": "SELECT user as name, logon_type as version, authentication_package as description, logon_id, logon_domain, session_id, logon_sid, logon_time, logon_server, dns_domain_name, upn, profile_path, home_directory, home_directory_drive FROM logon_sessions;",
    "description": "Windows logon session inventory for authentication and identity investigations.",
    "purlType": "swid",
    "componentType": "data"
  },
  "pipes_snapshot": {
    "query": "SELECT processes.path, processes.cmdline, processes.uid, processes.on_disk, pipes.name, pid FROM pipes JOIN processes USING (pid);",
    "description": "Pipes snapshot query.",
    "purlType": "swid",
    "componentType": "data"
  },
  "process_open_handles_snapshot": {
    "query": "SELECT processes.name, process_open_handles.type as version, process_open_handles.name as description, processes.path, processes.cmdline, processes.pid, process_open_handles.value, process_open_handles.type, process_open_handles.name as handle_name, process_open_handles.access, process_open_handles.attributes, process_open_handles.count, process_open_handles.raw_pointer_count, process_open_handles.error_stage, process_open_handles.error_code FROM processes JOIN process_open_handles USING (pid) WHERE process_open_handles.name != '' AND processes.name IN ('powershell.exe', 'pwsh.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe', 'wmic.exe', 'certutil.exe', 'bitsadmin.exe') AND ((process_open_handles.type = 'File' AND (lower(process_open_handles.name) LIKE '%\\appdata\\local\\temp\\%' OR lower(process_open_handles.name) LIKE '%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\%' OR lower(process_open_handles.name) LIKE '%\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\%' OR lower(process_open_handles.name) LIKE '%\\windows\\tasks\\%' OR lower(process_open_handles.name) LIKE '%\\system32\\tasks\\%' OR lower(process_open_handles.name) LIKE '%\\wbem\\repository\\%')) OR (process_open_handles.type = 'Key' AND (lower(process_open_handles.name) LIKE '%\\software\\microsoft\\windows\\currentversion\\run%' OR lower(process_open_handles.name) LIKE '%\\software\\microsoft\\windows\\currentversion\\runonce%' OR lower(process_open_handles.name) LIKE '%\\software\\microsoft\\windows nt\\currentversion\\winlogon%' OR lower(process_open_handles.name) LIKE '%\\system\\currentcontrolset\\services\\%' OR lower(process_open_handles.name) LIKE '%\\software\\microsoft\\windows nt\\currentversion\\schedule\\taskcache\\%' OR lower(process_open_handles.name) LIKE '%\\software\\microsoft\\wbem\\cimom%')));",
    "description": "Open handles owned by high-signal scripting and proxy-execution processes, filtered to persistence-oriented file and registry locations on Windows endpoints.",
    "purlType": "swid",
    "componentType": "data"
  },
  "services_snapshot": {
    "query": "SELECT * FROM services;",
    "description": "Services snapshot query.",
    "purlType": "swid",
    "componentType": "data"
  },
  "wmi_cli_event_consumers": {
    "query": "SELECT * FROM wmi_cli_event_consumers;",
    "description": "WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.",
    "purlType": "swid",
    "componentType": "data"
  },
  "wmi_filter_consumer_binding": {
    "query": "SELECT * FROM wmi_filter_consumer_binding;",
    "description": "Lists the relationship between event consumers and filters.",
    "purlType": "swid",
    "componentType": "data"
  },
  "wmi_cli_event_consumers_snapshot": {
    "query": "SELECT * FROM wmi_cli_event_consumers;",
    "description": "Snapshot query for WMI event consumers.",
    "purlType": "swid",
    "componentType": "data"
  },
  "certificates": {
    "query": "SELECT * FROM certificates WHERE path != 'Other People';",
    "description": "List all certificates in the trust store.",
    "purlType": "swid",
    "componentType": "data"
  },
  "wmi_event_filters": {
    "query": "SELECT * FROM wmi_event_filters;",
    "description": "Lists WMI event filters.",
    "purlType": "swid",
    "componentType": "data"
  },
  "windows_security_products": {
    "query": "SELECT * FROM windows_security_products;",
    "description": "Registered endpoint security products and signature posture.",
    "purlType": "swid",
    "componentType": "data"
  },
  "windows_security_center": {
    "query": "SELECT antivirus as name, firewall as version, autoupdate as description, internet_settings, windows_security_center_service, user_account_control FROM windows_security_center;",
    "description": "Windows Security Center overall protection health indicators.",
    "purlType": "swid",
    "componentType": "data"
  },
  "windows_bitlocker_info": {
    "query": "SELECT device_id as name, drive_letter as version, encryption_method as description, persistent_volume_id, conversion_status, protection_status, percentage_encrypted, lock_status FROM bitlocker_info;",
    "description": "BitLocker protection and encryption state for local drives.",
    "purlType": "swid",
    "componentType": "data"
  },
  "windows_run_keys": {
    "query": "SELECT path as name, mtime as version, data as description, key, type FROM registry WHERE (key LIKE 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\%' OR key LIKE 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\%' OR key LIKE 'HKEY_USERS\\%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\%' OR key LIKE 'HKEY_USERS\\%\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\%') AND type != 'subkey';",
    "description": "Registry Run/RunOnce autostart entries commonly abused for persistence.",
    "purlType": "swid",
    "componentType": "data"
  },
  "etc_hosts": {
    "query": "SELECT * FROM etc_hosts;",
    "description": "List the contents of the Windows hosts file.",
    "purlType": "swid",
    "componentType": "data"
  },
  "scheduled_tasks": {
    "query": "SELECT * FROM scheduled_tasks;",
    "description": "List all scheduled_tasks.",
    "purlType": "swid",
    "componentType": "data"
  },
  "chocolatey_packages": {
    "query": "SELECT * FROM chocolatey_packages;",
    "description": "List all chocolatey_packages.",
    "purlType": "chocolatey"
  },
  "npm_packages": {
    "query": "SELECT * FROM npm_packages;",
    "description": "List all npm_packages.",
    "purlType": "npm"
  },
  "startup_items": {
    "query": "SELECT * FROM startup_items;",
    "description": "List all startup_items.",
    "purlType": "swid",
    "componentType": "data"
  },
  "routes": {
    "query": "SELECT * FROM routes;",
    "description": "List all routes.",
    "purlType": "swid",
    "componentType": "data"
  },
  "listening_ports": {
    "query": "SELECT DISTINCT process.name, listening.port, listening.protocol, listening.family, listening.address, process.pid, process.path, process.cmdline, process.cwd, process.uid, process.on_disk, process.parent, process.start_time FROM processes AS process JOIN listening_ports AS listening ON process.pid = listening.pid;",
    "description": "List all processes and their listening_ports.",
    "purlType": "swid",
    "componentType": "application"
  },
  "processes": {
    "query": "SELECT * FROM processes;",
    "description": "List all processes.",
    "purlType": "swid",
    "componentType": "data"
  },
  "process_open_sockets": {
    "query": "SELECT * FROM process_open_sockets;",
    "description": "List all process_open_sockets.",
    "purlType": "swid",
    "componentType": "data"
  },
  "windows_update_history": {
    "query": "SELECT * FROM windows_update_history;",
    "description": "List all windows_update_history.",
    "purlType": "swid",
    "componentType": "data"
  },
  "windows_optional_features": {
    "query": "SELECT * FROM windows_optional_features;",
    "description": "List all windows_optional_features.",
    "purlType": "swid",
    "componentType": "data"
  },
  "windows_firewall_rules": {
    "query": "SELECT * FROM windows_firewall_rules;",
    "description": "List all windows_firewall_rules.",
    "purlType": "swid",
    "componentType": "data"
  },
  "logical_drives": {
    "query": "SELECT * FROM logical_drives;",
    "description": "List all logical_drives.",
    "purlType": "swid",
    "componentType": "device"
  }
}