analyzing-windows-registry-for-artifacts

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.

Zur Installation springen

Repository: xalgord/xalgorix
Letzte Quellaktivität: 6. Juni 2026 um 16:41
Erkannte Sprache von SKILL.md: Englisch
Sterne: 813
Forks: 146

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Zurück zur Suche Zurück zur Installation

name	analyzing-windows-registry-for-artifacts
description	Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
domain	cybersecurity
subdomain	digital-forensics
tags	["forensics","windows-registry","artifact-analysis","regripper","registry-explorer","evidence-collection"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Analyzing Windows Registry for Artifacts

When to Use

When investigating user activity on a Windows system during an incident
For identifying autorun/persistence mechanisms used by malware
When tracing installed software, USB devices, and network connections
During insider threat investigations to reconstruct user actions
For correlating registry timestamps with other forensic artifacts

Detection Gaps & Validation

ShimCache (AppCompatCache) proves presence, not execution, and lags. Entries are written to the SYSTEM hive only at shutdown, so recent activity is missing until the next reboot, and an entry only means the binary was seen by the system. Pair it with Amcache/Prefetch for execution.
Dirty hives need transaction-log replay. If you parse SYSTEM/NTUSER.DAT without applying .LOG1/.LOG2, RegRipper/python-registry may return stale or truncated data. Always collect and replay the logs (RECmd/EZ tools do this).
Last Write Time is per-key, not per-value. A key timestamp tells you the most recent value change, not which value changed. Do not attribute a single value's age to the key timestamp.
UserAssist is ROT13-encoded and counts focus/run from Explorer only; CLI-launched programs are absent. BAM/DAM (bam\State\UserSettings\<SID>) gives Win10+ last-run times worth checking separately.
Timezone: apply SYSTEM\...\TimeZoneInformation (bias) before placing registry timestamps on a UTC timeline.
Anti-forensics: Run-key/value deletion, key timestamp manipulation, and RegDelNull-style hidden keys. Carve deleted keys from hive slack / unallocated and check VSS copies.
Validate / cross-corroborate: confirm execution and persistence against Amcache, Prefetch, Security.evtx (4688/4697/4698), and Scheduled Tasks XML. USBSTOR serials should reconcile with MountedDevices and NTUSER MountPoints2.

Prerequisites

Forensic image or extracted registry hive files
RegRipper, Registry Explorer (Eric Zimmerman), or python-registry
Access to registry hive locations (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat)
Understanding of Windows Registry structure (hives, keys, values)
SIFT Workstation or forensic analysis environment

Workflow

Step 1: Extract Registry Hives from the Forensic Image


 /mnt/evidence
mount -o ro,loop,offset=$((*)) /cases/case-2024-001/images/evidence.dd /mnt/evidence


 /mnt/evidence/Windows/System32/config/SAM /cases/case-2024-001/registry/
 /mnt/evidence/Windows/System32/config/SYSTEM /cases/case-2024-001/registry/
 /mnt/evidence/Windows/System32/config/SOFTWARE /cases/case-2024-001/registry/
 /mnt/evidence/Windows/System32/config/SECURITY /cases/case-2024-001/registry/
 /mnt/evidence/Windows/System32/config/DEFAULT /cases/case-2024-001/registry/


 /mnt/evidence/Users/*/NTUSER.DAT /cases/case-2024-001/registry/
 /mnt/evidence/Users/*/AppData/Local/Microsoft/Windows/UsrClass.dat /cases/case-2024-001/registry/


 /mnt/evidence/Windows/System32/config/*.LOG* /cases/case-2024-001/registry/logs/


 /cases/case-2024-001/registry/* > /cases/case-2024-001/registry/hive_hashes.txt

# Install RegRipper
git clone https://github.com/keydet89/RegRipper3.0.git /opt/regripper

# Run RegRipper against NTUSER.DAT (user profile)
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -f ntuser > /cases/case-2024-001/analysis/ntuser_report.txt

# Run against SYSTEM hive
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -f system > /cases/case-2024-001/analysis/system_report.txt

# Run against SOFTWARE hive
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \
   -f software > /cases/case-2024-001/analysis/software_report.txt

# Run against SAM hive (user accounts)
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SAM \
   -f sam > /cases/case-2024-001/analysis/sam_report.txt

# Run specific plugins
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -p userassist > /cases/case-2024-001/analysis/userassist.txt

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p usbstor > /cases/case-2024-001/analysis/usbstor.txt

# Using python-registry for targeted extraction
pip install python-registry

python3 << 'PYEOF'
from Registry import Registry

# Open SOFTWARE hive
reg = Registry.Registry("/cases/case-2024-001/registry/SOFTWARE")

# Check Run keys (autostart)
autorun_paths = [
    "Microsoft\\Windows\\CurrentVersion\\Run",
    "Microsoft\\Windows\\CurrentVersion\\RunOnce",
    "Microsoft\\Windows\\CurrentVersion\\RunServices",
    "Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
    "Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
]

for path in autorun_paths:
    try:
        key = reg.open(path)
        print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===")
        for value in key.values():
            print(f"  {value.name()}: {value.value()}")
    except Registry.RegistryKeyNotFoundException:
        pass

# Check installed services
key = reg.open("Microsoft\\Windows NT\\CurrentVersion\\Svchost")
print(f"\n=== Svchost Groups ===")
for value in key.values():
    print(f"  {value.name()}: {value.value()}")
PYEOF

# Check NTUSER.DAT for user-specific autorun
python3 << 'PYEOF'
from Registry import Registry

reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT")

user_autorun = [
    "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
    "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
    "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run"
]

for path in user_autorun:
    try:
        key = reg.open(path)
        print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===")
        for value in key.values():
            print(f"  {value.name()}: {value.value()}")
    except Registry.RegistryKeyNotFoundException:
        pass
PYEOF

# Extract UserAssist data (program execution history with ROT13 encoding)
python3 << 'PYEOF'
from Registry import Registry
import codecs, struct, datetime

reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT")

ua_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist"
key = reg.open(ua_path)

for guid_key in key.subkeys():
    count_key = guid_key.subkey("Count")
    print(f"\n=== {guid_key.name()} ===")
    for value in count_key.values():
        decoded_name = codecs.decode(value.name(), 'rot_13')
        data = value.value()
        if len(data) >= 16:
            run_count = struct.unpack('<I', data[4:8])[0]
            focus_count = struct.unpack('<I', data[8:12])[0]
            timestamp = struct.unpack('<Q', data[60:68])[0] if len(data) >= 68 else 0
            if timestamp > 0:
                ts = datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=timestamp//10)
                print(f"  {decoded_name}: Runs={run_count}, Focus={focus_count}, Last={ts}")
            else:
                print(f"  {decoded_name}: Runs={run_count}, Focus={focus_count}")
PYEOF

# Extract Recent Documents (MRU lists)
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -p recentdocs > /cases/case-2024-001/analysis/recentdocs.txt

# Extract typed URLs (browser)
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -p typedurls > /cases/case-2024-001/analysis/typedurls.txt

# Extract typed paths in Explorer
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -p typedpaths > /cases/case-2024-001/analysis/typedpaths.txt

# Computer name and OS version from SYSTEM hive
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p compname > /cases/case-2024-001/analysis/system_info.txt

# Network interfaces and configuration
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p nic2 >> /cases/case-2024-001/analysis/system_info.txt

# Wireless network history
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \
   -p networklist > /cases/case-2024-001/analysis/network_history.txt

# Timezone configuration
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p timezone > /cases/case-2024-001/analysis/timezone.txt

# Shutdown time
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p shutdown > /cases/case-2024-001/analysis/shutdown.txt

# Installed software from Uninstall keys
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \
   -p uninstall > /cases/case-2024-001/analysis/installed_software.txt

Concept	Description
Registry hive	Binary file storing a section of the registry (SAM, SYSTEM, SOFTWARE, NTUSER.DAT)
MRU (Most Recently Used)	Lists tracking recently accessed files, commands, and search terms
UserAssist	ROT13-encoded registry entries tracking program execution with timestamps
ShimCache	Application compatibility cache recording executed programs
AmCache	Detailed execution history including SHA-1 hashes of executables
BAM/DAM	Background/Desktop Activity Moderator tracking program execution in Win10+
Last Write Time	Timestamp on registry keys indicating when they were last modified
Transaction logs	Journal files allowing recovery of registry state after improper shutdown

Tool	Purpose
RegRipper	Automated registry artifact extraction with plugin architecture
Registry Explorer	Eric Zimmerman GUI tool for interactive registry analysis
python-registry	Python library for programmatic registry hive parsing
RECmd	Eric Zimmerman command-line registry analysis tool
yarp	Yet Another Registry Parser for Python-based analysis
AppCompatCacheParser	Dedicated ShimCache/AppCompatCache parser
AmcacheParser	Dedicated AmCache.hve analysis tool
ShellBags Explorer	Specialized tool for analyzing ShellBag artifacts

Registry Analysis Summary:
  System: DESKTOP-ABC123 (Windows 10 Pro Build 19041)
  Timezone: Eastern Standard Time (UTC-5)
  Last Shutdown: 2024-01-18 23:45:12 UTC

  Autorun Entries:
    HKLM Run:     5 entries (1 suspicious: "updater.exe" -> C:\ProgramData\svc\updater.exe)
    HKCU Run:     3 entries (all legitimate)
    Services:     142 entries (2 unknown: "WinDefSvc", "SysMonAgent")

  User Activity (NTUSER.DAT):
    UserAssist Programs:  234 entries
    Recent Documents:     89 entries
    Typed URLs:           45 entries
    Typed Paths:          12 entries

  USB Devices Connected:
    - Kingston DataTraveler (Serial: 0019E06B4521) - First: 2024-01-10, Last: 2024-01-18
    - WD My Passport (Serial: 575834314131) - First: 2024-01-15, Last: 2024-01-15

  Installed Software:     127 applications
  Suspicious Findings:    3 items flagged for review