Skip to content

Windows Network, Registry, and Service Commands

These commands run on the connected Windows agent's local machine, using the compatible managed or native implementation offered by its command template.

Use net-info to inspect network state, the reg-* family to work with the registry, and the svc-* family to inspect and manage Windows services. They are included in the standard plugin command set. Execution options are described in Execution Context.

Network inspection

net-info collects interfaces, routes, neighbors, connections, listening endpoints, and DNS configuration. It does not require parameters.

Parameter Default Values or behavior
view ALL ALL, INTERFACES, ROUTES, NEIGHBORS, CONNECTIONS, DNS
addressFamily ALL ALL, IPV4, IPV6
protocol ALL ALL, TCP, UDP; applies to connections
state ALL ALL, LISTENING, ESTABLISHED; UDP bound endpoints count as listening
resolveProcessNames false Include owning process names for connection rows
maxEntries 1000 Maximum entries returned per selected section
saveDiscovery false Save eligible neighbors and local listening endpoints to Discovery after successful completion

For example, list IPv4 interfaces or inspect listening TCP endpoints:

1
2
net-info --view INTERFACES --addressFamily IPV4
net-info --view CONNECTIONS --protocol TCP --state LISTENING

Network inspection is separate from the interface metadata reported automatically by an agent. Use it when you need the current routing, connection, or DNS state.

Registry commands

Command Purpose Required parameters
reg-list List a key's contents key
reg-get Read named, default, or all values key, target
reg-search Search under a key key, pattern
reg-set Write a named or default value key, target, type
reg-delete Delete a key, named value, or default value key, target
reg-copy Copy a key tree within one hive sourceKey, destinationKey

All registry commands accept view: NATIVE (default), REGISTRY32, or REGISTRY64. Choose an explicit view when inspecting software that uses the other registry view on 64-bit Windows.

key includes the hive, such as HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion. The target parameter selects a registry item, not a remote computer:

  • reg-get: VALUE, DEFAULT_VALUE, or ALL_VALUES.
  • reg-set: VALUE or DEFAULT_VALUE.
  • reg-delete: KEY, VALUE, or DEFAULT_VALUE.

Supply valueName when using target VALUE. reg-set supports STRING, EXPAND_STRING, MULTI_STRING, DWORD, QWORD, and BINARY; use multiStringData for a multi-string value and data for other types, with binary data encoded as Base64.

reg-search uses matchMode CONTAINS by default; WILDCARD supports * and ?. Recursive key deletion requires recursive true. reg-copy requires both paths to use the same hive and defaults to overwrite false.

Read-only examples:

1
2
reg-list --key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" --view REGISTRY64
reg-get --key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" --target VALUE --valueName ProductName --view REGISTRY64

Service commands

Command Purpose Required parameters
svc-list List local services None
svc-query Inspect one service name
svc-start Start a service name
svc-stop Stop a service name
svc-create Create a service name, binaryPath
svc-modify Change a service's configuration name, plus the fields to change
svc-delete Delete a service name

name is the exact service name, not its display name. Service permissions are evaluated using the command's execution identity.

svc-list accepts listState (ALL, ACTIVE, or INACTIVE) and an optional case-insensitive pattern matching service names or display names. svc-start accepts an arguments array. Create and modify support displayName, description, binaryPath, startType (AUTO, DEMAND, DISABLED), account, and dependencies. The account field supports passwordless service accounts; plaintext service-account passwords are not supported.

binaryPath is the complete Service Control Manager configuration string, including any required quoting and arguments. svc-create defaults to startType DEMAND. In svc-modify, an empty description clears it and an empty dependencies array removes dependencies.

Read-only examples:

1
2
svc-list --listState ACTIVE
svc-query --name Spooler

These service commands operate locally. For the existing remote workflows, see jump-service and remote-exec-service.