Listen to this Post
Introduction:
When a system is compromised, traditional log files may be deleted or tampered with, but the Windows Registry often holds the untold story. As demonstrated in TryHackMe’s Advent of Cyber 2025 Day 16 challenge, registry forensics is a critical skill for reconstructing attacker timelines, uncovering stealthy persistence, and understanding the full scope of a breach. This guide delves into the practical techniques used by Digital Forensics and Incident Response (DFIR) professionals to turn registry hives into actionable intelligence.
Learning Objectives:
- Understand the structure of the Windows Registry and learn how to safely acquire and analyze offline registry hives.
- Identify forensic artefacts related to software installation, user activity, and system configuration.
- Detect and analyze common registry-based persistence mechanisms used by adversaries.
You Should Know:
1. Mastering Offline Registry Hive Acquisition and Analysis
The first rule of forensic registry analysis is to avoid altering the live system. Investigators work on extracted “hive” files to preserve evidence integrity.
Step‑by‑step guide:
Step 1: Acquire the Hive Files. From a forensic disk image or a live system using a trusted tool, copy the core hive files. These are typically located in `C:\Windows\System32\config\` (SYSTEM, SAM, SECURITY, SOFTWARE) and within user profiles (NTUSER.DAT and UsrClass.dat). On a live system, you can use a tool like `FTK Imager` to create a forensic copy, or use a trusted command-line utility:
Example: Using a trusted tool to copy a hive from a live system. Replace [bash] with the actual source. tool64.exe --source C:\Windows\System32\config\SYSTEM --destination E:\Evidence\SYSTEM.hive
Step 2: Load the Hive for Analysis (Optional). While specialized tools like Registry Explorer or Eric Zimmerman’s RECmd/RECmd_GUI can parse hives directly, you can also load them into your forensic workstation’s Registry Editor for manual examination using the `reg` command. Caution: This loads it into your own registry, so use a dedicated analysis machine.
Load an offline SYSTEM hive into a temporary key in your registry for exploration. reg load HKLM\ForensicTemp E:\Evidence\SYSTEM.hive After analysis, always unload the hive to clean up. reg unload HKLM\ForensicTemp
Step 3: Analyze with Specialized Tools. For efficient analysis, use tools built for forensics. Open the hive file in Registry Explorer. This tool provides a familiar tree view but includes advanced features like searching across all loaded hives, viewing binary data, and tracking cell slack—crucial for finding hidden data.
2. Investigating Installed Applications and Execution
The registry logs details about software installation and execution, which can reveal malicious tools dropped during an attack.
Step‑by‑step guide:
Step 1: Check Uninstall Keys. Legitimate and malicious software often create entries here. Navigate to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall` (in the user’s NTUSER.DAT). Look for unfamiliar program names, strange publisher information, or recent installation dates.
Step 2: Examine App Paths and Recent Executions. The `App Paths` keys (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\) map executable names to file locations. Adversaries may hijack these. Also, check the `UserAssist` key (within `NTUSER.DAT` at SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist), which tracks GUI program execution with ROT13-encoded names. Tools like `RECmd` automatically decode these entries.
Using RECmd from the command line to parse the UserAssist key from an offline NTUSER.DAT hive. RECmd.exe -f E:\Evidence\NTUSER.DAT --kn "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" --csv C:\output\
Step 3: Review Prefetch Entries (Indirect). While not in the registry, Prefetch files (.pf) in `C:\Windows\Prefetch` are goldmines for execution history. The registry key `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters` controls Prefetch functionality. If `EnablePrefetcher` is set to 0, it may indicate an attacker disabling this logging feature.
3. Tracing User Activity and Intent
User registry hives (NTUSER.DAT) contain a wealth of information about what a user did on the system, helping build context for the incident.
Step‑by‑step guide:
Step 1: Analyze Shellbags. These keys (USRCLASS.DAT at Local Settings\Software\Microsoft\Windows\Shell\BagMRU) store information about folder views (size, position, icon type) and can reveal that a user navigated to directories even if the files within were later deleted—useful for finding accessed data stores.
Step 2: Check Recent Documents and Typed Paths. The `RecentDocs` key (in NTUSER.DAT) lists recently opened files by extension. The `TypedPaths` key (Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths) stores paths manually typed into the Windows Explorer address bar, potentially revealing network shares or hidden folders.
Step 3: Investigate Command History. If command-line activity is suspected, check for traces. For cmd.exe, review the `HKCU\Software\Microsoft\Command Processor` key for `AutoRun` values that could execute malicious commands automatically. For PowerShell, investigate the `ConsoleHost` history files, but note that the registry may store PowerShell execution policy settings (HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell) which attackers might modify.
4. Hunting for Registry-Based Persistence
Establishing persistence is a primary goal for attackers, and the registry offers numerous well-known and obscure locations to achieve this.
Step‑by‑step guide:
Step 1: Check Common Auto-Start Extensibility Points (ASEPs). Systematically examine the standard “Run” keys:
Use reg query on a loaded hive or a live system to check common persistence keys. reg query "HKLM\ForensicTemp\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" reg query "HKLM\ForensicTemp\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" For 32-bit apps on 64-bit OS reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" Requires loading the user's NTUSER.DAT
Also check `RunOnce`, `RunServices`, and their variants.
Step 2: Investigate Service Registrations. Malware often installs itself as a service. Examine HKLM\SYSTEM\CurrentControlSet\Services\. Look for new, suspicious service names, especially those with `ImagePath` pointing to unfamiliar executables in user writable directories like `Temp` or AppData.
Step 3: Look for File Association Hijacking. A sophisticated method involves changing the program that opens a common file type (e.g., .txt). Check keys like HKLM\SOFTWARE\Classes\txtfile\shell\open\command. If the `(Default)` value points to a malicious script instead of notepad.exe, the attacker gains execution whenever a `.txt` file is opened.
5. Extracting System Configuration and Network Evidence
The registry contains vital system data that provides context for the incident, such as the computer name, network settings, and past connected devices.
Step‑by‑step guide:
Step 1: Identify the System. The computer name is stored in HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\. The `Hostname` value under `HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\` provides the same. This is critical for verifying which machine’s image you are analyzing.
Step 2: Map Network Shares and Wi-Fi Profiles. The `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\` may contain `NullSessionShares` if configured. More importantly, past connected wireless networks are stored in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\, which can indicate if the system connected to a rogue access point.
Step 3: Review Mounted Devices and USB History. The `HKLM\SYSTEM\MountedDevices` key maps disk signatures to drive letters. The USB history is extensive, found in `SYSTEM` hive under CurrentControlSet\Enum\USBSTOR. This logs vendor, product, and serial number of every USB storage device ever connected—invaluable for tracking data exfiltration.
Using a targeted KAPE processor (via RECmd) to parse all USB artifacts from a SYSTEM hive. RECmd.exe -f E:\Evidence\SYSTEM.hive --kp USBDevices --csv C:\output\
What Undercode Say:
- The Registry is a Non-Linear Timeline: Unlike sequential logs, the registry is a database of state. A single key’s last-write time doesn’t tell the full story; correlating timestamps across multiple hives and keys is essential to reconstruct events accurately.
- Absence of Evidence is Not Evidence of Absence: Sophisticated attackers use techniques to hide registry modifications, such as operating directly in memory (like fileless malware), using “timestomping,” or leveraging obscure, undocumented keys (e.g.,
HKLM\SOFTWARE\Microsoft\Windows CE Services\AutoStartOnConnect). Your hunting must account for both what is present and what might be intentionally missing or altered.
Prediction:
The role of registry forensics will intensify but become more automated. As attackers increasingly adopt “living-off-the-land” techniques (LOLBins) and fileless persistence that leaves minimal disk footprint, the registry will remain a primary battleground because Windows intrinsically relies on it. We will see a rise in AI-assisted forensic tools that automatically correlate anomalous registry changes across thousands of endpoints in real-time, shifting registry analysis from a purely reactive, post-breach activity to a proactive hunting capability. However, this will also drive adversaries to develop more advanced anti-forensics methods targeting registry artefact collection and analysis tools themselves.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ayush Mishra – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
