Windows registry artifactUserAssist
GUI-based programs launched from the desktop
- Program Execution
- 2 keys
NTUSERUser
Registry keys
2 keys that RECmd reads for this artifact
NTUSERSoftware\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\*\CountGUI-based programs launched from the desktop
UserSoftware\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\*\CountGUI-based programs launched from the desktop - Windows Store UWP
References
6 links
- github.comUserAssist plugin(opens in new tab)
- sans.org/security-resources/posters/windows-forensic-analysis/170/download(opens in new tab)
- blog.didierstevens.com/programs/userassist/(opens in new tab)
- andreafortuna.org/2018/05/23/forensic-artifacts-evidences-of-program-execution-on-windows-systems/(opens in new tab)
- countuponsecurity.com/tag/userassist/(opens in new tab)
- cellebrite.com/en/analyzing-program-execution-windows-artifacts/(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)