Skip to main content
analyzing-windows-registry-for-artifacts Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.
설치로 이동 Skills Marketplace 커뮤니티가 만든 AI 스킬을 발견하고 탐색하세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-registry-for-artifacts명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Zip 다운로드 다운로드 중... 이 저장소의 다른 Skills abusing-dpapi-for-credential-access Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
acquiring-disk-image-with-dd-and-dcfldd Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
name analyzing-windows-registry-for-artifacts description Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image. domain cybersecurity subdomain digital-forensics tags ["forensics","windows-registry","artifact-analysis","regripper","registry-explorer","evidence-collection"] version 1.0 author mahipal license Apache-2.0 nist_csf ["RS.AN-03","DE.AE-02","RS.MA-01"] mitre_attack ["T1012","T1547.001","T1112","T1003.002","T1025"]
Analyzing Windows Registry for Artifacts
When to Use
When investigating user activity on a Windows system during an incident
For identifying autorun/persistence mechanisms used by malware
When tracing installed software, USB devices, and network connections
During insider threat investigations to reconstruct user actions
For correlating registry timestamps with other forensic artifacts
Prerequisites
Forensic image or extracted registry hive files
RegRipper, Registry Explorer (Eric Zimmerman), or python-registry
Access to registry hive locations (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat)
Understanding of Windows Registry structure (hives, keys, values)
SIFT Workstation or forensic analysis environment
Workflow
Step 1: Extract Registry Hives from the Forensic Image
mkdir /mnt/evidence
mount -o ro,loop,offset=$((2048 *512 )) /cases/case-2024-001/images/evidence.dd /mnt/evidence
cp /mnt/evidence/Windows/System32/config/SAM /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/SYSTEM /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/SOFTWARE /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/SECURITY /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/DEFAULT /cases/case-2024-001/registry/
cp /mnt/evidence/Users/*/NTUSER.DAT /cases/case-2024-001/registry/
cp /mnt/evidence/Users/*/AppData/Local/Microsoft/Windows/UsrClass.dat /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/*.LOG* /cases/case-2024-001/registry/logs/
sha256sum /cases/case-2024-001/registry/* > /cases/case-2024-001/registry/hive_hashes.txt
Step 2: Analyze with RegRipper for Automated Artifact Extraction
git clone
Step 3: Extract Persistence and Autorun Entries
pip install python-registry
python3 << 'PYEOF'
from Registry import Registry
reg = Registry.Registry("/cases/case-2024-001/registry/SOFTWARE" )
autorun_paths = [
"Microsoft\\Windows\\CurrentVersion\\Run" ,
"Microsoft\\Windows\\CurrentVersion\\RunOnce" ,
"Microsoft\\Windows\\CurrentVersion\\RunServices" ,
"Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run" ,
"Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
]
for path in autorun_paths:
try:
key = reg.open(path)
print (f"\n=== {path} (Last Modified: {key.timestamp()}) ===" )
for value in key.values():
print (f" {value.name()}: {value.value()}" )
except Registry.RegistryKeyNotFoundException:
pass
key = reg.open("Microsoft\\Windows NT\\CurrentVersion\\Svchost" )
print (f"\n=== Svchost Groups ===" )
for value in key.values():
print (f" {value.name()}: {value.value()}" )
PYEOF
python3 << 'PYEOF'
from Registry import Registry
reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT" )
user_autorun = [
"Software\\Microsoft\\Windows\\CurrentVersion\\Run" ,
"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" ,
"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run"
]
for path in user_autorun:
try:
key = reg.open(path)
print (f"\n=== {path} (Last Modified: {key.timestamp()}) ===" )
for value in key.values():
print (f" {value.name()}: {value.value()}" )
except Registry.RegistryKeyNotFoundException:
pass
PYEOF
Step 4: Analyze User Activity Artifacts
python3 << 'PYEOF'
from Registry import Registry
import codecs, struct, datetime
reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT" )
ua_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist"
key = reg.open(ua_path)
for guid_key in key.subkeys():
count_key = guid_key.subkey("Count" )
print (f"\n=== {guid_key.name()} ===" )
for value in count_key.values():
decoded_name = codecs.decode(value.name(), 'rot_13' )
data = value.value()
if len(data) >= 16:
run_count = struct.unpack('<I' , data[4:8])[0]
focus_count = struct.unpack('<I' , data[8:12])[0]
timestamp = struct.unpack('<Q' , data[60:68])[0] if len(data) >= 68 else 0
if timestamp > 0:
ts = datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=timestamp//10)
print (f" {decoded_name}: Runs={run_count}, Focus={focus_count}, Last={ts}" )
else :
print (f" {decoded_name}: Runs={run_count}, Focus={focus_count}" )
PYEOF
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
-p recentdocs > /cases/case-2024-001/analysis/recentdocs.txt
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
-p typedurls > /cases/case-2024-001/analysis/typedurls.txt
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
-p typedpaths > /cases/case-2024-001/analysis/typedpaths.txt
Step 5: Extract System and Network Information
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
-p compname > /cases/case-2024-001/analysis/system_info.txt
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
-p nic2 >> /cases/case-2024-001/analysis/system_info.txt
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \
-p networklist > /cases/case-2024-001/analysis/network_history.txt
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
-p timezone > /cases/case-2024-001/analysis/timezone.txt
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
-p shutdown > /cases/case-2024-001/analysis/shutdown.txt
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \
-p uninstall > /cases/case-2024-001/analysis/installed_software.txt
Key Concepts Concept Description Registry hive Binary file storing a section of the registry (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) MRU (Most Recently Used) Lists tracking recently accessed files, commands, and search terms UserAssist ROT13-encoded registry entries tracking program execution with timestamps ShimCache Application compatibility cache recording executed programs AmCache Detailed execution history including SHA-1 hashes of executables BAM/DAM Background/Desktop Activity Moderator tracking program execution in Win10+ Last Write Time Timestamp on registry keys indicating when they were last modified Transaction logs Journal files allowing recovery of registry state after improper shutdown
Tools & Systems Tool Purpose RegRipper Automated registry artifact extraction with plugin architecture Registry Explorer Eric Zimmerman GUI tool for interactive registry analysis python-registry Python library for programmatic registry hive parsing RECmd Eric Zimmerman command-line registry analysis tool yarp Yet Another Registry Parser for Python-based analysis AppCompatCacheParser Dedicated ShimCache/AppCompatCache parser AmcacheParser Dedicated AmCache.hve analysis tool ShellBags Explorer Specialized tool for analyzing ShellBag artifacts
Common Scenarios Scenario 1: Malware Persistence Investigation
Extract SOFTWARE and NTUSER.DAT hives, check all Run/RunOnce keys for unauthorized entries, examine services for suspicious additions, check scheduled tasks registry keys, correlate autorun timestamps with malware execution timeline.
Scenario 2: User Activity Reconstruction
Analyze UserAssist for program execution history, examine RecentDocs for accessed files, check TypedPaths for Explorer navigation, extract ShellBags for folder access patterns, build a timeline of user activity around the incident window.
Scenario 3: Unauthorized Software Detection
Parse Uninstall keys for all installed applications, compare against approved software baseline, check BAM/DAM for recently executed programs not in approved list, examine AppCompatCache for execution evidence even after uninstallation.
Scenario 4: USB Data Exfiltration Investigation
Extract USBSTOR entries from SYSTEM hive for connected devices, correlate device serial numbers with MountedDevices, check NTUSER.DAT MountPoints2 for user access to removable media, examine SetupAPI logs for first-connection timestamps.
Output Format Registry Analysis Summary:
System: DESKTOP-ABC123 (Windows 10 Pro Build 19041)
Timezone: Eastern Standard Time (UTC-5)
Last Shutdown: 2024-01-18 23:45:12 UTC
Autorun Entries:
HKLM Run: 5 entries (1 suspicious: "updater.exe" -> C:\ProgramData\svc\updater.exe)
HKCU Run: 3 entries (all legitimate)
Services: 142 entries (2 unknown: "WinDefSvc", "SysMonAgent")
User Activity (NTUSER.DAT):
UserAssist Programs: 234 entries
Recent Documents: 89 entries
Typed URLs: 45 entries
Typed Paths: 12 entries
USB Devices Connected:
- Kingston DataTraveler (Serial: 0019E06B4521) - First: 2024-01-10, Last: 2024-01-18
- WD My Passport (Serial: 575834314131) - First: 2024-01-15, Last: 2024-01-15
Installed Software: 127 applications
Suspicious Findings: 3 items flagged for review
