<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-windows-registry
description: >-
  Windows Registry forensic analysis including SAM, SYSTEM, SECURITY, SOFTWARE,
  and NTUSER.DAT hive parsing, user account enumeration, autorun persistence,
  USB device history, application execution evidence, and Registry timeline
  reconstruction using RegRipper, Registry Explorer, and python-registry.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - windows-registry
  - regripper
  - sam-hive
  - ntuser-dat
  - persistence
  - autoruns
  - usb-history
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1547.001", "T1012", "T1552.002", "T1112"]
  nist-csf: ["RS.AN-3", "RS.AN-4"]
  frameworks: ["NIST SP 800-86"]
---

# Analyzing Windows Registry

## Overview

The Windows Registry is a hierarchical database storing OS configuration, user
preferences, application settings, and hardware information. For forensics, it
provides evidence of user accounts, program execution, USB device connections,
autorun persistence mechanisms, network connections, and system configuration
changes with last-write timestamps on every key.

## Prerequisites

| Requirement | Details |
|---|---|
| RegRipper (`regripper`, `rip.pl`) | Required |
| Registry Explorer (Eric Zimmerman) or `reglookup` | Required |
| Python 3.10+ with `python-registry` library | Required |
| Offline Registry hives from forensic image | Required |

## Key Concepts

### Registry Hive Locations

```
C:\Windows\System32\config\SAM       — User accounts and password hashes
C:\Windows\System32\config\SYSTEM    — Hardware config, services, boot settings
C:\Windows\System32\config\SECURITY  — Security policies, cached credentials
C:\Windows\System32\config\SOFTWARE  — Installed software, OS settings
C:\Users\<user>\NTUSER.DAT           — User-specific settings
C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat — Shellbags, COM
```

### Key Forensic Registry Paths

**User Accounts (SAM):**
```
SAM\Domains\Account\Users\<RID>
SAM\Domains\Account\Users\Names\<username>
```

**Autorun Persistence (T1547.001):**
```
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
```

**Program Execution Evidence:**
```
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache (ShimCache)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Amcache
```

**USB Device History:**
```
SYSTEM\CurrentControlSet\Enum\USBSTOR
SYSTEM\CurrentControlSet\Enum\USB
SYSTEM\MountedDevices
SOFTWARE\Microsoft\Windows Portable Devices\Devices
```

**Network Evidence:**
```
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures
```

## Workflow

### Step 1: Extract Hives from Forensic Image

```bash
# Mount image read-only
mount -o ro,loop,offset=$((512*2048)) evidence.dd /mnt/evidence

# Copy registry hives
cp /mnt/evidence/Windows/System32/config/SAM ./SAM
cp /mnt/evidence/Windows/System32/config/SYSTEM ./SYSTEM
cp /mnt/evidence/Windows/System32/config/SECURITY ./SECURITY
cp /mnt/evidence/Windows/System32/config/SOFTWARE ./SOFTWARE

# Copy user hives
for user in /mnt/evidence/Users/*/; do
    username=$(basename "$user")
    [ -f "$user/NTUSER.DAT" ] && cp "$user/NTUSER.DAT" "./NTUSER_${username}.DAT"
done
```

### Step 2: Parse with RegRipper

```bash
# User accounts from SAM
regripper -r SAM -f sam

# System configuration
regripper -r SYSTEM -f system

# Installed software and OS info
regripper -r SOFTWARE -f software

# User activity
regripper -r NTUSER.DAT -f ntuser
```

### Step 3: Python Registry Analysis

```python
from Registry import Registry

def enumerate_autoruns(software_hive: str) -> list[dict]:
    reg = Registry.Registry(software_hive)
    autoruns = []
    run_paths = [
        "Microsoft\\Windows\\CurrentVersion\\Run",
        "Microsoft\\Windows\\CurrentVersion\\RunOnce",
        "Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
    ]
    for path in run_paths:
        try:
            key = reg.open(path)
            for val in key.values():
                autoruns.append({
                    "path": path,
                    "name": val.name(),
                    "value": val.value(),
                    "last_write": key.timestamp().isoformat(),
                })
        except Registry.RegistryKeyNotFoundException:
            continue
    return autoruns
```

### Step 4: USB Device Enumeration

```python
def enumerate_usb_devices(system_hive: str) -> list[dict]:
    reg = Registry.Registry(system_hive)
    devices = []
    try:
        usbstor = reg.open("ControlSet001\\Enum\\USBSTOR")
        for device_class in usbstor.subkeys():
            for instance in device_class.subkeys():
                devices.append({
                    "class": device_class.name(),
                    "serial": instance.name(),
                    "last_write": instance.timestamp().isoformat(),
                    "friendly_name": next(
                        (v.value() for v in instance.values()
                         if v.name() == "FriendlyName"), ""
                    ),
                })
    except Registry.RegistryKeyNotFoundException:
        pass
    return devices
```

### Step 5: UserAssist Decoding

```python
import codecs

def decode_userassist(ntuser_hive: str) -> list[dict]:
    """Decode ROT13-encoded UserAssist entries (program execution evidence)."""
    reg = Registry.Registry(ntuser_hive)
    entries = []
    ua_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist"
    try:
        ua_key = reg.open(ua_path)
        for guid_key in ua_key.subkeys():
            count_key = guid_key.subkey("Count")
            for val in count_key.values():
                decoded_name = codecs.decode(val.name(), "rot_13")
                entries.append({
                    "guid": guid_key.name(),
                    "program": decoded_name,
                    "last_write": count_key.timestamp().isoformat(),
                })
    except Registry.RegistryKeyNotFoundException:
        pass
    return entries
```

## Detection

```yaml
title: Windows Registry Detection
id: 3abaa9cd-8718-4407-ad90-e73627edb2da
status: experimental
description: Detects suspicious activity related to analyzing windows registry techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*windows*"
  condition: selection
level: medium
tags:
  - attack.t1547.001
  - attack.t1012
  - attack.t1552.002
  - attack.t1112
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Windows Registry Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1547.001, T1012, T1552.002, T1112 |

## Verification

- [ ] All relevant Registry hives extracted from forensic image
- [ ] SAM parsed for user account enumeration
- [ ] Autorun keys checked across SOFTWARE and NTUSER.DAT hives
- [ ] USB device history extracted from SYSTEM hive
- [ ] UserAssist decoded for program execution evidence
- [ ] Network profile history extracted
- [ ] Registry key last-write timestamps correlated with incident timeline

## References

- [RegRipper](https://github.com/keydet89/RegRipper3.0)
- [Registry Explorer — Eric Zimmerman](https://ericzimmerman.github.io/)
- [python-registry](https://github.com/williballenthin/python-registry)
- [MITRE T1547.001 — Registry Run Keys](https://attack.mitre.org/techniques/T1547/001/)
- [SANS Windows Registry Forensics](https://www.sans.org/posters/windows-forensic-analysis/)
