AWS inspector documentation change
Summary
Added Windows applications ecosystem collection documentation including version detection methods for PowerShell, Microsoft Defender, Exchange Server, and other Microsoft products
Security assessment
The changes document expanded SBOM generation capabilities for Windows applications but do not address specific vulnerabilities or security incidents. While Microsoft Defender and Exchange Server are security products, the documentation focuses on version detection methodology rather than security features or vulnerability mitigation.
Diff
diff --git a/inspector/latest/user/sbom-generator-ecosystem-collection.md b/inspector/latest/user/sbom-generator-ecosystem-collection.md index 1d4b4ab14..bb7a68399 100644 --- a//inspector/latest/user/sbom-generator-ecosystem-collection.md +++ b//inspector/latest/user/sbom-generator-ecosystem-collection.md @@ -5 +5 @@ -Supported ecosystemsApache ecosystem collectionGoogle ecosystem collectionJava ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOpenSSH ecosystem collectionOpenSSL ecosystem CollectionOracle Database Server collectionWordPress ecosystem collection +Supported ecosystemsApache ecosystem collectionGoogle ecosystem collectionJava ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOpenSSH ecosystem collectionOpenSSL ecosystem CollectionOracle Database Server collectionWordPress ecosystem collectionWindows applicaitons ecosystem collection @@ -26,0 +27 @@ Node.JS | node +Windows applications | PowerShell NuGet CLI Visual Studio Code Microsoft Edge SharePoint Server Microsoft Defender Exchange Server Visual Studio .NET Runtime ASP.NET Core Runtime Outlook for Windows Microsoft Teams Outlook for Windows Microsoft Office Microsoft 365 @@ -411 +412,40 @@ The following is an example package URL for Nginx. -###### Supported artifacts +###### Supported platforms + +The following are supported platforms. (* is an arbitrary version) + +###### Linux + + * /usr/local/bin/node + + * /usr/bin/node + + * /nodejs/bin/node + + * ~/.nvm/versions/node/*/bin/node + + * ~/.local/share/fnm/node-versions/*/installation/bin/node + + * ~/.asdf/installs/nodejs/*/bin/node + + * ~/.local/share/mise/installs/node/*/bin/node + + * ~/.volta/tools/image/node/*/bin/node + + + + +###### Windows + + * C:\Program Files\nodejs\node.exe + + * C:\Program Files (x86)\nodejs\node.exe + + * ~\AppData\Roaming\fnm\node-versions\\*\installation\node.exe + + + + +###### macOS + + * /opt/homebrew/Cellar/node/*/bin/node + @@ -413 +452,0 @@ The following is an example package URL for Nginx. - * macOS and Linux – `node` binary detection through binary details installed with `asdf`, `fnm`, `nvm`, `volta`, or official Node.JS containers. @@ -415,0 +455 @@ The following is an example package URL for Nginx. +###### Key features @@ -416,0 +457 @@ The following is an example package URL for Nginx. +This collection examines binaries to extract embedded version information. It searches for version strings in the binary executable `.rodata` section (for ELF binaries on Linux), `.rdata` section (for PE binaries on Windows), or `__ctring` section (for MachO binaries). @@ -418 +459 @@ The following is an example package URL for Nginx. -###### Example macOS and Linux paths +###### Example version string @@ -420 +461 @@ The following is an example package URL for Nginx. -The following is an example of paths for macOS and Linux. +The following is an example of a version string embedded in an Node.JS runtime binary. @@ -423,5 +464 @@ The following is an example of paths for macOS and Linux. - NVM: ~/.nvm/, /usr/local/nvm - FNM: ~/.local/share/fnm/ - ASDF: ~/.asdf/ - MISE: ~/.local/share/mise/ - VOLTA: ~/.volta/ + node.js/v24.11.1 @@ -428,0 +466 @@ The following is an example of paths for macOS and Linux. +Version `24.11.1` is extracted to identify the Node.JS runtime version. @@ -435,2 +473 @@ The following is an example package URL for Node.JS. - Sample PURL: pkg:generic/nodejs/[email protected] - + Sample PURL: pkg:generic/nodejs/[email protected] @@ -695,0 +733,178 @@ The following is an example package URL for a WordPress theme. +## Windows applicaitons ecosystem collection + +###### Supported Windows Applications + + * PowerShell + + * NuGet CLI + + * Visual Studio Code + + * Microsoft Edge + + * SharePoint Server + + * Microsoft Defender + + * Exchange Server + + * Visual Studio + + * .NET Runtime + + * ASP.NET Core Runtime + + * Outlook for Windows + + * Microsoft Teams + + * Outlook for Windows + + * Microsoft Office + + * Microsoft 365 + + + + +###### Key features + + * PowerShell – Examines the `pwsh.exe` file to extract the embedded version information. + + * NuGet CLI – Examines the `nuget.exe` file to extract the embedded version information. + + * Visual Studio Code – Examines the `Code.exe` file to extract the embedded version information. + + * Microsoft Edge – Examines the `msedge.exe` file to extract the embedded version information. + + * SharePoint Server – Examines the `Microsoft.SharePoint.dll` file to extract the embedded version information. + + * Microsoft Defender – Examines the `MsMpEng.exe` file to extract the embedded version information. + + * Exhange Server – Examines the `Exsetup.exe` file to extract the embedded version information. + + * Visual Studio – Parses the `state.json` file to retrieve the version string from the `catalogInfo.productDisplayVersion` field. + + * .NET Runtime – Searches for `Microsoft.NETCore.App.deps.json` file in installation paths and extracts the version string from the following file path pattern. + + Microsoft.NETCore.App/<VERSION>/Microsoft.NETCore.App.deps.json + + * ASP.NET Runtime – Searches for `Microsoft.AspNetCore.App.deps.json` file in installation paths and extracts the version string from the following file path pattern. + + Microsoft.AspNetCore.App/<VERSION>/Microsoft.AspNetCore.App.deps.json + + * Outlook for Windows – Parses Windows Registry, and extracts version from the following registry key. + + HKLM\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.OutlookForWindows_<VERSION>_<ARCH>__8wekyb3d8bbwe + + * Microsoft Teams – Parses Windows Registry, and extracts version from the following registry key. + + HKLM\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\MSTeams_<VERSION>_<ARCH>__8wekyb3d8bbwee + + * Microsoft Office 365 / Microsoft 365 – Parses Windows Registry, and extracts version from the following registry key and value. + + * Registry Key + + KEY_LOCAL_MACHINES\SOFTWARE\Microsoft\Office\ClickToRun\Configuration + + * Registry Value + + * VersionToReport – Microsoft Office Version + + * ProductReleaseIds – List of product IDs. This is used to identify installed Office products. For more information about product IDs, see [product IDs](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/office-suite-issues/product-ids-supported-office-deployment-click-to-run) on the Microsoft website. + + * Microsoft Office Suite – Collects installed each Office applications by examining the following executable files: + + * `EXCEL.EXE` – Microsoft Excel + + * `WINWORD.EXE` – Microsoft Word + + * `POWERPNT.EXE` – Microsoft PowerPoint + + * `OUTLOOK.EXE` – Microsoft Outlook + +Version number in the Windows Registry is used as authoritative version number for each installed Office applications. + + + + +###### Example `state.json` file + +The following is an example of a `state.json` file to use to collect installed Visual Studio version. + + + { + "icon": { + "mimeType": "image/svg+xml", + "fileName": "product.svg" + }, + "updateDate": "2025-11-06T05:05:35.6517471Z", + "installDate": "2025-11-06T05:05:35.6527436Z", + "enginePath": "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\resources\\app\\ServiceHub\\Services\\Microsoft.VisualStudio.Setup.Service", + "installationName": "VisualStudio/17.14.19+36623.8", + "catalogInfo": { + "id": "VisualStudio/17.14.19+36623.8", + "buildBranch": "d17.14", + "buildVersion": "17.14.36623.8", + "localBuild": "build-lab", + "manifestName": "VisualStudio", + "manifestType": "installer", + "productDisplayVersion": "17.14.19", + // truncated + +Example PURL