Windows registry artifacts
175 registry artifacts and 515 keys and values to examine during an investigation, with the hive that holds each one
No registry artifacts match ""
Clear searchSystem Info
29 artifacts
- WinLogonDisplays the username of the last user logged in to this system5 keys
- LogonUIDisplays the last logged on SAM user5 keys
- Windows Boot VolumeIdentifies the system volume where Windows booted from1 key
- ControlSet ConfigurationDisplays value for the current ControlSet4 keys
- Shutdown TimeLast system shutdown time1 key
- Windows OS LanguageDefault OS Language, 0409 is English1 key
- Virtual Memory Pagefile Encryption StatusVirtual Memory Pagefile Encryption, 0 = Disabled, 1 = Enabled1 key
- TRIM StatusTRIM, 0 = Enabled, 1 = Disabled1 key
- NTFS File Compression StatusNTFS File Compression, 0 = Enabled, 1 = Disabled1 key
- NTFS File Encryption StatusNTFS File Encryption, 0 = Enabled, 1 = Disabled1 key
- NTFS LastAccess Timestamp StatusNTFS LastAccess Timestamp, 2147483650 = Enabled, 1 = Disabled1 key
- Long Paths EnabledNTFS Long Paths, 0 = Disabled, 1 = Enabled1 key
- Prefetch Status0 = Disabled, 1 = Application Prefetching Enabled, 2 = Boot Prefetching Enabled, 3 = Application and Boot Prefetching Enabled1 key
- Clear Page File at Shutdown Status0 = Disabled, 1 = Enabled1 key
- System Time Zone InformationDisplays the current Time Zone configuration for this system1 key
- Network ConnectionsDisplays list of network connections1 key
- Device ClassesDisplays a list of PnP devices (Plug and Play) that were connected to this system1 key
- LogonBannerLegal text caption that is displayed to a user before logon4 keys
- System Info (Current)Name of computer used by the user24 keys
- System Info (Historical)Historical location of %SystemRoot% Environment Variable18 keys
- Network AdaptersDisplays list of network adapters connected to this system1 key
- Network Configuration (IPv4)DHCP Broadcast, 0 = Disabled, 1 = Enabled26 keys
- Network Configuration (IPv6)DHCP Broadcast, 0 = Disabled, 1 = Enabled26 keys
- Windows 10 Timeline StatusWindows 10 Activity Timeline status, 0 = Disabled, 1 = Enabled2 keys
- Clipboard History StatusDisplays the status of Clipboard History, 0 = Disabled, 1 = Enabled3 keys
- User Access Logging (SUM DB)Displays the updating interval for the SUM DB. Default is 24 hours. 60000 = 60 seconds, for example1 key
- Firewall RulesDisplays firewall rules on this system1 key
- MAC AddressesDisplays MAC Addresses related to this system1 key
- Processor InformationDisplays Processor Architecture of this system8 keys
Devices
10 artifacts
- MicrophoneDisplays the timestamp of when a microphone started being used with a given application2 keys
- WebcamDisplays the timestamp of when a webcam started being used with a given application2 keys
- Bluetooth DevicesDisplays the Bluetooth devices that have been connected to this computer1 key
- Volume Info Cache2 = Removable, 3 = Fixed, 4 = Network, 5 = Optical, 6 = RAM disk, 0 = Unknown1 key
- USBSTORDisplays list of USB devices that have been plugged into this system. If & is second character within serial number, serial number is only unique on the system1 key
- USBProvides VID and PID numbers of USB devices. Match serial number from USBSTOR and search for VID and PID across the system1 key
- MountPoints2Mount Points - NTUSER2 keys
- Mounted DevicesLast Write Timestamp is for entire key, not each individual value1 key
- Windows Portable DevicesDisplays list of USB devices previously connected to this system1 key
- SCSIDisplays a list of SCSI devices connected to this system1 key
User Activity
27 artifacts
- Default PrintersDisplays the printer options available to the user1 key
- LogonStatsFirst Time a User Logs in to a System.2 keys
- Pinned Taskbar ItemsDisplays pinned Taskbar items1 key
- TypedPathsDisplays paths that were typed by the user in Windows Explorer2 keys
- TypedURLsInternet Explorer/Edge Typed URLs1 key
- Microsoft Office MRUMicrosoft Office Recent Files, lower Item value (Value Name) = more recent4 keys
- WordWheelQueryUser Searches2 keys
- FirstFolderFirstFolder, tracks the application's first folder that is presented to the user during an Open or Save As operation1 key
- OpenSavePidlMRUTracks files that have been opened or saved within a Windows shell dialog box2 keys
- OpenSaveMRUTracks files that have been opened or saved within a Windows shell dialog box1 key
- LastVisitedPidlMRUTracks the specific executable used by an application to open the files documented in OpenSavePidlMRU3 keys
- RecentDocsFiles recently opened from Windows Explorer2 keys
- Recent File ListDisplays recent files accessed by the user with an application5 keys
- Registry Editor UsageDisplays the last registry key accessed by the user in RegEdit2 keys
- Recent Folder List1 key
- Recent Document List1 key
- Recent1 key
- RecentFind1 key
- User Shell FoldersDisplays where a user's Shell folders are mapped to1 key
- FeatureUsageDisplays the number of times the user has received a notification for an application11 keys
- Terminal Server Client (RDP)Displays the IP addresses/hostnames of devices this system has connected to (Outbound RDP)1 key
- ConsentStore (Global)Displays Permissions Set For Applications to Access. Allow, Deny and Prompt5 keys
- ConsentStore (User)Displays Permissions Set For Applications to Access. Allow, Deny and Prompt5 keys
- Desktop IconLayoutsDisplays the desktop icon layout, Observed in Windows 11 to be arranged from top to bottom in columns from the top left of the screen.1 key
- VisualStudio FileMRUList1 key
- VisualStudio MRUItems1 key
- VisualStudio MRUSettings1 key
Network Shares
2 artifacts
User Accounts
6 artifacts
- User Accounts (SAM)User accounts in SAM hive1 key
- User Accounts (SOFTWARE)User accounts in SOFTWARE hive1 key
- User Accounts (SECURITY)Built-in accounts in SECURITY hive1 key
- Built-in User Accounts (SAM)Built-in accounts in SAM hive1 key
- SpecialAccountsHides Accounts from being visible on Logon Screen and Start Menu, 0 = Hide User Account, 1 = Show User Account, 65536 (0x10000) = Hide User Accounts Starting with e.g. J with this value would hide all accounts starting with J1 key
- Stored IdentitiesDisplays information about Microsoft accounts that have signed into a computer1 key
Installed Software
7 artifacts
- SysinternalsDisplays all SysInternals Tools that had the EULA accepted, indicating either execution of the tool or the Registry values were added intentionally prior to execution1 key
- App PathsDisplays list of installed software and the associated application paths1 key
- File ExtensionsTracks programs associated with file extensions2 keys
- ApplicationAssociationToastsTracks programs associated with file extensions - Linked to Open With Dialog2 keys
- Add/Remove Programs EntriesDisplays installed software3 keys
- ProductsDisplays all installed software packages1 key
- Windows App ListDisplays all Windows applications installed on this system1 key
Program Execution
13 artifacts
- JumplistDataDisplays last execution time of a program1 key
- RecentAppsRecentApps1 key
- RunMRUTracks commands from the Run box in the Start menu, lower MRU # (Value Data3) = more recent1 key
- AppCompatCacheAKA ShimCache, data is only written to this value at reboot by winlogon.exe1 key
- AppCompatFlagsDisplays programs that are configured to run in Compatibility Mode in Windows1 key
- CIDSizeMRURecently ran applications, lower MRU # (Value Data3) = more recent2 keys
- Background Activity Moderator (BAM)Displays the last execution time of a program1 key
- Desktop Activity Moderator (DAM)DAM1 key
- Regedit.exe Last RunDisplays the last key opened with RegEdit1 key
- UserAssistGUI-based programs launched from the desktop2 keys
- MuiCache (Vista+)Displays new applications that have been executed within Windows1 key
- MuiCache (2000/XP/2003)Displays new applications that have been executed within Windows1 key
- RADARDisplays applications that were running at one point in time on this system1 key
Autoruns
8 artifacts
- Run (Group Policy)Group Policy Run Key1 key
- Run (NTUSER)Program execution upon successful user logon1 key
- RunOnce (NTUSER)Program execution upon successful user logon1 key
- Run (SYSTEM)Program execution upon successful user logon2 keys
- RunOnce (SYSTEM)Program execution upon successful user logon2 keys
- RunNotificationNew in Windows 11, compare with other more researched Autoruns artifacts1 key
- Startup ProgramsDisplays list of programs that start up upon system boot6 keys
- Scheduled Tasks (TaskCache)Displays Scheduled Tasks and their last start/stop time1 key
Third Party Applications
38 artifacts
- MobaXTerm SessionsCollects all MobaXTerm session artifacts1 key
- MobaXTermCollects all MobaXTerm/MobaTek administrative artifacts4 keys
- CitrixDisplays artifacts relating to Citrix1 key
- VNC ViewerDisplays artifacts relating to VNC Viewer1 key
- QNAP QFinderDisplays the name of the QNAP as it was assigned by the user6 keys
- Total CommanderTotal Commander Registry artifacts2 keys
- TeamViewerWindows username of logged in user7 keys
- Adobe cRecentFilesDisplays files which were opened Adobe Reader by the user1 key
- Adobe cRecentFoldersDisplays folders where Adobe Reader opened a PDF file from1 key
- 7-ZipDisplays list of files and folders that were used with 7-Zip1 key
- WinRARDisplays history of archives that were used with WinRAR1 key
- EraserPotential evidence of anti-forensics1 key
- LogMeInLogMeIn GoToMeeting3 keys
- Macrium ReflectMacrium Reflect image storage directory11 keys
- WinSCPWinSCP4 keys
- AresDisplays information relating to Ares1 key
- SoulseekDisplays the name of the user who installed Soulseek2 keys
- SignalDisplays the location where Signal is installed on the user's computer1 key
- Stardock FencesDisplays a list of links the user had on their desktop at the time of installation4 keys
- 4K Video DownloaderDisplays the run count for 4K Video Downloader5 keys
- AnyDeskDisplays artifacts relating to AnyDesk2 keys
- AteraDisplays artifacts relating to Atera2 keys
- ConnectWise (ScreenConnect)Displays artifacts relating to ConnectWise (ScreenConnect)2 keys
- RemoteUtilitiesDisplays artifacts relating to RemoteUtilities7 keys
- SplashtopDisplays artifacts relating to Splashtop7 keys
- TightVNCDisplays artifacts relating to TightVNC3 keys
- PuTTYDisplays artifacts relating to PuTTY1 key
- CCleanerDisplays artifacts relating to CCleaner1 key
- File ShredderDisplays artifacts relating to File Shredder1 key
- FileZillaDisplays artifacts relating to FileZilla1 key
- FreeFileSyncDisplays artifacts relating to FreeFileSync1 key
- GoodSyncDisplays artifacts relating to GoodSync2 keys
- Advanced Port ScannerDisplays artifacts relating to Advanced Port Scanner2 keys
- Advanced IP ScannerDisplays artifacts relating to Advanced IP Scanner2 keys
- Angry IP Scanner - LegacyDisplays artifacts relating to Angry IP Scanner2 keys
- Angry IP ScannerDisplays artifacts relating to Angry IP Scanner2 keys
- DB Browser for SQLiteDisplays artifacts relating to DB Browser for SQLite1 key
- WinMergeDisplays artifacts relating to WinMerge1 key
Cloud Storage
3 artifacts
Services
1 artifact
Event Logs
3 artifacts
- Event Logs Logging StatusDisplays the status of Windows Event Log Channels (Key Path) on this system, 0 = Disabled, 1 - Enabled1 key
- Application Event Log ProvidersDisplays the status of Providers within the Application Event Log on this system, 0 = Disabled, 1 - Enabled1 key
- System Event Log ProvidersDisplays the status of Providers within the Application Event Log on this system, 0 = Disabled, 1 - Enabled1 key
Microsoft Office
2 artifacts
Microsoft Exchange
1 artifact
Web Browsers
4 artifacts
Volume Shadow Copies
1 artifact
Threat Hunting
20 artifacts
- WinLogon ShellContains the default shell environment for Windows, normally 'explorer.exe'3 keys
- WinLogon UserInitUserinit.exe is launched by winlogon.exe and runs logon scripts for the user, reestablishes network connections, and then starts Explorer.exe. It also specifies programs Winlogon should run when a user logs on. Typically contains 'userinit.exe,'.3 keys
- Shadow RDP SessionsShadow RDP sessions, 0 = Disabled, 1 = Full Control with user's permission, 2 = Full Control without user's permission, 3 = View Session with user's permission, 4 = View Session without user's permission1 key
- RDP Connections StatusDisplays the status of whether the system can accept Terminal Server (RDP) connections, 0 = Disabled (Inbound RDP enabled), 1 = Enabled (Inbound RDP disabled)1 key
- RDP User Authentication StatusDisplays whether a Network-Level user authentication is required before a remote desktop connection is established. 0 = Disabled (no authentication required), 1 = Enabled (authentication required)1 key
- Windows Defender StatusDisplays the status of whether Windows Defender AntiSpyware is enabled or not. 0 = Enabled (AntiSpyware On), 1 = Disabled4 keys
- Windows DefenderWindows Defender DisableBlockAtFirstSeen Status, 0 = Enabled (BlockAtFirstSeen On), 1 = Disabled32 keys
- PortProxy ConfigurationDisplays current port proxy configuration1 key
- Exefile Shell Open CommandExefile hijack shows e.g. path to a binary2 keys
- Hades IOCs0 = Disabled, 1 = Enabled8 keys
- REvil IOCsREvil/Kaseya Ransomware attack from July 20211 key
- PowerShell InfoCobalt Strike Reflection Attack - Lockbit 2.01 key
- Restricted Admin StatusDisplays the status of Restricted Admin mode1 key
- Symantec Endpoint ProtectionDisplays a list of filenames that have been quarantined by Symantec Endpoint Protection1 key
- Windows SmartScreenWindows SmartScreen Status, 0 = Disabled (SmartScreen Off), 1 = Enabled18 keys
- Image File Execution Options InjectionSee documentation in Batch File for further information2 keys
- Microsoft Security EssentialsMicrosoft Security Essentials will automatically take action on all detected threats Status, 0 = Enabled (RoutinelyTakingAction On), 1 = Disabled9 keys
- Connections Made By MS OfficeDisplays the connections made by MS Office - IOCs found here for CVE-2022-301901 key
- User Account Control (UAC)Run all administrators in Admin Approval Mode - Disables UAC, 0 = Disabled (UAC Off), 1 = Enabled (UAC On)10 keys
- WDigestDisplay whether WDigest is enabled. These registry keys are worth monitoring in an environment as an attacker may wish to set it to 1 to enable Digest password support which forces “clear-text” passwords to be placed in LSASS on any version of Windows from Windows 7 / 2008R2 up to Windows 10 / 2012R2. Furthermore, Windows 8.1 / 2012 R2 and newer do not have a “UseLogonCredential” DWORD value, so the key needs to be added. The existence of the key is suspicious, if not expected.2 keys
Results
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)