Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Analyzing Windows Registry for Artifacts · mukul975 | DecimalAI

Analyzing Windows Registry For Artifacts

NewSkillScoreMaintained

analyzing-windows-registry-for-artifacts

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-windows-registry-for-artifacts/SKILL.md

decimalai skills pull analyzing-windows-registry-for-artifacts --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-windows-registry-for-artifacts/SKILL.md https://app.decimal.ai/s/analyzing-windows-registry-for-artifacts/SKILL.md

Raw file: /s/analyzing-windows-registry-for-artifacts/SKILL.md ↗ · machine-readable summary at /s/analyzing-windows-registry-for-artifacts.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

No — -100% lift+182% tokens0% turns0% of whole cases pass with skill (0/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-13	✗→✗	＝ Same ✗	—	—
case-10	✗→✗	＝ Same ✗	—	—
case-09	✗→✗	＝ Same ✗	—	—
case-01	✗→✗	＝ Same ✗	—	—
case-06	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-windows-registry-for-artifacts/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Analyzing Windows Registry for Artifacts

When to Use

When investigating user activity on a Windows system during an incident
For identifying autorun/persistence mechanisms used by malware
When tracing installed software, USB devices, and network connections
During insider threat investigations to reconstruct user actions
For correlating registry timestamps with other forensic artifacts

Prerequisites

Forensic image or extracted registry hive files
RegRipper, Registry Explorer (Eric Zimmerman), or python-registry
Access to registry hive locations (SAM, SYSTEM, SOFTWARE, NTUSER.DAT, UsrClass.dat)
Understanding of Windows Registry structure (hives, keys, values)
SIFT Workstation or forensic analysis environment

Workflow

Step 1: Extract Registry Hives from the Forensic Image

bash
# Mount the forensic image read-only
mkdir /mnt/evidence
mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence

# Copy system registry hives
cp /mnt/evidence/Windows/System32/config/SAM /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/SYSTEM /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/SOFTWARE /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/SECURITY /cases/case-2024-001/registry/
cp /mnt/evidence/Windows/System32/config/DEFAULT /cases/case-2024-001/registry/

# Copy user-specific hives
cp /mnt/evidence/Users/*/NTUSER.DAT /cases/case-2024-001/registry/
cp /mnt/evidence/Users/*/AppData/Local/Microsoft/Windows/UsrClass.dat /cases/case-2024-001/registry/

# Copy transaction logs (for dirty hive recovery)
cp /mnt/evidence/Windows/System32/config/*.LOG* /cases/case-2024-001/registry/logs/

# Hash all extracted hives
sha256sum /cases/case-2024-001/registry/* > /cases/case-2024-001/registry/hive_hashes.txt

Step 2: Analyze with RegRipper for Automated Artifact Extraction

bash
# Install RegRipper
git clone https://github.com/keydet89/RegRipper3.0.git /opt/regripper

# Run RegRipper against NTUSER.DAT (user profile)
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -f ntuser > /cases/case-2024-001/analysis/ntuser_report.txt

# Run against SYSTEM hive
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -f system > /cases/case-2024-001/analysis/system_report.txt

# Run against SOFTWARE hive
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \
   -f software > /cases/case-2024-001/analysis/software_report.txt

# Run against SAM hive (user accounts)
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SAM \
   -f sam > /cases/case-2024-001/analysis/sam_report.txt

# Run specific plugins
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -p userassist > /cases/case-2024-001/analysis/userassist.txt

perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p usbstor > /cases/case-2024-001/analysis/usbstor.txt

Step 3: Extract Persistence and Autorun Entries

bash
# Using python-registry for targeted extraction
pip install python-registry

python3 << 'PYEOF'
from Registry import Registry

# Open SOFTWARE hive
reg = Registry.Registry("/cases/case-2024-001/registry/SOFTWARE")

# Check Run keys (autostart)
autorun_paths = [
    "Microsoft\\Windows\\CurrentVersion\\Run",
    "Microsoft\\Windows\\CurrentVersion\\RunOnce",
    "Microsoft\\Windows\\CurrentVersion\\RunServices",
    "Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
    "Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
]

for path in autorun_paths:
    try:
        key = reg.open(path)
        print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===")
        for value in key.values():
            print(f"  {value.name()}: {value.value()}")
    except Registry.RegistryKeyNotFoundException:
        pass

# Check installed services
key = reg.open("Microsoft\\Windows NT\\CurrentVersion\\Svchost")
print(f"\n=== Svchost Groups ===")
for value in key.values():
    print(f"  {value.name()}: {value.value()}")
PYEOF

# Check NTUSER.DAT for user-specific autorun
python3 << 'PYEOF'
from Registry import Registry

reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT")

user_autorun = [
    "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
    "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
    "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run"
]

for path in user_autorun:
    try:
        key = reg.open(path)
        print(f"\n=== {path} (Last Modified: {key.timestamp()}) ===")
        for value in key.values():
            print(f"  {value.name()}: {value.value()}")
    except Registry.RegistryKeyNotFoundException:
        pass
PYEOF

Step 4: Analyze User Activity Artifacts

bash
# Extract UserAssist data (program execution history with ROT13 encoding)
python3 << 'PYEOF'
from Registry import Registry
import codecs, struct, datetime

reg = Registry.Registry("/cases/case-2024-001/registry/NTUSER.DAT")

ua_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist"
key = reg.open(ua_path)

for guid_key in key.subkeys():
    count_key = guid_key.subkey("Count")
    print(f"\n=== {guid_key.name()} ===")
    for value in count_key.values():
        decoded_name = codecs.decode(value.name(), 'rot_13')
        data = value.value()
        if len(data) >= 16:
            run_count = struct.unpack('<I', data[4:8])[0]
            focus_count = struct.unpack('<I', data[8:12])[0]
            timestamp = struct.unpack('<Q', data[60:68])[0] if len(data) >= 68 else 0
            if timestamp > 0:
                ts = datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=timestamp//10)
                print(f"  {decoded_name}: Runs={run_count}, Focus={focus_count}, Last={ts}")
            else:
                print(f"  {decoded_name}: Runs={run_count}, Focus={focus_count}")
PYEOF

# Extract Recent Documents (MRU lists)
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -p recentdocs > /cases/case-2024-001/analysis/recentdocs.txt

# Extract typed URLs (browser)
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -p typedurls > /cases/case-2024-001/analysis/typedurls.txt

# Extract typed paths in Explorer
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/NTUSER.DAT \
   -p typedpaths > /cases/case-2024-001/analysis/typedpaths.txt

Step 5: Extract System and Network Information

bash
# Computer name and OS version from SYSTEM hive
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p compname > /cases/case-2024-001/analysis/system_info.txt

# Network interfaces and configuration
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p nic2 >> /cases/case-2024-001/analysis/system_info.txt

# Wireless network history
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \
   -p networklist > /cases/case-2024-001/analysis/network_history.txt

# Timezone configuration
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p timezone > /cases/case-2024-001/analysis/timezone.txt

# Shutdown time
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SYSTEM \
   -p shutdown > /cases/case-2024-001/analysis/shutdown.txt

# Installed software from Uninstall keys
perl /opt/regripper/rip.pl -r /cases/case-2024-001/registry/SOFTWARE \
   -p uninstall > /cases/case-2024-001/analysis/installed_software.txt

Key Concepts

| Concept | Description | |---------|-------------| | Registry hive | Binary file storing a section of the registry (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) | | MRU (Most Recently Used) | Lists tracking recently accessed files, commands, and search terms | | UserAssist | ROT13-encoded registry entries tracking program execution with timestamps | | ShimCache | Application compatibility cache recording executed programs | | AmCache | Detailed execution history including SHA-1 hashes of executables | | BAM/DAM | Background/Desktop Activity Moderator tracking program execution in Win10+ | | Last Write Time | Timestamp on registry keys indicating when they were last modified | | Transaction logs | Journal files allowing recovery of registry state after improper shutdown |

Tools & Systems

| Tool | Purpose | |------|---------| | RegRipper | Automated registry artifact extraction with plugin architecture | | Registry Explorer | Eric Zimmerman GUI tool for interactive registry analysis | | python-registry | Python library for programmatic registry hive parsing | | RECmd | Eric Zimmerman command-line registry analysis tool | | yarp | Yet Another Registry Parser for Python-based analysis | | AppCompatCacheParser | Dedicated ShimCache/AppCompatCache parser | | AmcacheParser | Dedicated AmCache.hve analysis tool | | ShellBags Explorer | Specialized tool for analyzing ShellBag artifacts |

Common Scenarios

Scenario 1: Malware Persistence Investigation Extract SOFTWARE and NTUSER.DAT hives, check all Run/RunOnce keys for unauthorized entries, examine services for suspicious additions, check scheduled tasks registry keys, correlate autorun timestamps with malware execution timeline.

Scenario 2: User Activity Reconstruction Analyze UserAssist for program execution history, examine RecentDocs for accessed files, check TypedPaths for Explorer navigation, extract ShellBags for folder access patterns, build a timeline of user activity around the incident window.

Scenario 3: Unauthorized Software Detection Parse Uninstall keys for all installed applications, compare against approved software baseline, check BAM/DAM for recently executed programs not in approved list, examine AppCompatCache for execution evidence even after uninstallation.

Scenario 4: USB Data Exfiltration Investigation Extract USBSTOR entries from SYSTEM hive for connected devices, correlate device serial numbers with MountedDevices, check NTUSER.DAT MountPoints2 for user access to removable media, examine SetupAPI logs for first-connection timestamps.

Output Format

Registry Analysis Summary:
  System: DESKTOP-ABC123 (Windows 10 Pro Build 19041)
  Timezone: Eastern Standard Time (UTC-5)
  Last Shutdown: 2024-01-18 23:45:12 UTC

  Autorun Entries:
    HKLM Run:     5 entries (1 suspicious: "updater.exe" -> C:\ProgramData\svc\updater.exe)
    HKCU Run:     3 entries (all legitimate)
    Services:     142 entries (2 unknown: "WinDefSvc", "SysMonAgent")

  User Activity (NTUSER.DAT):
    UserAssist Programs:  234 entries
    Recent Documents:     89 entries
    Typed URLs:           45 entries
    Typed Paths:          12 entries

  USB Devices Connected:
    - Kingston DataTraveler (Serial: 0019E06B4521) - First: 2024-01-10, Last: 2024-01-18
    - WD My Passport (Serial: 575834314131) - First: 2024-01-15, Last: 2024-01-15

  Installed Software:     127 applications
  Suspicious Findings:    3 items flagged for review

Illustrative Want to see what analyzing-windows-registry-for-artifacts would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/27/2026, 23:58 UTC · 23 cases

Lift

-100%

0% vs 100%

Agent turns

0%

1.0 vs 1.0

Tokens

+182%

4,642.3 vs 1,645.13

fail → fail · 23

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-13 What specific RegRipper plugin names extract system timezone settings and last shutdown timestamp from the SYSTEM hive?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Where are `NTUSER.DAT` and `UsrClass.dat` hive files located relative to a user's profile directory on a standard Windows 10 installation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 What is the exact command syntax when executing RegRipper to parse only the USB storage plugin against a SYSTEM hive at `/cases/hive/SYSTEM`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I am investigating a potential insider threat on a workstation where suspicious USB activity and file access were reported. I have extracted the registry hive files from the mounted forensic image at `/cases/case-2024-001/registry/`. Please perform a full registry artifact extraction and analysis across the system and user hives to identify autoruns, user execution/activity, connected USB devices, and installed applications. Provide the results in the standardized Registry Analysis Summary block format covering system details, autorun entries, user activity breakdown, USB device history, software counts, and flagged findings.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We need to analyze file system timestamps on an NTFS volume using the `$MFT` file to detect timestamp manipulation (timestomping). Which tool parses `$MFT` records into MACB timeline formats?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 As part of an incident response investigation into an unapproved software installation and potential data exfiltration attempt, please analyze the provided Windows registry hives. Extract all pertinent persistence mechanisms, user activity tracking, network/system settings, and external media footprints. Output the final report structured strictly as a Registry Analysis Summary displaying system specs, shutdown timestamp, autorun checks, user interaction metrics from NTUSER.DAT, connected USB devices, total installed apps, and flagged suspicious items.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 An analyst is investigating an SSH brute-force attack on an Ubuntu server. Which log file stores authentication logs, and what command filters for failed password attempts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 Which RegRipper plugin extracts Windows Explorer typed folder paths from `NTUSER.DAT`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Which registry key path in the SOFTWARE hive holds 64-bit autostart application entries, and which key path holds 32-bit autostart entries on 64-bit Windows systems?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 On a headless forensic Linux server, what open-source Python library allows programmatic parsing of raw Windows registry hive files via object methods like `Registry.Registry()`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 I have acquired a raw physical memory dump (`memdump.raw`) from a suspect Windows 10 host. How do I scan the memory dump for hidden processes and injected DLL code?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 What does the timestamp recorded on a registry key represent in Windows registry forensics?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Which key in `NTUSER.DAT` records mapped drive letters and remote/removable storage volume mounts for an individual user?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When copying registry hives from a disk image of a system that crashed, transaction logs must be copied alongside the hive files to ensure complete recovery. Which transaction log file extensions match dirty hive transaction journals?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When writing Python code to extract binary UserAssist entries from `NTUSER.DAT` using programmatic registry libraries, how are the encoded application paths decoded?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What background activity monitoring registry service on Windows 10/11 tracks executable execution timestamps per user SID under the SYSTEM hive `Services` key?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We recently isolated an endpoint suspected of running unauthorized persistence mechanism executables from `ProgramData`. I need a complete forensic evaluation of the system and NTUSER registry hives extracted from the host. Summarize the findings following the structured Registry Analysis Summary outline, detailing the system identity and timezone, autostart/service configurations, user activity metrics (like UserAssist and MRU entries), USB hardware connection history with serial numbers and timestamps, software count, and identified suspicious items.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 What argument is passed to RegRipper's `-f` flag when processing the SAM registry hive?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 An investigator is reviewing extracted Windows Security Event Log files (`Security.evtx`) to detect brute force RDP attacks. Which Event ID numbers indicate failed logon attempts and successful logon events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 An investigator wants to query installed application records in `SOFTWARE`. What is the full subkey path under `Microsoft\Windows\CurrentVersion` where application uninstall information is indexed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 In RegRipper CLI (`rip.pl`), what distinction exists between the `-f` flag and the `-p` flag?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Which RegRipper plugin extracts wireless network history and known Wi-Fi network SSIDs from the SOFTWARE hive?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 When analyzing program execution artifacts, what unique cryptographic hash artifact is stored in `Amcache.hve` that is missing from ShimCache (`AppCompatCache`)?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of -100 percentage points is the difference between those two pass rates over the 23 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 100%
Pass rate with the skill: 0%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 2
Skill version measured: v1
Run completed: 7/27/2026, 23:58 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.