Windows Registry Forensics: Key Artifacts for Incident Response

UserAssist: GUI program execution history:

UserAssist records every program run from the GUI (not command line) with ROT13-encoded executable paths and timestamps.

Registry path: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count

Decoded entries show: [executable path] → last run time, run count
ROT13 decoding: A→N, B→O, etc. (e.g., HRZR_EHAYBT = UEME_RUNLOG prefix for many entries)

Forensic value:
- Proves user ran a specific application (even if deleted)
- Timestamp is the LAST run time
- Run count shows how many times it was executed via GUI

Extract UserAssist with Registry Explorer (Eric Zimmerman):

# Copy NTUSER.DAT from a live system:
reg save HKCU C:\Temp\NTUSER.DAT
# Or copy directly from the profile during offline analysis

# Open in Registry Explorer:
# RegistryExplorer.exe
# File > Open hive > NTUSER.DAT
# Navigate to: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
# The UI automatically ROT13-decodes the entries and formats timestamps

ShimCache (AppCompatCache): execution metadata:

ShimCache records metadata for any executable that touched the file system: including programs that ran before the investigator arrived and programs that were deleted. Critical: ShimCache records presence and some timestamp data but NOT execution count: presence proves the file existed, combined with other evidence to infer execution.

# Extract ShimCache from a live system:
$AppCompat = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache"
$AppCompatCache = (Get-ItemProperty -Path $AppCompat -Name AppCompatCache).AppCompatCache
# Raw binary: needs parsing with RegRipper or AppCompatCacheParser

# Use AppCompatCacheParser (Eric Zimmerman):
AppCompatCacheParser.exe -f C:\Temp\SYSTEM --csv C:\Temp\Output --csvf shimcache.csv
# Output CSV: path, modified time, shimcache timestamp, executed flag

# Look for: malware paths in %TEMP%, %APPDATA%, C:\Users\Public\
# Even if the file was deleted, its path persists in ShimCache

AmCache.hve: SHA1 hash and first execution:

# AmCache is a separate hive file, not part of the main hives
# Location: C:\Windows\AppCompat\Programs\Amcache.hve

# Copy during live response:
reg load HKLM\AmCache C:\Windows\AppCompat\Programs\Amcache.hve
reg save HKLM\AmCache C:\Temp\Amcache.hve
reg unload HKLM\AmCache

# Parse with AmcacheParser (Eric Zimmerman):
AmcacheParser.exe -f C:\Temp\Amcache.hve --csv C:\Temp\Output --csvf amcache.csv

# Key output fields:
# KeyLastWriteTimestamp: first time Amcache recorded the entry (close to first execution)
# SHA1: hash of the executable: match against threat intel
# FullPath: where the executable was when first recorded
# Name: executable name

Run and RunOnce keys: startup persistence:

# Common persistence locations:
$persistenceKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SYSTEM\CurrentControlSet\Services"  # Service-based persistence
)

foreach ($key in $persistenceKeys) {
    Write-Host "=== $key ==="
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue |
        Get-Member -MemberType NoteProperty |
        Where-Object { $_.Name -ne 'PSPath' -and $_.Name -ne 'PSParentPath'
            -and $_.Name -ne 'PSChildName' -and $_.Name -ne 'PSDrive'
            -and $_.Name -ne 'PSProvider' } |
        ForEach-Object {
            $name = $_.Name
            $value = (Get-ItemProperty -Path $key).$name
            Write-Host "  $name = $value"
        }
}

WMI subscription persistence:

# WMI Event Subscriptions survive reboots and do not appear in standard Run key checks
Get-WMIObject -Namespace "root\subscription" -Class __EventFilter |
  Select-Object Name, Query, QueryLanguage

Get-WMIObject -Namespace "root\subscription" -Class __EventConsumer |
  Select-Object Name, CommandLineTemplate, ScriptFileName

Get-WMIObject -Namespace "root\subscription" -Class __FilterToConsumerBinding |
  Select-Object Filter, Consumer
# Any suspicious WMI subscription: investigate Name and CommandLineTemplate

RecentDocs: recently opened files (per extension):

Registry path:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Sub-keys organized by extension:
HKCU\...\RecentDocs\.docx: recently opened Word docs
HKCU\...\RecentDocs\.pdf: recently opened PDFs
HKCU\...\RecentDocs\Folder: recently opened folders

Forensic value: proves user (or attacker using that user's session) 
opened specific files, including by extension type

Shellbags: folder navigation history:

Shellbags record every folder the user has browsed: including folders on external drives, network shares, and even folders that have been deleted.

Registry paths:
HKCU\Software\Microsoft\Windows\Shell\Bags
HKCU\Software\Microsoft\Windows\Shell\BagMRU
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags

Forensic value:
- Proves folders were browsed: including content of deleted directories
- USB drive contents (volume GUID recorded): proves specific USB was browsed
- Network share paths accessed (\\server\share format)
- Timestamps: first and last interaction

# Parse with ShellBagsExplorer (Eric Zimmerman):
ShellBagsExplorer.exe
# Open USRCLASS.DAT (C:\Users\[user]\AppData\Local\Microsoft\Windows\UsrClass.dat)
# Reveals complete folder browsing history including deleted paths

USB device history:

# All USB devices ever connected to this machine:
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*' |
  Select-Object FriendlyName, DeviceDesc, Mfg,
    @{N='SerialNumber'; E={ ($_.PSChildName -split '\\')[-1] }}

# Cross-reference with Setupapi.dev.log for first install timestamps:
Get-Content "C:\Windows\INF\setupapi.dev.log" |
  Select-String -Pattern 'USBSTOR' -Context 0,2
# Shows: first-time device connection timestamp

# Map serial number to drive letter assignment:
Get-ItemProperty -Path 'HKLM:\SYSTEM\MountedDevices' |
  Get-Member -MemberType NoteProperty |
  Where-Object { $_.Name -like '*DosDevices*' }

RegRipper is the standard tool for automated registry forensic artifact extraction: it runs plugins that extract and format specific artifact categories.

# Install RegRipper:
git clone https://github.com/keydet89/RegRipper3.0
cd RegRipper3.0

# Run all plugins against a SYSTEM hive:
perl rip.pl -r /evidence/SYSTEM -f system > system_report.txt

# Run all plugins against NTUSER.DAT:
perl rip.pl -r /evidence/NTUSER.DAT -f ntuser > ntuser_report.txt

# Run a specific plugin (userassist):
perl rip.pl -r /evidence/NTUSER.DAT -p userassist > userassist.txt

# Key RegRipper plugins and what they extract:
# userassist   → UserAssist execution history (decoded)
# shimcache    → AppCompatCache entries
# run          → HKLM and HKCU Run/RunOnce keys
# recentdocs   → RecentDocs file access history
# mru          → Multiple MRU artifact types
# usbstor      → USB device connection history
# networklist  → Previously connected network names/GUIDs
# lastlogon    → Last logon time for local accounts
# winsearch    → Windows Search typed terms