analyzing-windows-registry-for-artifacts

name	analyzing-windows-registry-for-artifacts
description	Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise. Use when working with analyzing windows registry for artifacts.
domain	cybersecurity
tags	["forensics","windows-registry","artifact-analysis","regripper","registry-explorer","evidence-collection"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Analyzing Windows Registry For Artifacts

Overview

Cybersecurity skill for analyzing windows registry for artifacts. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing windows registry for artifacts"

• "Extract and analyze Windows Registry hives to uncover user activity, installed s"

• When investigating user activity on a Windows system during an incident

• For identifying autorun/persistence mechanisms used by malware

• When tracing installed software, USB devices, and network connections

• During insider threat investigations to reconstruct user actions

• For correlating registry timestamps with other forensic artifacts

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Forensic image or extracted registry hive files
• RegRipper, Registry Explorer (Eric Zimmerman), or python-registry
• Access to registry hive locations (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat)
• Understanding of Windows Registry structure (hives, keys, values)
• SIFT Workstation or forensic analysis environment

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Scope the Analysis — Define what windows registry artifacts or data sources to examine and the investigation timeline.