Windows Registry

Windows Registry#

A reference for the operator pivoting through the Windows registry, whether to find artifacts on a target host (forensics) or to establish persistence (offense). The handbook’s registry section is an exhaustive table of where each piece of state lives across XP, Vista, 7, 8, and 10. This page captures the key definitions and the categories that matter most.

Key definitions#

  • HKCU, HKEY_Current_User, settings specific to a user and only apply to a specific or currently logged-on user. Each user gets their own user key for unique settings.

  • HKU, HKEY_Users, settings that apply to all user accounts. All HKCU keys are maintained under this key.

  • HKU\<SID> is equivalent to HKCU. Set auditing on the appropriate key for the user logged in (HKCU) or other users by <GUID>.

  • HKLM, HKEY_Local_Machine, settings for the machine or system that apply to everyone and everything.

USB activity#

Keys that record connected USB devices, mount letters, and serial numbers.

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR                                # Class ID / Serial
HKLM\SYSTEM\CurrentControlSet\Enum\USB                                     # VID / PID
HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices                    # Friendly name, Volume name
HKLM\SYSTEM\MountedDevices                                                  # Drive letter, Volume GUID
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt
NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2  # user who mounted

USB times stored under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USB iSerial #\Properties.

  • 0064, first time device connected.

  • 0066, last time device connected.

  • 0067, last removal time.

Persistence anchors#

Auto-run, Run, RunOnce, scheduled tasks, service binaries, Winlogon, Image File Execution Options, and AppInit DLLs all hang off the registry. The operator looking to persist (or hunt persistence) gravitates here.

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{GUID}
HKLM\SOFTWARE\Microsoft\PushRouter\Test\TestDllPath2
HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs\ReflectDebugger
HKLM\Software\Microsoft\Cryptography\Offload\ExpoOffload
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath
HKLM\SYSTEM\ControlSet001\services\<service>

User activity#

Application use, document MRUs, and recent files live under NTUSER.DAT.

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Internet Explorer typed URLs, TypedURLs, and TypedURLsTime.

NTUSER.DAT\Software\Microsoft\Internet Explorer\TypedURLs
NTUSER.DAT\Software\Microsoft\Internet Explorer\TypedURLsTime

Recent application launches via ShimCache and AmCache.

HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache
HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility\

Background Activity Moderator, on Windows 10 records process execution under each user SID.

HKLM\SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}
HKLM\SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID}

Network and host#

Hostname, time zone, page-file behavior at shutdown, mounted volumes, wireless networks profiles.

HKLM\SYSTEM\ControlSet001\Control\ComputerName\ComputerName
HKLM\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName
HKLM\SOFTWARE\Microsoft\Windows Media\WMSDK\General                          # Volume Serial Number
HKLM\SYSTEM\ControlSet###\Control\Session Manager\Memory Management\ClearPageFileAtShutdown
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\

Application data#

Per-app keys for browsers (Chrome, Firefox, IE), peer-to-peer clients (BitComet, BitTorrent), messaging (AIM, AOL Instant Messenger), and disk encryption (BitLocker To Go) live under each respective vendor’s \SOFTWARE hive. The handbook enumerates several hundred specific keys; an analyst pulls the relevant one based on the application of interest.

Examples worth highlighting.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\(BitTorrent Client Name)
NTUSER.DAT\Software\Microsoft\Windows NT\CurrentVersion\FveAutoUnlock          # BitLocker To Go
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.jpg  # Camera App / image
SECURITY\Policy\Secrets\DefaultPassword                                         # Cached passwords (CurrVal / OldVal)

Class identifiers#

CLSID lookups for drivers, storage volumes, USB host controllers, Windows Portable Devices, and similar.

HKLM\SYSTEM\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}  # HDD drivers
HKLM\SYSTEM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}  # Storage volumes
HKLM\SYSTEM\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}  # USB host controllers
HKLM\SYSTEM\ControlSet001\Control\Class\{EEC5AD98-8080-425F-922A-DABF3DE3F69A}  # Windows Portable Devices

References#

Contents