Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.
Detailed execution history including SHA-1 hashes of executables
BAM/DAM
Background/Desktop Activity Moderator tracking program execution in Win10+
Last Write Time
Timestamp on registry keys indicating when they were last modified
Transaction logs
Journal files allowing recovery of registry state after improper shutdown
Tools & Systems
Tool
Purpose
RegRipper
Automated registry artifact extraction with plugin architecture
Registry Explorer
Eric Zimmerman GUI tool for interactive registry analysis
python-registry
Python library for programmatic registry hive parsing
RECmd
Eric Zimmerman command-line registry analysis tool
yarp
Yet Another Registry Parser for Python-based analysis
AppCompatCacheParser
Dedicated ShimCache/AppCompatCache parser
AmcacheParser
Dedicated AmCache.hve analysis tool
ShellBags Explorer
Specialized tool for analyzing ShellBag artifacts
Common Scenarios
Scenario 1: Malware Persistence Investigation
Extract SOFTWARE and NTUSER.DAT hives, check all Run/RunOnce keys for unauthorized entries, examine services for suspicious additions, check scheduled tasks registry keys, correlate autorun timestamps with malware execution timeline.
Scenario 2: User Activity Reconstruction
Analyze UserAssist for program execution history, examine RecentDocs for accessed files, check TypedPaths for Explorer navigation, extract ShellBags for folder access patterns, build a timeline of user activity around the incident window.
Scenario 3: Unauthorized Software Detection
Parse Uninstall keys for all installed applications, compare against approved software baseline, check BAM/DAM for recently executed programs not in approved list, examine AppCompatCache for execution evidence even after uninstallation.
Scenario 4: USB Data Exfiltration Investigation
Extract USBSTOR entries from SYSTEM hive for connected devices, correlate device serial numbers with MountedDevices, check NTUSER.DAT MountPoints2 for user access to removable media, examine SetupAPI logs for first-connection timestamps.
