/usr/share/artifacts/windows.yaml

# Windows specific artifacts.

name: WindowsActiveDesktop
doc: Windows Active Desktop executable paths, used for persistence.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Desktop\Components\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Desktop\General'
conditions: [os_major_version < 6]
supported_os: [Windows]
urls:
- 'https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~DwnLdr-GWV/detailed-analysis.aspx'
- 'https://support.microsoft.com/en-us/kb/929200'
- 'https://en.wikipedia.org/wiki/Active_Desktop'
---
name: WindowsAlternateShell
doc: Alternate Shell to be run via Userinit.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot', value: 'AlternateShell'}
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option', value: 'UseAlternateShell'}
supported_os: [Windows]
urls:
- 'https://www.microsoftpressstore.com/articles/article.aspx'
- 'https://technet.microsoft.com/en-us/library/cc976124.aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsAMCacheHveFile
doc: The AMCache.hve Windows NT Registry file.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\AppCompat\Programs\Amcache.hve']
    separator: '\'
conditions: [os_major_version >= 6 AND os_minor_version >= 1]
supported_os: [Windows]
urls: ['http://www.swiftforensics.com/2013/12/amcachehve-in-windows-8-goldmine-for.html']
---
name: WindowsAppCertDLLs
doc: Windows AppCertDLLs persistence.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDLLs']
supported_os: [Windows]
urls: ['http://blogs.technet.com/b/mmpc/archive/2011/03/19/how-to-defang-the-fake-defragmenter.aspx']
---
name: WindowsAppCompatCache
doc: Windows Application Compatibility Cache
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility', value: 'AppCompatCache'}
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatCache', value: 'AppCompatCache'}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/master/documentation/Application%20Compatibility%20Cache%20key.asciidoc']
---
name: WindowsAppInitDLLs
doc: |
  Windows Application Initial (AppInit) DLLs persistence.

  AppInit DLLs is a mechanism that allows an arbitrary list of DLLs to be loaded
  into each user mode process on the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/dd744762(v=vs.85).aspx'
- 'https://support.microsoft.com/en-us/kb/197571'
---
name: WindowsApplicationRegistration
doc: Windows Application Registration (AppPath) Registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\*'
supported_os: [Windows]
urls:
- 'https://github.com/keydet89/RegRipper2.8/blob/master/plugins/apppaths.pl'
- 'http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ee872121(v=vs.85).aspx'
---
name: WinAppXRT
doc: WinAppXRT DLL loaded by .Net applications when the APPX_PROCESS environment variable is set.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\system32\WinAppXRT.dll'
    - '%%environ_systemroot%%\WinAppXRT.dll'
    - '%%environ_systemroot%%\System32\Wbem\WinAppXRT.dll'
    - '%%environ_systemroot%%\System32\WindowsPowerShell\v1.0\WinAppXRT.dll'
supported_os: [Windows]
conditions: [os_major_version >= 6 AND os_minor_version >= 2]
urls: ['http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/']
---
name: WindowsAutoexecBat
doc: Windows autoexec.bat file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\autoexec.bat'
      - '%%environ_windir%%\autoexec.nt'
    separator: '\'
supported_os: [Windows]
---
name: WindowsAutomaticDebugging
doc: Windows automatic debugging (Aedebug)
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug', value: 'Debugger'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/bb204634(v=vs.85).aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsAutomaticDebuggingExclusionList
doc: Windows automatic debugging (Aedebug) exclusion list
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AutoExclusionList\*']
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/bb204634(v=vs.85).aspx']
---
name: WindowsAutorun
doc: Filebased Tests.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemdrive%%\autorun.inf']
    separator: '\'
supported_os: [Windows]
---
name: WindowsAvailableTimeZones
doc: Timezones available on a Windows system.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\*\*']}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Time-zone-keys']
---
name: WindowsBITSQueueManagerDatabases
doc: Databases that contain the Windows BITS jobs definition and state.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_allusersprofile%%\Microsoft\Network\Downloader\qmgr*.dat'
supported_os: [Windows]
urls: ['http://dfrws.org/2015/proceedings/presentations/DFRWS2015-pres3.pdf']
---
name: WindowsBootVerificationProgram
doc: Path to custom startup verification program.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\BootVerificationProgram', value: 'ImagePath'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/cc786702(WS.10).aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsCodePage
doc: The code page of the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodePage', value: 'ACP'}
provides: [code_page]
supported_os: [Windows]
urls: ['http://en.wikipedia.org/wiki/Windows_code_page']
---
name: WindowsComputerName
doc: The name of the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\ComputerName', value: 'ComputerName'}
provides: [hostname]
supported_os: [Windows]
---
name: WindowsCommandProcessorAutoRun
doc: Commands that are run each time the Command Processor (Cmd.exe) is started.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor', value: 'AutoRun'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Command Processor', value: 'AutoRun'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Command Processor', value: 'AutoRun'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Command Processor', value: 'AutoRun'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/cc779439(v=ws.10).aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://blogs.msdn.com/b/oldnewthing/archive/2007/11/21/6447771.aspx'
- 'https://technet.microsoft.com/en-us/library/cc756720(v=ws.10).aspx'
---
name: WindowsCOMInprocHandlers
doc: Windows COM in-process handlers
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*', value: 'InprocHandler'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*', value: 'InprocHandler32'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*', value: 'InprocHandler'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*', value: 'InprocHandler32'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*', value: 'InprocHandler'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*', value: 'InprocHandler32'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*', value: 'InprocHandler'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*', value: 'InprocHandler32'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms694515(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms691354(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms693485(v=vs.85).aspx'
---
name: WindowsCOMInprocServers
doc: Windows COM in-process servers
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\InprocServer', value: ''}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\InprocServer32', value: ''}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\InprocServer', value: ''}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\InprocServer32', value: ''}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\InprocServer', value: ''}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\InprocServer32', value: ''}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\InprocServer', value: ''}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\InprocServer32', value: ''}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms694515(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms682390(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms694328(v=vs.85).aspx'
---
name: WindowsCOMLocalServers
doc: Windows COM local servers
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*', value: 'LocalServer'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\LocalServer32', value: ''}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\LocalServer32', value: 'ServerExecutable'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*', value: 'LocalServer'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\LocalServer32', value: ''}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\LocalServer32', value: 'ServerExecutable'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*', value: 'LocalServer'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\LocalServer32', value: ''}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\LocalServer32', value: 'ServerExecutable'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*', value: 'LocalServer'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\LocalServer32', value: ''}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\LocalServer32', value: 'ServerExecutable'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms694515(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms686595(v=vs.85).aspx'
---
name: WindowsCOMRegisteredTypeLibraries
doc: Windows COM registered type libraries
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Typelib\*\*\*\*', value: ''}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Typelib\*\*\*\*', value: ''}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Typelib\*\*\*\*', value: ''}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Typelib\*\*\*\*', value: ''}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/master/documentation/Component%20Object%20Model%20keys.asciidoc#type-libraries-key']
---
name: WindowsConfigSys
doc: Windows config.sys file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\config.sys'
      - '%%environ_windir%%\config.nt'
    separator: '\'
supported_os: [Windows]
---
name: WindowsControlPanelFilePaths
doc: DLLs listed here will be run when the user opens the Windows Control Panel.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Control Panel\CPLs'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Control Panel\CPLs'
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127454(v=vs.85).aspx'
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms683844(v=vs.85).aspx'
---
name: WindowsCredentialProviderFilters
doc: Windows Credential Provider Filters
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\*'
supported_os: [Windows]
urls: ['http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/']
---
name: WindowsCredentialProviders
doc: CLSIDs of applications to use as Credential Providers
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://blogs.technet.com/b/ad/archive/2009/05/26/thoughts-on-single-sign-on-and-credential-providers.aspx'
- 'http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/'
- 'https://www.sophos.com/en-us/support/knowledgebase/114190.aspx'
---
name: WindowsCommonFilePlacementAttacks
doc: Common files associated with search order hijacking and other file placement attacks.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_programfiles%%\Internet Explorer\sxs.dll'
      - '%%environ_programfilesx86%%\Internet Explorer\sxs.dll'
      - '%%environ_systemdrive%%\explorer.exe'
      - '%%environ_systemdrive%%\program.exe'
      - '%%environ_systemroot%%\linkinfo.dll'
      - '%%environ_systemroot%%\ntshrui.dll'
      - '%%environ_systemroot%%\System32\oci.dll'
      - '%%environ_systemroot%%\System32\sysprep\cryptbase.dll'
      - '%%environ_systemroot%%\SysWOW64\oci.dll'
      - '%%environ_systemroot%%\SysWOW64\sysprep\cryptbase.dll'
    separator: '\'
supported_os: [Windows]
urls:
- 'http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf'
- 'https://www.mandiant.com/blog/fxsst/'
---
name: WindowsCurrentVersion
doc: The Windows current verson
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'CurrentVersion'}]}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/master/documentation/System%20keys.asciidoc']
---
name: WindowsDebugger
doc: Windows Debugger peristence or AV disable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/a329t4ed%28VS.71%29.aspx']
---
name: WindowsDomainName
doc: The domain the system is connected to.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters', value: 'Domain'}
provides: [domain]
supported_os: [Windows]
---
name: WindowsEnvironmentUserLoginScripts
doc: User login scripts configured via Windows environment variables.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitLogonServer'}
      - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitLogonScript'}
      - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserMprLogonScript'}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/'
- 'https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/cb6f1d6f-60a6-4369-803e-ec03d902e638/gina-how-to-run-domain-scripts-after-logon'
---
name: WindowsEnvironmentVariableAllUsersAppData
doc: The %ProgramData% environment variable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'ProgramData'}
provides: [environ_allusersappdata]
supported_os: [Windows]
urls: ['http://environmentvariables.org/ProgramData']
---
name: WindowsEnvironmentVariableAllUsersProfile
doc: The %AllUsersProfile% environment variable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'AllUsersProfile'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'ProfilesDirectory'}
provides: [environ_allusersprofile]
supported_os: [Windows]
urls: ['http://support.microsoft.com/kb//214653']
---
name: WindowsEnvironmentVariableAppxProcess
doc: |
  The %APPX_PROCESS% environment variable.

  If this variable is set, .NET applications will attempt to load WinAppXRT.dll
  from PATH, which is a potential persistence mechanism.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'APPX_PROCESS'}
supported_os: [Windows]
conditions: [os_major_version >= 6 AND os_minor_version >= 2]
urls: ['http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/']
---
name: WindowsEnvironmentVariablePath
doc: The %PATH% environment variable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment', value: 'Path'}
provides: [environ_path]
supported_os: [Windows]
urls: ['http://environmentvariables.org/Path']
---
name: WindowsEnvironmentVariableProgramFiles
doc: The %ProgramFiles% environment variable.
sources:
- type: PATH
  attributes:
    paths: ['\Program Files']
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion', value: 'ProgramFilesDir'}
provides: [environ_programfiles]
supported_os: [Windows]
urls: ['http://environmentvariables.org/ProgramFiles']
---
name: WindowsEnvironmentVariableProgramFilesX86
doc: The %ProgramFiles(x86)% environment variable.
sources:
- type: PATH
  attributes:
    paths: ['\Program Files (x86)']
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion', value: 'ProgramFilesDir (x86)'}
provides: [environ_programfilesx86]
supported_os: [Windows]
urls: ['http://environmentvariables.org/ProgramFiles']
---
name: WindowsEnvironmentVariableSystemDrive
doc: |
  The %SystemDrive% environment variable, usually "C:".

  This value isn't actually present in the Registry but with some parsing we
  can figure it out from SystemRoot.
sources:
- type: ARTIFACT_GROUP
  attributes: {names: ['WindowsEnvironmentVariableSystemRoot']}
provides: [environ_systemdrive]
supported_os: [Windows]
urls:
- 'http://environmentvariables.org/SystemDrive'
- 'https://msdn.microsoft.com/en-us/library/cc231436.aspx'
---
name: WindowsEnvironmentVariableSystemRoot
doc: The system root directory path, defined by %SystemRoot%, typically "C:\Windows".
sources:
- type: PATH
  attributes:
    paths:
      - '\Windows'
      - '\WinNT'
      - '\WINNT35'
      - '\WTSRV'
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'SystemRoot'}
provides: [environ_systemroot]
supported_os: [Windows]
urls: ['http://environmentvariables.org/SystemRoot']
---
name: WindowsEnvironmentVariableTemp
doc: The %TEMP% environment variable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment', value: 'TEMP'}
provides: [environ_temp]
supported_os: [Windows]
urls: ['http://environmentvariables.org/Temp']
---
name: WindowsEnvironmentVariableWinDir
doc: The %WinDir% environment variable.
sources:
- type: PATH
  attributes:
    paths:
      - '\Windows'
      - '\WinNT'
      - '\WINNT35'
      - '\WTSRV'
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment', value: 'windir'}
provides: [environ_windir]
supported_os: [Windows]
urls: ['http://environmentvariables.org/WinDir']
---
name: WindowsEventLogs
doc: Windows Event logs.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
      - 'WindowsEventLogApplication'
      - 'WindowsEventLogSecurity'
      - 'WindowsEventLogSystem'
      - 'WindowsXMLEventLogApplication'
      - 'WindowsXMLEventLogSecurity'
      - 'WindowsXMLEventLogSystem'
labels: [Logs]
supported_os: [Windows]
---
name: WindowsEventLogApplication
doc: Application Windows Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\AppEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: WindowsEventLogSecurity
doc: Security Windows Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\SecEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: WindowsEventLogSystem
doc: System Windows Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\SysEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: WindowsXMLEventLogApplication
doc: Application Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Application.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: WindowsXMLEventLogSecurity
doc: Security Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Security.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: WindowsXMLEventLogSystem
doc: System Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\System.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: WindowsXMLEventLogTerminalServices
doc: TerminalServices Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: WindowsExcludeFromKnownDLLs
doc: ExcludeFromKnownDLLs can be used to bypass search order hijacking protection.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'ExcludeFromKnownDLLs'}]
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586%28v=vs.85%29.aspx']
---
name: WindowsExplorerAppKey
doc: Handlers for special keys on some keyboards (file path or CLSID).
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AppKey\*', value: 'ShellExecute'}
supported_os: [Windows]
urls:
- 'http://answers.microsoft.com/en-us/windows/forum/windows_vista-hardware/assigning-the-special-keys-at-the-top-of-the/d1ab2e13-5297-457d-a8e8-bc2c883d8b58?db=5'
- 'http://h30434.www3.hp.com/t5/Notebook-Hardware/How-do-I-customize-the-Action-Keys/td-p/379207'
---
name: WindowsExplorerAutoplayHandlers
doc: Handlers for autoplay events in Windows Explorer.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\*']
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa468474.aspx'
---
name: WindowsExplorerContextMenuHandlers
doc: Handlers for subcommands on context menu
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
        - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\*', value: 'CommandStateHandler'}
        - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\*', value: 'ExplorerCommandHandler'}
        - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\*', value: 'command'}
        - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\*\command', value: 'DelegateExecute'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127467(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/cc144171(v=vs.85).aspx'
- 'http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commandstore-shell-windows-closewindow'
- 'http://www.checkfilename.com/view-details/Windows-7-Ultimate/RespageIndex/4/sTab/2/'
---
name: WindowsExplorerNamespaceCommonPlaces
doc: CLSIDs listed here are used to populate the Common Places items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace\DelegateFolders'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\CommonPlaces\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\CommonPlaces\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\CommonPlaces\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\CommonPlaces\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx'
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm'
- 'http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces'
---
name: WindowsExplorerNamespaceControlPanel
doc: CLSIDs listed here are used to populate the Control Panel items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanel\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanel\NameSpace\DelegateFolders'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanelWOW64\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanelWOW64\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpaceWOW64\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanelWOW64\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanelWOW64\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanelWOW64\NameSpace\DelegateFolders'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanel\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanel\NameSpace\DelegateFolders'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanelWOW64\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Wow6432Node\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanelWOW64\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx'
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm'
---
name: WindowsExplorerNamespaceDesktop
doc: CLSIDs listed here are used to populate the Desktop items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\Desktop\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\Desktop\NameSpace\DelegateFolders'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Wow6432Node\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\Desktop\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\Desktop\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop'
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm'
- 'http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm'
- 'https://support.microsoft.com/en-us/kb/321777'
---
name: WindowsExplorerNamespaceMyComputer
doc: CLSIDs listed here are used to populate the MyComputer items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\MyComputer\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\MyComputer\NameSpace\DelegateFolders'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Wow6432Node\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\MyComputer\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\MyComputer\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm'
- 'http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/'
- 'http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5'
---
name: WindowsExplorerNamespaceNetworkNeighborhood
doc: CLSIDs listed here are used to populate the Network Neighborhood items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\NetworkNeighborhood\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\NetworkNeighborhood\NameSpace\DelegateFolders'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\NetworkNeighborhood\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\NetworkNeighborhood\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm'
- 'http://www.lavasoft.com/mylavasoft/rogues/secretservice'
- 'http://www.wikihow.com/Manually-Remove-Macatte-Malware'
---
name: WindowsExplorerNamespacePrintersAndFaxes
doc: CLSIDs listed here are used to populate the Printer and Fax items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\PrintersAndFaxes\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\PrintersAndFaxes\NameSpace\DelegateFolders'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace\DelegateFolders'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\PrintersAndFaxes\NameSpace'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\PrintersAndFaxes\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm'
---
name: WindowsFileTypeAutorunAssociations
doc: |
  Registry value for what application class identifier (CLSID) to launch for a file extension.

  Extension subkeys start with a dot.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Classes\.*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\.*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\.*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\.*'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/ms678415(v=vs.85).aspx']
---
name: WindowsGroupPolicyScripts
doc: Windows group policy scripts
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\GroupPolicy\User\Scripts\scripts.ini'
    separator: '\'
supported_os: [Windows]
---
name: WindowsHostsFiles
doc: The Windows hosts and lmhosts file.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\Drivers\etc\Lmhosts'
      - '%%environ_systemroot%%\System32\Drivers\etc\hosts'
    separator: '\'
supported_os: [Windows]
---
name: WindowsHotkeyReplacement
doc: Hotkey executable replacement.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\magnifier.exe'
      - '%%environ_systemroot%%\System32\sethc.exe'
      - '%%environ_systemroot%%\System32\utilman.exe'
    separator: '\'
supported_os: [Windows]
---
name: WindowsInstallationDateTime
doc: Windows installation date and time
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'InstallDate'}
supported_os: [Windows]
---
name: WindowsLogoffScript
doc: Windows policy logoff script
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Logoff'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Logoff'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/ff404236.aspx']
---
name: WindowsLogonScript
doc: Windows policy logon script
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Logon'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Logon'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/ff404236.aspx']
---
name: WindowsLSAAuthenticationPackages
doc: Authentication Packages can be injected into LSASS.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa', value: 'Authentication Packages'}
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig', value: 'Authentication Packages'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://technet.microsoft.com/en-us/library/cc963218.aspx'
---
name: WindowsLSANotificationPackages
doc: Notification Packages can be injected into LSASS.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa', value: 'Notification Packages'}
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig', value: 'Notification Packages'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://technet.microsoft.com/en-us/library/cc963221.aspx'
---
name: WindowsLSASecurityPackages
doc: Security Packages can be injected into LSASS.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa', value: 'Security Packages'}
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig', value: 'Security Packages'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa379392(v=vs.85).aspx'
- 'https://dl.mandiant.com/EE/library/MIRcon2014/MIRcon_2014_IR_Track_Analysis_of_Malicious_SSP.pdf'
---
name: WindowsMetroApplicationCache
doc: Windows Metro application cache.
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%\AppData\Local\Packages\*\AC\INetCache']}
supported_os: [Windows]
urls:
- 'http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look'
---
name: WindowsMetroApplicationCookies
doc: Windows Metro application cookies.
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%\AppData\Local\Packages\*\AC\INetCookies']}
supported_os: [Windows]
urls:
- 'http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look'
---
name: WindowsMetroApplicationHistory
doc: Windows Metro application history.
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%\AppData\Local\Packages\*\AC\INetHistory']}
supported_os: [Windows]
urls:
- 'http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look'
---
name: WindowsMetroUserPinnedFavoriteTiles
doc: Windows Metro user-pinned favorite tiles.
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%\AppData\Local\Microsoft\Windows\RoamingTiles']}
supported_os: [Windows]
urls:
- 'http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look'
---
name: WindowsMostRecentApplication
doc: Windows Most Recent Application name key
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\*\MostRecentApplication', value: 'Name'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\*\MostRecentApplication', value: 'Name'}
supported_os: [Windows]
urls:
- 'http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_ransom.smc7'
- 'https://www.symantec.com/security_response/writeup.jsp?docid=2014-092314-3644-99&tabid=2'
---
name: WindowsMSDTCDLLs
doc: Windows MSDTC attempts to load these DLLs on start
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\MSDTC\MTxOCI\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\MSDTC\MTxOCI\*'
supported_os: [Windows]
urls: ['https://www.mandiant.com/blog/hikit-rootkit-advanced-persistent-attack-techniques-part-1-2/']
---
name: WindowsMultiMediaDrivers
doc: Configured drivers for different multimedia filetypes.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\*']
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://support.microsoft.com/en-us/kb/126054'
---
name: WindowsNetworkShellHelpers
doc: Windows Network Shell (netsh) helpers are loaded on boot
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Netsh'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Netsh'
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/242468']
---
name: WindowsOpenSaveMRU
doc: Information about files opened or saved in a Windows shell dialog.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDIg32\OpenSaveMRU\*\*']
conditions: [os_major_version < 6]
supported_os: [Windows]
urls:
 - 'http://www.forensicswiki.org/wiki/OpenSaveMRU'
 - 'https://digital-forensics.sans.org/blog/2010/04/02/openrunsavemru-lastvisitedmru'
---
name: WindowsOpenSavePidlMRU
doc: Information about files opened or saved in a Windows shell dialog.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\*']
conditions: [os_major_version >= 6]
supported_os: [Windows]
urls:
 - 'https://digital-forensics.sans.org/blog/2010/04/02/openrunsavemru-lastvisitedmru'
 - 'http://www.forensicswiki.org/wiki/OpenSavePidlMRU'
---
name: WindowsPendingFileRenames
doc: Windows Pending file renames on reboot
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'PendingFileRenameOperations'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc960241.aspx']
---
name: WindowsPersistenceMechanisms
doc: Persistence mechanisms in Windows.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
      - WindowsPersistenceRegistryKeys
      - WindowsPowerShellDefaultProfiles
      - WindowsServices
  returned_types: [PersistenceFile]
labels: [Software]
supported_os: [Windows]
---
name: WindowsPersistenceRegistryKeys
doc: Windows Registry keys used for persistence.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
      - InternetExplorerBrowserHelperObjects
      - WindowsActiveDesktop
      - WindowsAlternateShell
      - WindowsAppCertDLLs
      - WindowsAppInitDLLs
      - WindowsBootVerificationProgram
      - WindowsCommandProcessorAutoRun
      - WindowsCredentialProviderFilters
      - WindowsCredentialProviders
      - WindowsDebugger
      - WindowsEnvironmentUserLoginScripts
      - WindowsExplorerAutoplayHandlers
      - WindowsFileTypeAutorunAssociations
      - WindowsLSAAuthenticationPackages
      - WindowsLSANotificationPackages
      - WindowsLSASecurityPackages
      - WindowsMSDTCDLLs
      - WindowsMultiMediaDrivers
      - WindowsNetworkShellHelpers
      - WindowsPLAPProviders
      - WindowsPrintMonitors
      - WindowsRunGrpConv
      - WindowsRunKeys
      - WindowsRunServices
      - WindowsScreenSaverExecutable
      - WindowsSecurityProviders
      - WindowsServiceControlManagerExtension
      - WindowsSessionManagerBootExecute
      - WindowsSessionManagerExecute
      - WindowsSessionManagerSetupExecute
      - WindowsSessionManagerSubSystems
      - WindowsSessionManagerWOWCommandLine
      - WindowsSharedTaskScheduler
      - WindowsShellExecuteHooks
      - WindowsShellExtensions
      - WindowsShellIconOverlayIdentifiers
      - WindowsShellLoadAndRun
      - WindowsShellOpenCommand
      - WindowsShellServiceObjects
      - WindowsStubPaths
      - WindowsSystemPolicyShell
      - WindowsTerminalServerRunKeys
      - WindowsTerminalServerStartupPrograms
      - WindowsToolPaths
      - WindowsWinlogonGinaDLL
      - WindowsWinlogonNotify
      - WindowsWinlogonShell
      - WindowsWinlogonSystem
      - WindowsWinlogonTaskman
      - WindowsWinlogonUiHost
      - WindowsWinlogonUserinit
      - WindowsWinlogonVMApplet
      - WinSock2LayeredServiceProviders
      - WinSock2NamespaceProviders
labels: [Software]
supported_os: [Windows]
---
name: WindowsPLAPProviders
doc: Windows Pre-Logon Access Provider (PLAP) Providers
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\*'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/bb530584(v=vs.85).aspx']
---
name: WindowsPolicyDisallowRun
doc: Restrict users from running specific applications, typically used by malware to block AV.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\*']
labels: [Software]
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/323525']
---
name: WindowsPowerShellDefaultProfiles
doc: Default PowerShell Profile files. These files are executed by default when PowerShell starts up.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\system32\WindowsPowerShell\v1.0\profile.ps1'
      - '%%environ_systemroot%%\system32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1'
      - '%%users.homedir%%\Documents\WindowsPowerShell\profile.ps1'
      - '%%users.homedir%%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1'
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/magazine/2008.10.windowspowershell.aspx#id0190010'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: WindowsPowerShellEnableScripts
doc: Registry keys that control whether PowerShell scripts can execute directly.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\PowerShell', value: 'EnableScripts'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell', value: 'EnableScripts'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/library/hh847748.aspx'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: WindowsPowerShellExecutionPolicies
doc: PowerShell Script Execution Policies for all users, and the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\PowerShell', value: 'ExecutionPolicy'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell', value: 'ExecutionPolicy'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/library/hh847748.aspx'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: WindowsPrefetchFiles
doc: Windows Prefetch files.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\Prefetch\*.pf']
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Prefetch']
---
name: WindowsPrintMonitors
doc: Windows Print Monitor DLL config.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Monitors\*', value: 'Driver'}]
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://support.microsoft.com/en-us/kb/102966'
---
name: WindowsProductName
doc: The Windows product name
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'ProductName'}]}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/master/documentation/System%20keys.asciidoc']
---
name: WindowsProgramsCache
doc: Windows Programs Cache
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage', value: 'ProgramsCache'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2', value: 'ProgramsCache'}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/master/documentation/Programs%20Cache%20values.asciidoc']
---
name: WindowsRecentFileCacheBCF
doc: The RecentFileCache.bcf file.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\AppCompat\Programs\RecentFileCache.bcf']
    separator: '\'
conditions: [os_major_version >= 6 AND os_minor_version >= 1]
supported_os: [Windows]
urls: ['https://github.com/libyal/assorted/blob/master/documentation/RecentFileCache.bcf%20format.asciidoc']
---
name: WindowsRecycleBin
doc: Windows Recycle Bin (Recyler, $Recycle.Bin) files.
sources:
- type: FILE
  attributes:
    paths:
      - '\$Recycle.Bin\**'
      - '\Recycler\**'
    separator: '\'
labels: [Users]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows#Recycle_Bin']
---
name: WindowsRegistryCurrentControlSet
doc: The current control set of the Windows Registry.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\Select', value: 'Current'}]}
provides: [current_control_set]
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/System-keys']
---
name: WindowsRegistryProfiles
doc: |
  Get SIDs for all users on the system with profiles present in the Registry.

  This looks in the Windows Registry where the profiles are stored and retrieves
  the paths for each profile.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\*', value: 'ProfileImagePath'}]}
labels: [Users]
provides: [users.sid, users.userprofile, users.homedir, users.username]
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/windows/desktop/bb776892(v=vs.85).aspx']
---
name: WindowsRoverAutostartDLL
doc: |
  Windows Rover autostart DLL.

  The DLL loaded via the Windows Rover autostart mechanism.
  If this file exists, and the Rover autostart Registry key is set,
  userinit.exe will load this file and call its RunMonitor export.
sources:
- type: FILE
  attributes: {paths: ['%%environ_systemroot%%\System32\rover.dll']}
supported_os: [Windows]
urls: ['http://www.hexacorn.com/blog/2014/05/21/beyond-good-ol-run-key-part-12/']
---
name: WindowsRoverAutostartKey
doc: |
  Windows Rover autostart Registry key.

  When set userinit.exe will load the DLL at %SystemRoot%\System32\rover.dll and call its RunMonitor export.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_CLASSES_ROOT\CLSID\{16d12736-7a9e-4765-bec6-f301d679caaa}']}
supported_os: [Windows]
urls: ['http://www.hexacorn.com/blog/2014/05/21/beyond-good-ol-run-key-part-12/']
---
name: WindowsRunGrpConv
doc: |
  The Windows RunGrpConv Registry value.

  When this Registry value is non-zero userinit.exe will launch grpconv.exe at user login.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'RunGrpConv'}]}
supported_os: [Windows]
conditions: [os_major_version <= 5]
urls:
- 'http://www.hexacorn.com/blog/2014/06/18/beyond-good-ol-run-key-part-13/'
- 'http://www.exploit-id.com/local-exploits/windows-xp-sp2-grpconv-exe'
---
name: WindowsRunKeys
doc: |
  Windows Run and RunOnce keys.

  Note users.sid will currently only expand to SIDs with profiles
  on the system, not all SIDs.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
labels: [Software]
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx'
- 'https://support.microsoft.com/en-us/kb/137367'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://technet.microsoft.com/en-us/magazine/ee851671.aspx'
---
name: WindowsRunServices
doc: Windows Run Services.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\*'
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/179365']
---
name: WindowsScheduledTasks
doc: Windows Scheduled Tasks.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\Tasks\**10'
      - '%%environ_systemroot%%\System32\Tasks\**10'
      - '%%environ_systemroot%%\SysWow64\Tasks\**10'
    separator: '\'
supported_os: [Windows]
urls: ['http://forensicswiki.org/wiki/Windows#Scheduled_Tasks']
---
name: WindowsScreenSaverExecutable
doc: ScreenSaver Executable
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\Control Panel\Desktop', value: 'scrnsave.exe'}
      - {key: 'HKEY_USERS\%%users.sid%%\Control Panel\Desktop', value: 'scrnsave.exe'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://technet.microsoft.com/en-us/library/cc737855(v=ws.10).aspx'
- 'https://technet.microsoft.com/en-us/library/cc957840.aspx'
---
name: WindowsSearchDatabase
doc: Windows Search database (Windows.edb).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\Microsoft\Search\Data\Applications\Windows\Windows.edb']
    separator: '\'
labels: [Software]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Desktop_Search']
---
name: WindowsSecurityProviders
doc: Security Providers DLLs
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\*']
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://github.com/wmark/security-configuration/blob/master/Windows/disable-weak-ciphers-and-enable-TLS1.x.reg'
---
name: WindowsServiceControlManagerExtension
doc: Windows service control manager extension
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control', value: 'ServiceControlManagerExtension'}]
labels: [Software]
supported_os: [Windows]
urls:
- 'http://forum.sysinternals.com/autoruns-and-windows-7_topic19770.html'
- 'https://support.microsoft.com/en-us/kb/102985'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.silentrunners.org/Silent%20Runners.vbs'
---
name: WindowsServices
doc: Windows services from the Registry.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\*\*'
      - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\*\Parameters\*'
labels: [Software]
supported_os: [Windows]
urls:
- 'http://support.microsoft.com/kb/103000'
- 'https://github.com/libyal/winreg-kb/wiki/System-keys'
---
name: WindowsSessionManagerBootExecute
doc: Windows Session Manager BootExecute persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'BootExecute'}]
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc963230.aspx']
---
name: WindowsSessionManagerExecute
doc: Windows Session Manager Execute persistence
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'Execute'}]
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc976130.aspx']
---
name: WindowsSessionManagerSetupExecute
doc: Windows Session Manager SetupExecute persistence
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'SetupExecute'}]
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/dd392286%28v=vs.85%29.aspx']
---
name: WindowsSessionManagerSubSystems
doc: Windows Session Manager SubSystems persistence
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems', value: 'Windows'}]
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/cc976130.aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsSessionManagerWOWCommandLine
doc: Windows Session Manager Windows-on-Windows (WOW) command line
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\WOW', value: 'cmdline'}
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\WOW', value: 'wowcmdline'}
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/102986']
---
name: WindowsSharedTaskScheduler
doc: Runs on windows boot.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.bleepingcomputer.com/tutorials/windows-program-automatic-startup-locations/'
---
name: WindowsShellExecuteHooks
doc: Shell execution hooks are called when ShellExecuteEx() is called.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
- 'https://code.google.com/p/regripper/wiki/ASEPs'
---
name: WindowsShellExtensions
doc: Approved extensions to the Windows Shell (explorer.exe).
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/cc144110(v=vs.85).aspx']
---
name: WindowsShellHandlersRegistryKeys
doc: |
  Windows registry values for shell handler artifacts.

  ContextMenuHandlers are added to right-click menus.
  CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
  settings to trigger on these actions.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\ColumnHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\CopyHookHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\DragDropHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\CopyHookHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\DragDropHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\ColumnHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\CopyHookHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\DragDropHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Directory\Background\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Directory\Background\ShellEx\CopyHookHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Directory\Background\ShellEx\DragDropHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Directory\Background\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\ColumnHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\CopyHookHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\DragDropHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\CopyHookHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\DragDropHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\ColumnHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\CopyHookHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\DragDropHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Directory\Background\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Directory\Background\ShellEx\CopyHookHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Directory\Background\ShellEx\DragDropHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Directory\Background\ShellEx\PropertySheetHandlers\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm'
- 'http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r'
---
name: WindowsShellIconOverlayIdentifiers
doc: Called to display custom icons.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127455(v=vs.85).aspx'
---
name: WindowsShellLoadAndRun
doc: Windows Shell Load and Run values
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'Load'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'Run'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows', value: 'Load'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows', value: 'Run'}
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/103865']
---
name: WindowsShellOpenCommand
doc: Executed every time this file type is opened, should be "%1 %*".
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\shell\open\command'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\shell\open\command'
supported_os: [Windows]
urls: ['http://gladiator-antivirus.com/forum/index.php?showtopic=24610']
---
name: WindowsShellServiceObjects
doc: Windows Shell (explorer.exe) service objects delayed load.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad'
supported_os: [Windows]
urls: ['http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=TrojanClicker:Win32/Zirit.X#tab=2']
---
name: WindowsSetupApiLogs
doc: Windows setup API logs.
sources:
- type: FILE
  attributes: {paths: ['%%environ_systemroot%%\setupapi.log']}
  conditions: [os_major_version < 6]
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\inf\setupapi.app.log'
      - '%%environ_systemroot%%\inf\setupapi.dev.log'
      - '%%environ_systemroot%%\inf\setupapi.offline.log'
    separator: '\'
  conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Setup_API_Logs']
---
name: WindowsShutdownScript
doc: Windows policy shutdown script
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Shutdown'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/ff404236.aspx']
---
name: WindowsStartupFolderModification
doc: Windows startup folder Registry values.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
supported_os: [Windows]
---
name: WindowsStartupFolders
doc: Windows startup folder persistence.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%\Start Menu\Programs\Startup\*'
      - '%%environ_allusersprofile%%\Start Menu\Programs\Startup\*'
      - '%%users.homedir%%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*'
      - '%%environ_allusersprofile%%\Microsoft\Windows\Start Menu\Programs\Startup\*'
    separator: '\'
supported_os: [Windows]
---
name: WindowsStartupScript
doc: Windows policy startup script
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Startup'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/ff404236.aspx']
---
name: WindowsStubPaths
doc: Windows StubPath persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
supported_os: [Windows]
---
name: WindowsSuperFetchFiles
doc: Windows SuperFetch files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\Prefetch\Ag*.db'
      - '%%environ_systemroot%%\Prefetch\Ag*.db.trx'
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/SuperFetch']
---
name: WindowsSystemIniFiles
doc: Windows system ini files
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\system.ini'
      - '%%environ_windir%%\win.ini'
      - '%%environ_windir%%\wininit.ini'
    separator: '\'
supported_os: [Windows]
---
name: WindowsSystemPolicyShell
doc: Windows System policy replacement shell (custom user interface).
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'Shell'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'Shell'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc728472(v=ws.10).aspx']
---
name: WindowsSystemRegistryFiles
doc: Windows system Registry files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\config\SAM'
      - '%%environ_systemroot%%\System32\config\SECURITY'
      - '%%environ_systemroot%%\System32\config\SOFTWARE'
      - '%%environ_systemroot%%\System32\config\SYSTEM'
      - '\System Volume Information\Syscache.hve'
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Registry-files']
---
name: WindowsTempDirectories
doc: Contents of the Windows temporary directories
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemdrive%%\Temp\*'
    - '%%environ_systemroot%%\Temp\*'
    - '%%users.localappdata%%\Temp\*'
    separator: '\'
supported_os: [Windows]
---
name: WindowsTerminalServerRunKeys
doc: Windows Terminal Server Run keys
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
supported_os: [Windows]
urls: ['http://gladiator-antivirus.com/forum/index.php?showtopic=24610']
---
name: WindowsTerminalServerStartupPrograms
doc: Windows Terminal Server Startup Programs
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd', value: 'StartupPrograms'}
supported_os: [Windows]
urls: ['http://forum.sysinternals.com/rdpclip_topic4729.html']
---
name: WindowsTimezone
doc: The timezone of the system in Olson format.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation', value: 'StandardName'}]}
provides: [time_zone]
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Time-zone-keys']
---
name: WindowsToolPaths
doc: Paths to windows tools such as defrag, chkdsk.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath'
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\ChkDskPath'
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath'
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.liutilities.com/products/registrybooster/tweaklibrary/tweaks/11118/'
---
name: WindowsUninstallKeys
doc: Uninstall Registry keys
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Userdata\%%users.sid%%\Products\*\InstallProperties'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/aa372105(v=vs.85).aspx']
---
name: WindowsUpdateStatus
doc: Windows auto update status.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect', value: 'LastSuccessTime'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download', value: 'LastSuccessTime'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install', value: 'LastSuccessTime'}
supported_os: [Windows]
urls:
- 'http://forensicswiki.org/wiki/Windows_Update'
- 'http://blogs.msdn.com/b/aruns_blog/archive/2011/06/20/active-setup-registry-key-what-it-is-and-how-to-create-in-the-package-using-admin-studio-install-shield.aspx'
---
name: WindowsUserDownloadsDirectory
doc: User downloads directory
sources:
- type: DIRECTORY
  attributes:
    paths: ['%%users.homedir%%\Downloads\*']
    separator: '\'
labels: [Users]
supported_os: [Windows]
---
name: WindowsUserRecentFiles
doc: Windows user specific recent files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.appdata%%\Roaming\Microsoft\Office\Recent\*'
      - '%%users.appdata%%\Roaming\Microsoft\Windows\Recent\*'
    separator: '\'
labels: [Users]
supported_os: [Windows]
---
name: WindowsUserRegistryFiles
doc: Windows user specific Registry files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%\NTUSER.DAT'
      - '%%users.homedir%%\NTUSER.MAN'
      - '%%users.localappdata%%\Microsoft\Windows\UsrClass.dat'
    separator: '\'
labels: [Users]
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Registry-files']
---
name: WindowsUserShellFolders
doc: The Shell Folders information for Windows users.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\*'
      - 'HKEY_USERS\%%users.sid%%\Environment\*'
      - 'HKEY_USERS\%%users.sid%%\Volatile Environment\*'
provides:
- users.cookies
- users.appdata
- users.personal
- users.startup
- users.homedir
- users.desktop
- users.internet_cache
- users.localappdata
- users.localappdata_low
- users.recent
- users.userprofile
- users.temp
supported_os: [Windows]
---
name: WindowsWinlogonGinaDLL
doc: Windows Gina DLL replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'GinaDLL'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'GinaDLL'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinlogonNotify
doc: Windows Winlogon Notify DLL names.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*', value: 'DLLName'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*', value: 'DLLName'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/aa379402(v=vs.85).aspx']
---
name: WindowsWinlogonShell
doc: Windows shell replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Shell'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Shell'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/ms838576%28v=winembedded.5%29.aspx']
---
name: WindowsWinlogonSystem
doc: Applications launched by Winlogon in the system context during the system initialisation.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'System'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'System'}
supported_os: [Windows]
urls:
- 'https://code.google.com/p/regripper/wiki/ASEPs'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
---
name: WindowsWinlogonTaskman
doc: Windows Winlogon Taskman replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Taskman'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Taskman'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinlogonUiHost
doc: Windows Winlogon UI screen application
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'UiHost'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'UiHost'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.bleepingcomputer.com/forums/t/14028/change-the-loginwelcome-screen/'
---
name: WindowsWinlogonUserinit
doc: Windows Winlogon Userinit replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Userinit'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Userinit'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939862.aspx']
---
name: WindowsWinlogonVMApplet
doc: Windows VMApplet replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'VMApplet'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'VMApplet'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinstart
doc: Windows winstart.bat file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_windir%%\winstart.bat'
      - '%%environ_windir%%\dosstart.bat'
    separator: '\'
supported_os: [Windows]
---
name: WindowsWinlogonAppSetup
doc: Windows Winlogon Appsetup
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'AppSetup'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WinSock2LayeredServiceProviders
doc: Used to filter TCP/IP traffic through WinSock2.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\*']
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://en.wikipedia.org/wiki/Layered_Service_Provider'
---
name: WinSock2NamespaceProviders
doc: WinSock2NamespaceProviders
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters\namespace_catalog5\catalog_entries\*', value: 'LibraryPath'}
supported_os: [Windows]
urls:
- 'https://www.symantec.com/security_response/writeup.jsp?docid=2012-020609-4221-99&tabid=2'
- 'http://www.nirsoft.net/utils/winsock_service_providers.html'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms739923(v=vs.85).aspx'
---
name: WindowsDNSSettings
doc: Windows Registry Keys that contain DNS and DHCP settings.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters', value: 'NameServer'}
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\*', value: 'NameServer'}
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrenControlSet\Services\Dnscache\Parameters', value: 'NameServer'}
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\*', value: 'DhcpNameServer'}
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\*', value: 'DhcpServer'}
labels: [System, Network]
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/dd197418(v=ws.10).aspx']
forensic-artifacts 20170808-1 / usr / share / artifacts / windows.yaml
