Moved file linking rules into the registry_hive file enrichment module

- Moved file linking rules into the `registry_hive file` enrichment module, eliminated the static rules (so existing paths can be linked)

libs/chromium/chromium/local_state.py

@@ -3,6 +3,7 @@
 import base64
 import json
 import ntpath
+import asyncio
 
 import psycopg
 from common.logger import get_logger
@@ -192,7 +193,7 @@ async def _insert_state_keys(
                                 app_bound_key_dec = derive_abe_key(abe_parsed)
                                 if app_bound_key_dec:
                                     app_bound_key_is_decrypted = True
-                                    logger.warning(
+                                    logger.debug(
                                         "Successfully derived ABE key",
                                         version=abe_parsed.get("version"),
                                         system_masterkey_guid=app_bound_key_system_masterkey_guid,

libs/file_enrichment_modules/file_enrichment_modules/registry_hive/analyzer.py

@@ -131,7 +131,6 @@ class RegistryHiveAnalyzer(EnrichmentModule):
 
                     result = cur.fetchone()
                     if result:
-                        print(f"XXX result: {result}")
                         return str(result["object_id"])  # Convert UUID to string
 
         except Exception as e:
@@ -139,6 +138,36 @@ class RegistryHiveAnalyzer(EnrichmentModule):
 
         return None
 
+    def _get_existing_hive_path(self, file_enriched, standard_path: str) -> str:
+        """Get the actual path of an existing hive, or return the standard path if not found."""
+        # First try to find an existing hive
+        object_id = self._find_existing_hive(file_enriched, standard_path)
+
+        if object_id:
+            # Found an existing hive, get its actual path from the database
+            try:
+                with psycopg.connect(self._conninfo, row_factory=dict_row) as conn:
+                    with conn.cursor() as cur:
+                        cur.execute(
+                            """
+                            SELECT path
+                            FROM files_enriched
+                            WHERE object_id = %s
+                            LIMIT 1
+                        """,
+                            (object_id,),
+                        )
+
+                        result = cur.fetchone()
+                        if result and result["path"]:
+                            logger.debug(f"Found existing hive at {result['path']} instead of {standard_path}")
+                            return result["path"]
+            except Exception as e:
+                logger.error(f"Failed to get path for existing hive {object_id}: {e}")
+
+        # Fall back to standard path if not found or on error
+        return standard_path
+
     def _create_proactive_file_linkings(self, file_enriched, hive_type: str):
         """Create proactive file linkings based on hive type."""
         if not file_enriched.source or not file_enriched.path:
@@ -152,8 +181,12 @@ class RegistryHiveAnalyzer(EnrichmentModule):
         try:
             if hive_type == "SYSTEM":
                 # Link to SAM and SECURITY hives
-                sam_path = f"{drive}\\Windows\\System32\\Config\\SAM"
-                security_path = f"{drive}\\Windows\\System32\\Config\\SECURITY"
+                # First check if they exist at non-standard locations
+                sam_standard_path = f"{drive}\\Windows\\System32\\Config\\SAM"
+                security_standard_path = f"{drive}\\Windows\\System32\\Config\\SECURITY"
+
+                sam_path = self._get_existing_hive_path(file_enriched, sam_standard_path)
+                security_path = self._get_existing_hive_path(file_enriched, security_standard_path)
 
                 add_file_linking(
                     source=file_enriched.source,
@@ -173,7 +206,9 @@ class RegistryHiveAnalyzer(EnrichmentModule):
 
             elif hive_type in ["SAM", "SECURITY"]:
                 # Link to SYSTEM hive
-                system_path = f"{drive}\\Windows\\System32\\Config\\SYSTEM"
+                # First check if it exists at a non-standard location
+                system_standard_path = f"{drive}\\Windows\\System32\\Config\\SYSTEM"
+                system_path = self._get_existing_hive_path(file_enriched, system_standard_path)
 
                 add_file_linking(
                     source=file_enriched.source,

libs/file_linking/file_linking/rules/windows/security.yaml

@@ -1,19 +0,0 @@
-name: "hive_security"
-description: "Link SECURITY hive to SYSTEM hive"
-category: "windows"
-enabled: true
-
-triggers:
-  - file_patterns:
-      - "**/Windows/System32/config/SECURITY"
-    magic_patterns:
-      - "MS Windows registry file, NT/2000 or above"
-
-linked_files:
-
-  - name: "system_hive"
-    description: "SYSTEM registry hive"
-    path_templates:
-      - 'C:\Windows\System32\config\SYSTEM'
-    priority: "high"
-    collection_reason: "Linked hive"

libs/file_linking/file_linking/rules/windows/system.yaml

@@ -1,18 +0,0 @@
-name: "hive_system"
-description: "Link SYSTEM hive to SECURITY hive"
-category: "windows"
-enabled: true
-
-triggers:
-  - file_patterns:
-      - "**/Windows/System32/config/SYSTEM"
-    magic_patterns:
-      - "MS Windows registry file, NT/2000 or above"
-
-linked_files:
-  - name: "security_hive"
-    description: "SECURITY registry hive"
-    path_templates:
-      - 'C:\Windows\System32\config\security'
-    priority: "high"
-    collection_reason: "Linked hive"