# Windows specific artifacts.
---
name: WindowsActionCenterSettings
doc: |
  Windows Action Center Settings

  Malware can modify these keys to disable notifications that occur
  when various security features are disabled. One malware family
  known to modify these keys is Kovter, a well-known trojan.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{e8433b72-5842-4d43-8645-bc2c35960837}.check.*', value: 'CheckSetting'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Action Center\Checks\{e8433b72-5842-4d43-8645-bc2c35960837}.check.*', value: 'CheckSetting'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance', value: 'Enabled'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance', value: 'Enabled'}
supported_os: [Windows]
urls:
- 'https://winaero.com/blog/registry-tweak-to-disable-action-center-notifications-in-windows-7/'
- 'https://blog.talosintelligence.com/2019/05/threat-roundup-0517-0524.html'
- 'https://blogs.technet.microsoft.com/platforms_lync_cloud/2017/05/05/disabling-windows-10-action-center-notifications/'
---
name: WindowsActiveDesktop
doc: Windows Active Desktop settings and components.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Desktop\Components\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Desktop\General'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ActiveDesktop.html']
---
name: WindowsActiveDirectoryDatabaseFile
aliases: [WindowsActiveDirectoryDatabase]
doc: Windows Active Directory database file (ntds.dit).
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\ntds\ntds.dit'
    - '%%environ_systemroot%%\ServicePackFiles\*\ntds.dit*'
    - '%%environ_systemroot%%\SoftwareDistribution\Download\*\*\ntds.dit*'
    - '%%environ_systemroot%%\System32\ntds.dit'
    separator: '\'
supported_os: [Windows]
urls: ['https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc772829(v=ws.10)']
---
name: WindowsActiveSyncAutoStart
doc: Windows ActiveSync AutoStart entries
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows CE Services\AutoStartOnConnect\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows CE Services\AutoStartOnDisconnect\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows CE Services\AutoStartOnConnect\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows CE Services\AutoStartOnDisconnect\*'
supported_os: [Windows]
urls: ['https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2']
---
name: WindowsActivitiesCacheDatabase
doc: SQLite database containing the Windows activities cache.
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\ConnectedDevicesPlatform\L.%%users.username%%\ActivitiesCache.db']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ActivitiesCacheDatabase.html']
---
name: WindowsAlternateShell
doc: Alternate Shell to be run via Userinit.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot', value: 'AlternateShell'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option', value: 'UseAlternateShell'}
supported_os: [Windows]
urls:
- 'https://www.microsoftpressstore.com/articles/article.aspx'
- 'https://technet.microsoft.com/en-us/library/cc976124.aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsAMCacheHveFile
doc: The AMCache file, stored in the Windows NT Registry file format.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\AppCompat\Programs\Amcache.hve'
    - '%%environ_systemroot%%\AppCompat\Programs\Amcache.hve.LOG1'
    - '%%environ_systemroot%%\AppCompat\Programs\Amcache.hve.LOG2'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/AMCache.html']
---
name: WindowsAppCertDLLs
doc: Windows AppCertDLLs persistence.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDLLs']
supported_os: [Windows]
urls: ['http://blogs.technet.com/b/mmpc/archive/2011/03/19/how-to-defang-the-fake-defragmenter.aspx']
---
name: WindowsAppCompatCache
doc: Windows Application Compatibility Cache
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility', value: 'AppCompatCache'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatCache', value: 'AppCompatCache'}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/Application%20Compatibility%20Cache%20key.asciidoc']
---
name: WindowsAppInitDLLs
doc: |
  Windows Application Initial (AppInit) DLLs persistence.

  AppInit DLLs is a mechanism that allows an arbitrary list of DLLs to be loaded
  into each user mode process on the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/dd744762(v=vs.85).aspx'
- 'https://support.microsoft.com/en-us/kb/197571'
---
name: WindowsApplicationRegistration
doc: Windows Application Registration (AppPath) Registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\*'
supported_os: [Windows]
urls:
- 'https://github.com/keydet89/RegRipper2.8/blob/master/plugins/apppaths.pl'
- 'http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ee872121(v=vs.85).aspx'
---
name: WindowsApplicationCompatibilityInstalledShimDatabases
doc: |
  Windows Application Compatibility Installed Shim Databases.

  drvmain.sdb, frxmain.sdb, msimain.sdb, pcamain.sdb, and sysmain.sdb are
  shim database files (SDB files) that are provided by Windows, and contain
  many predefined shims that address known application compatibility issues.
  Note that these database files are not signed.

  Windows also supports custom shim database. These are typically installed
  by the sdbinst.exe utility. Note, that shim database files can also exist
  elsewhere in the file system.

  Windows application shims provide a way for the operating system to
  apply patches to executables before they are run, ultimately providing
  a lightweight mechanism for applying hot fixes and making modifications to
  ensure compatibility across the various versions of Windows. This
  functionality can also be leveraged maliciously to change how certain
  programs operate, or to provide capabilities to malware, such as the
  ability to bypass UAC, gain persistence by injecting loading into legitimate
  processes, or avoid detection by disabling anti-virus software.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_windir%%\AppPatch\drvmain.sdb'
    - '%%environ_windir%%\AppPatch\frxmain.sdb'
    - '%%environ_windir%%\AppPatch\msimain.sdb'
    - '%%environ_windir%%\AppPatch\pcamain.sdb'
    - '%%environ_windir%%\AppPatch\sysmain.sdb'
    - '%%environ_windir%%\AppPatch\AppPatch64\Custom\*'
    - '%%environ_windir%%\AppPatch\Custom\*'
    - '%%environ_windir%%\AppPatch\Custom\Custom64\*'
    - '%%environ_windir%%\AppPatch\CustomSDB\*'
    separator: '\'
supported_os: [Windows]
urls:
- 'https://attack.mitre.org/techniques/T1138/'
- 'https://countercept.com/blog/hunting-for-application-shim-databases/'
- 'http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf'
- 'https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf'
---
name: WindowsApplicationCompatibilityShimDatabaseMappings
doc: |
  Windows Application Compatibility Shim Database Mappings.

  Mappings between the Windows Application Compatibility shim database files and
  the programs that they apply to.

  Windows allows for custom application shims to be installed via the
  sdbinst.exe application. For example a mapping for 'notepad.exe':

  Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\notepad.exe
  Value: {00000000-1111-2222-3333-444444444444}.sdb = 0

  Key: AppCompatFlags\InstalledSDB\{00000000-1111-2222-3333-444444444444}
  Value: DatabasePath = "C:\Windows\AppPatch\Custom\{00000000-1111-2222-3333-444444444444}.sdb"

  Windows application shims provide a way for the operating system to
  apply patches to executables before they are run, ultimately providing
  a lightweight mechanism for applying hot fixes and making modifications to
  ensure compatibility across the various versions of Windows. This
  functionality can also be leveraged maliciously to change how certain
  programs operate, or to provide capabilities to malware, such as the
  ability to bypass UAC, gain persistence by injecting loading into legitimate
  processes, or avoid detection by disabling anti-virus software.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\*', value: 'DatabaseDescription'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\*', value: 'DatabasePath'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\*', value: '*'}
supported_os: [Windows]
urls:
- 'https://attack.mitre.org/techniques/T1138/'
- 'https://countercept.com/blog/hunting-for-application-shim-databases/'
---
name: WindowsApplicationCompatibilityShims
doc: Windows Application Compatibility Shim Database Files and Application Mappings
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'WindowsApplicationCompatibilityInstalledShimDatabases'
    - 'WindowsApplicationCompatibilityShimDatabaseMappings'
supported_os: [Windows]
---
name: WindowsAppXRT
aliases: [WinAppXRT]
doc: WinAppXRT DLL loaded by .Net applications when the APPX_PROCESS environment variable is set.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\system32\WinAppXRT.dll'
    - '%%environ_systemroot%%\WinAppXRT.dll'
    - '%%environ_systemroot%%\System32\Wbem\WinAppXRT.dll'
    - '%%environ_systemroot%%\System32\WindowsPowerShell\v1.0\WinAppXRT.dll'
    separator: '\'
supported_os: [Windows]
urls: ['http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/']
---
name: WindowsAutoexecBat
doc: Windows autoexec.bat file
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemdrive%%\autoexec.bat'
    - '%%environ_windir%%\autoexec.nt'
    separator: '\'
supported_os: [Windows]
---
name: WindowsAutomaticDebugging
doc: Windows automatic debugging (Aedebug)
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug', value: 'Debugger'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/bb204634(v=vs.85).aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsAutomaticDebuggingExclusionList
doc: Windows automatic debugging (Aedebug) exclusion list
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AutoExclusionList\*']
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/bb204634(v=vs.85).aspx']
---
name: WindowsAutorun
doc: Filebased Tests.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemdrive%%\autorun.inf']
    separator: '\'
supported_os: [Windows]
---
name: WindowsAvailableTimeZones
doc: Timezones available on a Windows system.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\*']}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/Time%20zone%20keys.asciidoc']
---
name: WindowsBackgroundActivityModeratorKeys
doc: Windows Background Activity Moderator (BAM) and Desktop Activity Moderator (DAM) registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\bam\UserSettings\*'
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\bam\State\UserSettings\*'
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\dam\UserSettings\*'
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\dam\State\UserSettings\*'
supported_os: [Windows]
urls:
- 'https://dfir.ru/2020/04/08/bam-internals/'
- 'https://notes.qazeer.io/dfir/windows/_artefacts_overview'
---
name: WindowsBITSQueueManagerDatabases
doc: Databases that contain the Windows BITS jobs definition and state.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_allusersprofile%%\Microsoft\Network\Downloader\qmgr*.dat'
    - '%%environ_allusersprofile%%\Microsoft\Network\Downloader\qmgr.db'
    separator: '\'
supported_os: [Windows]
urls: ['http://dfrws.org/2015/proceedings/presentations/DFRWS2015-pres3.pdf']
---
name: WindowsBootConfigurationDataRegistryFiles
doc: Boot Configuration Data (BCD) Windows Registry files.
sources:
- type: FILE
  attributes:
    paths:
    - '\Boot\BCD'
    - '\Boot\BCD.LOG'
    - '\Boot\BCD.LOG1'
    - '\Boot\BCD.LOG2'
    - '\EFI\Microsoft\Boot\BCD'
    - '\EFI\Microsoft\Boot\BCD.LOG'
    - '\EFI\Microsoft\Boot\BCD.LOG1'
    - '\EFI\Microsoft\Boot\BCD.LOG2'
    - '\EFI\Microsoft\Recovery\BCD'
    - '\EFI\Microsoft\Recovery\BCD.LOG'
    - '\EFI\Microsoft\Recovery\BCD.LOG1'
    - '\EFI\Microsoft\Recovery\BCD.LOG2'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsBootVerificationProgram
doc: Path to custom startup verification program.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\BootVerificationProgram', value: 'ImagePath'}]
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/cc786702(WS.10).aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsBootConfigurationSettings
doc: Windows Boot Configuration Settings
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\BCD00000000\Objects\*\Elements\16000009', value: 'Element'}
    - {key: 'HKEY_LOCAL_MACHINE\BCD00000000\Objects\*\Elements\250000e0', value: 'Element'}
supported_os: [Windows]
urls: ['https://forensics.wiki/windows_boot_configuration_data']
---
name: WindowsCIMRepositoryFiles
doc: |
  Windows Common Information Model (CIM) repository.

  Persistent database that holds the schema, also called the object repository or class store,
  that models the managed environment and defines every piece of data exposed by WMI.

  This definition does not specify the copies of the CIM repository that are stored in system restore points.
sources:
- type: FILE
  attributes:
    paths:
    # Windows 95 OSR 2.5, 98, Millennium Edition (Me)
    - '%%environ_windir%%\System\Wbem\Repository\cim.rep'
    # Windows NT4 and 2000
    - '%%environ_systemroot%%\System32\wbem\Repository\CIM.REC'
    - '%%environ_systemroot%%\System32\wbem\Repository\CIM.REP'
    # Windows Vista and later
    - '%%environ_systemroot%%\System32\wbem\Repository\INDEX.BTR'
    - '%%environ_systemroot%%\System32\wbem\Repository\INDEX.MAP'
    - '%%environ_systemroot%%\System32\wbem\Repository\MAPPING.VER'
    - '%%environ_systemroot%%\System32\wbem\Repository\MAPPING[1-3].MAP'
    - '%%environ_systemroot%%\System32\wbem\Repository\OBJECTS.DATA'
    - '%%environ_systemroot%%\System32\wbem\Repository\OBJECTS.MAP'
    # Windows XP and Windows 2003
    - '%%environ_systemroot%%\System32\wbem\Repository\FS\INDEX.BTR'
    - '%%environ_systemroot%%\System32\wbem\Repository\FS\INDEX.MAP'
    - '%%environ_systemroot%%\System32\wbem\Repository\FS\MAPPING.VER'
    - '%%environ_systemroot%%\System32\wbem\Repository\FS\MAPPING[1-2].MAP'
    - '%%environ_systemroot%%\System32\wbem\Repository\FS\OBJECTS.DATA'
    - '%%environ_systemroot%%\System32\wbem\Repository\FS\OBJECTS.MAP'
    # Copies from the system rebuild process - Windows Vista and later
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\INDEX.BTR'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\INDEX.MAP'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\MAPPING.VER'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\MAPPING[1-3].MAP'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\OBJECTS.DATA'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\OBJECTS.MAP'
    # Copies from the system rebuild process - Windows XP and Windows 2003
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\FS\INDEX.BTR'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\FS\INDEX.MAP'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\FS\MAPPING.VER'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\FS\MAPPING[1-2].MAP'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\FS\OBJECTS.DATA'
    - '%%environ_systemroot%%\System32\wbem\Repository.00[1-9]\FS\OBJECTS.MAP'
    separator: '\'
supported_os: [Windows]
urls:
- 'https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc'
- 'https://forensics.wiki/wmi'
---
name: WindowsCodePage
aliases: [WinCodePage]
doc: The system code page.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodePage', value: 'ACP'}
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Codepage.html']
---
name: WindowsComputerName
doc: The name of the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\ComputerName', value: 'ComputerName'}
supported_os: [Windows]
---
name: WindowsCommandProcessorAutoRun
doc: Commands that are run each time the Command Processor (Cmd.exe) is started.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor', value: 'AutoRun'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Command Processor', value: 'AutoRun'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Command Processor', value: 'AutoRun'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Command Processor', value: 'AutoRun'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/cc779439(v=ws.10).aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://blogs.msdn.com/b/oldnewthing/archive/2007/11/21/6447771.aspx'
- 'https://technet.microsoft.com/en-us/library/cc756720(v=ws.10).aspx'
---
name: WindowsCOMInprocHandlers
doc: Windows COM in-process handlers
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*', value: 'InprocHandler'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*', value: 'InprocHandler32'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*', value: 'InprocHandler'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*', value: 'InprocHandler32'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*', value: 'InprocHandler'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*', value: 'InprocHandler32'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*', value: 'InprocHandler'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*', value: 'InprocHandler32'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms694515(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms691354(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms693485(v=vs.85).aspx'
---
name: WindowsCOMInprocServers
doc: Windows COM in-process servers
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\InprocServer', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\InprocServer32', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\InprocServer', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\InprocServer32', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\InprocServer', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\InprocServer32', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\InprocServer', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\InprocServer32', value: ''}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms694515(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms682390(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms694328(v=vs.85).aspx'
---
name: WindowsCOMLocalServers
doc: Windows COM local servers
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*', value: 'LocalServer'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\LocalServer32', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\LocalServer32', value: 'ServerExecutable'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*', value: 'LocalServer'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\LocalServer32', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\LocalServer32', value: 'ServerExecutable'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*', value: 'LocalServer'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\LocalServer32', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\LocalServer32', value: 'ServerExecutable'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*', value: 'LocalServer'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\LocalServer32', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\LocalServer32', value: 'ServerExecutable'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms694515(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms686595(v=vs.85).aspx'
---
name: WindowsCommonFilePlacementAttacks
doc: Common files associated with search order hijacking and other file placement attacks.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_programfiles%%\Internet Explorer\sxs.dll'
    - '%%environ_programfilesx86%%\Internet Explorer\sxs.dll'
    - '%%environ_systemdrive%%\explorer.exe'
    - '%%environ_systemdrive%%\program.exe'
    - '%%environ_systemroot%%\linkinfo.dll'
    - '%%environ_systemroot%%\ntshrui.dll'
    - '%%environ_systemroot%%\System32\oci.dll'
    - '%%environ_systemroot%%\System32\sysprep\cryptbase.dll'
    - '%%environ_systemroot%%\SysWOW64\oci.dll'
    - '%%environ_systemroot%%\SysWOW64\sysprep\cryptbase.dll'
    separator: '\'
supported_os: [Windows]
urls:
- 'http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf'
- 'https://www.mandiant.com/blog/fxsst/'
---
name: WindowsCOMProperties
doc: |
  Various properties of Windows COM Objects.

  These artifacts are meant to highlight properties of COM objects that,
  although legitimate, are known to be associated with persistence techniques
  or other capabilities that malware can leverage.

  ShellFolder\HideOnDesktop, ShellFolder\Attributes (specifically with value
  0xf090013d), and InprocServer\LoadWithoutCOM are associated with a technique
  to cause iexplore or explorer to load a malicious DLL by registering a COM
  object and invoking it through the use of Junction Folders.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\ShellFolder', value: 'Attributes'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\ShellFolder', value: 'Attributes'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\ShellFolder', value: 'Attributes'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\ShellFolder', value: 'Attributes'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\ShellFolder', value: 'HideOnDesktop'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\ShellFolder', value: 'HideOnDesktop'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\ShellFolder', value: 'HideOnDesktop'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\ShellFolder', value: 'HideOnDesktop'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\InprocServer32', value: 'LoadWithoutCOM'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\CLSID\*\InprocServer32', value: 'LoadWithoutCOM'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\InprocServer32', value: 'LoadWithoutCOM'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\CLSID\*\InprocServer32', value: 'LoadWithoutCOM'}
supported_os: [Windows]
urls:
- 'https://ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse'
- 'https://labs.nettitude.com/blog/com-and-the-powerthief/'
---
name: WindowsCOMRegisteredTypeLibraries
doc: Windows COM registered type libraries
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Typelib\*\*\*\*', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Typelib\*\*\*\*', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Typelib\*\*\*\*', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Typelib\*\*\*\*', value: ''}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/Component%20Object%20Model%20keys.asciidoc#type-libraries-key']
---
name: WindowsConfigSys
doc: Windows config.sys file
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemdrive%%\config.sys'
    - '%%environ_windir%%\config.nt'
    separator: '\'
supported_os: [Windows]
---
name: WindowsControlPanelFilePaths
doc: DLLs listed here will be run when the user opens the Windows Control Panel.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Control Panel\CPLs'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Control Panel\CPLs'
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127454(v=vs.85).aspx'
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms683844(v=vs.85).aspx'
---
name: WindowsCortanaDatabase
doc: Windows Cortana database
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Packages\Microsoft.Windows.Cortana_*\AppData\Indexed DB\IndexedDB.edb'
    - '%%users.localappdata%%\Packages\Microsoft.Windows.Cortana_*\LocalState\ESEDatabase_CortanaCoreInstance\CortanaCoreDb.dat'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/cortana']
---
name: WindowsCrashDumps
doc: |
  Windows Error Reporting (WER) files and crash dumps.

  The files include information about the crashed processes and potentially
  process dumps, whether auto-generated upon a crash or by a user. It's helpful
  to analyze them to identify unexpected process executions or exploitation
  attempts.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_allusersprofile%%\Microsoft\Windows\WER\**'
    - '%%environ_systemroot%%\*.dmp'
    - '%%environ_systemroot%%\Minidump\*.dmp'
    - '%%environ_systemroot%%\ServiceProfiles\AppData\Local\CrashDumps\**'
    - '%%environ_systemroot%%\ServiceProfiles\AppData\Local\Temp\*.dmp'
    - '%%environ_systemroot%%\System32\config\systemprofile\AppData\Local\CrashDumps\**'
    - '%%environ_systemroot%%\System32\config\systemprofile\AppData\Local\Temp\*.dmp'
    - '%%environ_systemroot%%\Temp\*.dmp'
    - '%%users.localappdata%%\CrashDumps\**'
    - '%%users.localappdata%%\Microsoft\Windows\WER\**'
    - '%%users.localappdata%%\Temp\*.dmp'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#crash-and-minidumps']
---
name: WindowsCredentialProviderFilters
doc: Windows Credential Provider Filters
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\*'
supported_os: [Windows]
urls: ['http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/']
---
name: WindowsCredentialProviders
doc: CLSIDs of applications to use as Credential Providers
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://blogs.technet.com/b/ad/archive/2009/05/26/thoughts-on-single-sign-on-and-credential-providers.aspx'
- 'http://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/'
- 'https://www.sophos.com/en-us/support/knowledgebase/114190.aspx'
---
name: WindowsCryptnetUrlCacheMetadata
doc: |
  Metadata of a Windows cache of files downloaded from the internet.

  Helpful when investigating the use of "Living of the Land" tools that allow
  attackers to download arbitrary files from the internet, such as
  "certutil.exe".
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*'
    - '%%environ_systemroot%%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*'
    - '%%users.userprofile%%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#cryptnet-url-cache']
---
name: WindowsCryptnetUrlCacheContent
doc: |
  Content of a Windows cache of files downloaded from the internet.

  Helpful when investigating the use of "Living of the Land" tools that allow
  attackers to download arbitrary files from the internet, such as
  "certutil.exe".
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*'
    - '%%environ_systemroot%%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*'
    - '%%users.userprofile%%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#cryptnet-url-cache']
---
name: WindowsCurrentVersion
doc: The Windows current version
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'CurrentVersion'}]}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/System%20keys.asciidoc']
---
name: WindowsDebugger
doc: Windows Debugger peristence or AV disable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/a329t4ed%28VS.71%29.aspx']
---
name: WindowsDNSSettings
doc: Windows Registry Keys that contain DNS and DHCP settings.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters', value: 'NameServer'}
    - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\*', value: 'NameServer'}
    - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters', value: 'NameServer'}
    - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\*', value: 'DhcpNameServer'}
    - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\*', value: 'DhcpServer'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/dd197418(v=ws.10).aspx']
---
name: WindowsDomainCachedCredentials
doc: Windows domain cached credentials
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Security\Cache', value: 'NL$*'}]
supported_os: [Windows]
urls: ['http://juggernaut.wikidot.com/cached-credentials']
---
name: WindowsDomainName
doc: The domain the system is connected to.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters', value: 'Domain'}
supported_os: [Windows]
---
name: WindowsDisallowedSystemCertificates
doc: |
  Windows Disallowed System Certificates

  Malware can add code-signing certificates associated with
  antivirus programs to the disallowed list to prevent the
  AV programs from running.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Disallowed\Certificates\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\Disallowed\Certificates\*'
supported_os: [Windows]
urls:
- 'https://blog.malwarebytes.com/detections/pum-optional-misplacedcertificate/'
---
name: WindowsEnvironmentUserLoginScripts
doc: User login scripts configured via Windows environment variables.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitLogonServer'}
    - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitLogonScript'}
    - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitMprLogonScript'}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/'
- 'https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/cb6f1d6f-60a6-4369-803e-ec03d902e638/gina-how-to-run-domain-scripts-after-logon'
---
name: WindowsEnvironmentVariableAllUsersProfile
doc: The system-wide %AllUsersProfile% environment variable contains the path of the of the "All Users" or "Common" profile directory.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'AllUsersProfile'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableAppxProcess
doc: |
  The user-specific %APPX_PROCESS% environment variable is used for .NET applications.

  If set, a .NET applications will attempt to load WinAppXRT.dll from %PATH%, which can be used as a persistence mechanism by malware.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'APPX_PROCESS'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableCommonProgramFiles
doc: The %COMMONPROGRAMFILES% environment variable contains the path of the common program files folder.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion', value: 'CommonFilesDir'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableCommonProgramFilesX86
doc: The %COMMONPROGRAMFILES(X86)% environment variable contains the path of the 32-bit common program files folder on a 64-bit Windows installation.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion', value: 'CommonFilesDir (x86)'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableComSpec
doc: The %ComSpec% environment variable contains the path of the command processor, typically "cmd.exe".
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment', value: 'ComSpec'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableDriverData
doc: The %DriverData% environment variable contains the path of the directory used for temporary state files of user-mode drivers.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment', value: 'DriverData'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariablePath
aliases: [WinPathEnvironmentVariable]
doc: The %PATH% environment variable contains an ordered list of paths of directories that will be searched on execution request without a specific path.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment', value: 'Path'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableProfilesDirectory
doc: The %ProfilesDirectory% environment variable contain a path of a directory that contains the users' profile directories, typically "%SystemDrive%\Users".
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'ProfilesDirectory'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableProgramData
doc: The %ProgramData% environment variable contains a path of the "Program Data" directory.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList', value: 'ProgramData'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableProgramFiles
aliases: [ProgramFiles]
doc: The %ProgramFiles% environment variable contains a path of the "Program Files" directory.
sources:
- type: PATH
  attributes:
    paths: ['\Program Files']
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion', value: 'ProgramFilesDir'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableProgramFilesX86
aliases: [ProgramFilesx86]
doc: The %ProgramFiles(x86)% environment variable contains a path of the 32-bit "Program Files" directory on a 64-bit Windows installation.
sources:
- type: PATH
  attributes:
    paths: ['\Program Files (x86)']
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion', value: 'ProgramFilesDir (x86)'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableSystemDrive
doc: |
  The %SystemDrive% environment variable contains the letter of the drive in which the system directory is located, typically "C:".

  This value is not present in the Windows Registry but can be derived from %SystemRoot%.
sources:
- type: ARTIFACT_GROUP
  attributes: {names: ['WindowsEnvironmentVariableSystemRoot']}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableSystemRoot
aliases: [SystemRoot]
doc: The %SystemRoot%, environment variable contains the path of the system directory, typically "C:\Windows".
sources:
- type: PATH
  attributes:
    paths:
    - '\Windows'
    - '\WinNT'
    - '\WINNT35'
    - '\WTSRV'
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'SystemRoot'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableTemp
aliases: [TempEnvironmentVariable]
doc: The %TEMP% environment variable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment', value: 'TEMP'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEnvironmentVariableWinDir
aliases: [WinDirEnvironmentVariable]
doc: The %WinDir%, environment variable contains the path of the Windows directory, typically "C:\Windows".
sources:
- type: PATH
  attributes:
    paths:
    - '\Windows'
    - '\WinNT'
    - '\WINNT35'
    - '\WTSRV'
    separator: '\'
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment', value: 'windir'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EnvironmentVariables.html']
---
name: WindowsEventLogApplication
doc: Application Windows Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\config\AppEvent.evt']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsEventLogPublishers
doc: Windows EventLog publishers (or providers) Registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\*']
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/EventLog-keys.html']
---
name: WindowsEventLogs
doc: Windows Event logs.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\config\*.evt'
    - '%%environ_systemroot%%\System32\winevt\Logs\*.evtx'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsEventLogSecurity
doc: Security Windows Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\config\SecEvent.evt']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsEventLogSources
aliases: [WindowsEventLogProviders]
doc: Windows EventLog sources Registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\*\*']
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/EventLog-keys.html']
---
name: WindowsEventLogSystem
doc: System Windows Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\config\SysEvent.evt']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsEventTracingLogFiles
doc: Event Tracing for Windows (ETW) log files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_allusersappdata%%\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\*.etl'
    - '%%environ_allusersappdata%%\Microsoft\DiagnosticLogCSP\Collectors\*.etl'
    - '%%environ_allusersappdata%%\Microsoft\Windows\wfp\*.etl'
    - '%%environ_allusersappdata%%\Microsoft\Windows Security Health\Logs\*.etl'
    - '%%environ_allusersappdata%%\USOShared\Logs\System\*.etl'
    - '%%users.localappdata%%\Microsoft\OneDrive\logs\Personal\*.etl'
    - '%%users.localappdata%%\Microsoft\Windows\Explorer\*.etl'
    - '%%users.localappdata%%\Packages\Microsoft.Windows.Photos_*\LocalState\*.etl'
    - '%%environ_systemroot%%\Logs\*\*.etl'
    - '%%environ_systemroot%%\Panther\*.etl'
    - '%%environ_systemroot%%\Security\Logs\*.etl'
    - '%%environ_systemroot%%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\*.etl'
    - '%%environ_systemroot%%\System32\LogFiles\WMI\*.etl'
    - '%%environ_systemroot%%\System32\LogFiles\WMI\*.etl.0*'
    - '%%environ_systemroot%%\System32\LogFiles\WMI\RtBackup\*.etl'
    - '%%environ_systemroot%%\System32\SleepStudy\*.etl'
    - '%%environ_systemroot%%\System32\SleepStudy\ScreenOn\*.etl'
    - '%%environ_systemroot%%\System32\WDI\LogFiles\*.etl'
    - '%%environ_systemroot%%\System32\WDI\LogFiles\*.etl.0*'
    - '%%environ_systemroot%%\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\*\*.etl'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/event_tracing_for_windows_(etw)']
---
name: WindowsExcludeFromKnownDLLs
doc: ExcludeFromKnownDLLs can be used to bypass search order hijacking protection.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'ExcludeFromKnownDLLs'}]
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586%28v=vs.85%29.aspx']
---
name: WindowsExplorerAppKey
doc: Handlers for special keys on some keyboards (file path or CLSID).
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AppKey\*', value: 'ShellExecute'}
supported_os: [Windows]
urls:
- 'http://answers.microsoft.com/en-us/windows/forum/windows_vista-hardware/assigning-the-special-keys-at-the-top-of-the/d1ab2e13-5297-457d-a8e8-bc2c883d8b58?db=5'
- 'http://h30434.www3.hp.com/t5/Notebook-Hardware/How-do-I-customize-the-Action-Keys/td-p/379207'
---
name: WindowsExplorerAutoplayHandlers
doc: Handlers for autoplay events in Windows Explorer.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\*']
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa468474.aspx'
---
name: WindowsExplorerContextMenuHandlers
doc: Handlers for subcommands on context menu
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\*', value: 'CommandStateHandler'}
    - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\*', value: 'ExplorerCommandHandler'}
    - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\*', value: 'command'}
    - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\*\command', value: 'DelegateExecute'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127467(v=vs.85).aspx'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/cc144171(v=vs.85).aspx'
- 'http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commandstore-shell-windows-closewindow'
- 'http://www.checkfilename.com/view-details/Windows-7-Ultimate/RespageIndex/4/sTab/2/'
---
name: WindowsExplorerNamespaceCommonPlaces
doc: CLSIDs listed here are used to populate the Common Places items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace\DelegateFolders'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommonPlaces\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\CommonPlaces\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\CommonPlaces\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\CommonPlaces\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\CommonPlaces\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx'
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/commonplacesfolder.htm'
- 'http://www.windowrdb.com/w.php?w=hklm-software-microsoft-windows-currentversion-explorer-commonplaces'
---
name: WindowsExplorerNamespaceControlPanel
doc: CLSIDs listed here are used to populate the Control Panel items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanel\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanel\NameSpace\DelegateFolders'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanelWOW64\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanelWOW64\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpaceWOW64\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanelWOW64\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanelWOW64\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanelWOW64\NameSpace\DelegateFolders'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanel\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanel\NameSpace\DelegateFolders'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanelWOW64\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Wow6432Node\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\ControlPanelWOW64\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127450(v=vs.85).aspx'
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/controlpanel.htm'
---
name: WindowsExplorerNamespaceDesktop
doc: CLSIDs listed here are used to populate the Desktop items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\Desktop\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\Desktop\NameSpace\DelegateFolders'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Wow6432Node\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\Desktop\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\Desktop\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'https://social.technet.microsoft.com/Forums/windowsserver/en-US/2760309c-89d1-414c-a04c-ce4178e90787/hide-libraries-icon-from-desktop'
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm'
- 'http://www.geoffchappell.com/notes/windows/shell/controlpanel/desktopicons.htm'
- 'https://support.microsoft.com/en-us/kb/321777'
---
name: WindowsExplorerNamespaceMyComputer
doc: CLSIDs listed here are used to populate the MyComputer items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\MyComputer\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\MyComputer\NameSpace\DelegateFolders'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Wow6432Node\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\MyComputer\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\MyComputer\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/mycomputer.htm'
- 'http://www.howtogeek.com/168081/how-to-remove-the-folders-from-my-computer-in-windows-8.1/'
- 'http://answers.microsoft.com/en-us/windows/forum/windows8_1-files/how-to-remove-these-folders-from-windows-81/777c4ba3-7853-453e-bfa0-9a0f4245b9e1?db=5'
---
name: WindowsExplorerNamespaceNetworkNeighborhood
doc: CLSIDs listed here are used to populate the Network Neighborhood items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\NetworkNeighborhood\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\NetworkNeighborhood\NameSpace\DelegateFolders'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\NetworkNeighborhood\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\NetworkNeighborhood\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/regfolder.htm'
- 'http://www.lavasoft.com/mylavasoft/rogues/secretservice'
- 'http://www.wikihow.com/Manually-Remove-Macatte-Malware'
---
name: WindowsExplorerNamespacePrintersAndFaxes
doc: CLSIDs listed here are used to populate the Printer and Fax items.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\PrintersAndFaxes\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\PrintersAndFaxes\NameSpace\DelegateFolders'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\PrintersAndFaxes\NameSpace\DelegateFolders'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\PrintersAndFaxes\NameSpace'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\*\PrintersAndFaxes\NameSpace\DelegateFolders'
supported_os: [Windows]
urls:
- 'http://www.geoffchappell.com/studies/windows/shell/shell32/classes/printers.htm'
---
name: WindowsExplorerSettings
doc: |
  Windows Explorer Settings

  Malware can modify these keys to make it more difficult for the
  user to detect and remove malicious software.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'Hidden'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'Hidden'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'Hidden'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'Hidden'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'HideFileExt'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'HideFileExt'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'HideFileExt'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'HideFileExt'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'ShowSuperHidden'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'ShowSuperHidden'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'ShowSuperHidden'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'ShowSuperHidden'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'HideSCAHealth'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'HideSCAHealth'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'HideSCAHealth'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'HideSCAHealth'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoControlPanel'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoControlPanel'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoControlPanel'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoControlPanel'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoFolderOptions'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoFolderOptions'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoFolderOptions'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoFolderOptions'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoRun'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoRun'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoRun'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoRun'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoViewContextMenu'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoViewContextMenu'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoViewContextMenu'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'NoViewContextMenu'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'ShowControlPanel'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'ShowControlPanel'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'ShowControlPanel'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced', value: 'ShowControlPanel'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'TaskbarNoNotification'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'TaskbarNoNotification'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'TaskbarNoNotification'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer', value: 'TaskbarNoNotification'}
supported_os: [Windows]
urls:
- 'https://www.sdkhere.com/2016/02/analysis-of-malware-using-wmi-query.html'
- 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_mandrom.e'
- 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_deleter.ah'
- 'https://blog.malwarebytes.com/detections/pum-optional-disabledrightclick/'
- 'https://blog.malwarebytes.com/detections/pum-optional-disableshowcontrolpanel/'
---
name: WindowsFileTypeAutorunAssociations
doc: |
  Registry value for what application class identifier (CLSID) to launch for a file extension.

  Extension subkeys start with a dot. The '(Default)' value will be a ProgID,
  which points to another entry in HKCR specifying the command to run to open
  a file of the given type. The WindowsShellOpenCommand artifact is associated
  with these ProgID command invocations.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\.*', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\.*', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\.*', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\.*', value: ''}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms678415(v=vs.85).aspx'
- 'https://docs.microsoft.com/en-us/windows/desktop/shell/fa-file-types'
---
name: WindowsFirewallLogFile
doc: Windows Firewall default logfile
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\logfiles\firewall\pfirewall.log']
    separator: '\'
supported_os: [Windows]
urls: ['https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/configure-the-windows-firewall-log']
---
name: WindowsFirewallEnabledRules
doc: Command to list the enabled Windows Firewall rules.
sources:
- type: COMMAND
  attributes:
    args: ["advfirewall", "monitor", "show", "firewall", "rule", "name=all"]
    cmd: netsh.exe
supported_os: [Windows]
---
name: WindowsFirewallRules
doc: Command to list the configured Windows Firewall rules.
sources:
- type: COMMAND
  attributes:
    args: ["advfirewall", "firewall", "show", "rule", "name=all"]
    cmd: netsh.exe
supported_os: [Windows]
---
name: WindowsGroupPolicyScripts
doc: Windows group policy scripts
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\GroupPolicy\User\Scripts\psscripts.ini'
    - '%%environ_systemroot%%\System32\GroupPolicy\User\Scripts\scripts.ini'
    - '%%environ_systemroot%%\System32\GroupPolicy\User\Scripts\Logoff\*'
    - '%%environ_systemroot%%\System32\GroupPolicy\User\Scripts\Logon\*'
    - '%%environ_systemroot%%\System32\GroupPolicy\Machine\Scripts\psscripts.ini'
    - '%%environ_systemroot%%\System32\GroupPolicy\Machine\Scripts\scripts.ini'
    - '%%environ_systemroot%%\System32\GroupPolicy\Machine\Scripts\Shutdown\*'
    - '%%environ_systemroot%%\System32\GroupPolicy\Machine\Scripts\Startup\*'
    separator: '\'
supported_os: [Windows]
---
name: WindowsFirewallAuthorizedApplications
doc: |
  Windows Firewall Authorized Applications

  Malware can add paths to this list to more easily communicate
  over the network on an infected machine. For instance, Emotet
  modifies some these settings after gaining execution.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    # Windows XP and 2003
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List\*'
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications\List\*'
    # Windows Vista and later
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\*'
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications\List\*'
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\*'
supported_os: [Windows]
urls:
- 'https://threatvector.cylance.com/en_us/home/threat-spotlight-eyepyramid-malware.html'
- 'https://blog.talosintelligence.com/2019/05/threat-roundup-0524-0531.html'
---
name: WindowsFirewallGloballyOpenPorts
doc: |
  Windows Firewall Globally Open Ports

  Malware can add to the list of open ports to avoid
  having to create Windows Firewall exceptions tied
  to specific applications.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    # Windows XP and 2003
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List\*'
    - 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts\List\*'
    # Windows Vista and later
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\*'
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts\List\*'
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\*'
supported_os: [Windows]
urls:
- 'https://qaforce.wordpress.com/2009/10/06/windows-firewall-registry-keys/'
- 'https://github.com/steeve85/Malwares/wiki/Registry'
---
name: WindowsFirewallPolicySettings
doc: |
  Windows Firewall Policy Settings

  Malware can modify these settings to more easily communicate
  over the network on an infected machine. For instance, Emotet
  modifies some these settings after gaining execution.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile', value: 'EnableFirewall'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile', value: 'DisableNotifications'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile', value: 'DoNotAllowExceptions'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile', value: 'DefaultInboundAction'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile', value: 'DefaultOutboundAction'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile', value: 'EnableFirewall'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile', value: 'DisableNotifications'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile', value: 'DoNotAllowExceptions'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile', value: 'DefaultInboundAction'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile', value: 'DefaultOutboundAction'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile', value: 'EnableFirewall'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile', value: 'DisableNotifications'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile', value: 'DoNotAllowExceptions'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile', value: 'DefaultInboundAction'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile', value: 'DefaultOutboundAction'}
supported_os: [Windows]
urls:
- 'https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/networking-mpssvc-svc-privateprofile-enablefirewall'
- 'https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/networking-mpssvc-svc-privateprofile-disablenotifications'
- 'https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html'
---
name: WindowsFontDrivers
doc: Windows font drivers from the Registry.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Font Drivers\*'
supported_os: [Windows]
urls:
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
---
name: WindowsHelpCenterDatabaseFile
doc: Windows Help Center database file (HCdata.edb).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\PCHEALTH\HELPCTR\Database\HCdata.edb']
    separator: '\'
supported_os: [Windows]
---
name: WindowsHostsFiles
doc: The Windows hosts and lmhosts file.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\Drivers\etc\Lmhosts'
    - '%%environ_systemroot%%\System32\Drivers\etc\hosts'
    separator: '\'
supported_os: [Windows]
---
name: WindowsHotkeyReplacement
doc: Hotkey executable replacement.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\magnifier.exe'
    - '%%environ_systemroot%%\System32\sethc.exe'
    - '%%environ_systemroot%%\System32\utilman.exe'
    separator: '\'
supported_os: [Windows]
---
name: WindowsInstallationDateTime
doc: Windows installation date and time
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'InstallDate'}
supported_os: [Windows]
---
name: WindowsLanguage
doc: The system language.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language', value: 'Default'}
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Language.html']
---
name: WindowsLogoffScript
doc: Windows policy logoff script
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Logoff'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Logoff'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/ff404236.aspx']
---
name: WindowsLogonScript
doc: Windows policy logon script
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Logon'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Logon'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/ff404236.aspx']
---
name: WindowsLSAAuthenticationPackages
doc: Authentication Packages can be injected into LSASS.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa', value: 'Authentication Packages'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig', value: 'Authentication Packages'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://technet.microsoft.com/en-us/library/cc963218.aspx'
---
name: WindowsLSANotificationPackages
doc: Notification Packages can be injected into LSASS.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa', value: 'Notification Packages'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig', value: 'Notification Packages'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://technet.microsoft.com/en-us/library/cc963221.aspx'
---
name: WindowsLSASecurityPackages
doc: Security Packages can be injected into LSASS.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa', value: 'Security Packages'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\OSConfig', value: 'Security Packages'}
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa379392(v=vs.85).aspx'
- 'https://dl.mandiant.com/EE/library/MIRcon2014/MIRcon_2014_IR_Track_Analysis_of_Malicious_SSP.pdf'
---
name: WindowsMapNetworkDriveMRU
doc: Recently mapped network shares.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU']
supported_os: [Windows]
---
name: WindowsMetroApplicationCache
doc: Windows Metro application cache.
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Packages\*\AC\INetCache']
    separator: '\'
supported_os: [Windows]
urls: ['http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look']
---
name: WindowsMetroApplicationCookies
doc: Windows Metro application cookies.
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Packages\*\AC\INetCookies']
    separator: '\'
supported_os: [Windows]
urls: ['http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look']
---
name: WindowsMetroApplicationHistory
doc: Windows Metro application history.
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Packages\*\AC\INetHistory']
    separator: '\'
supported_os: [Windows]
urls: ['http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look']
---
name: WindowsMetroUserPinnedFavoriteTiles
doc: Windows Metro user-pinned favorite tiles.
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Microsoft\Windows\RoamingTiles']
    separator: '\'
supported_os: [Windows]
urls: ['http://www.forensicmag.com/article/2012/09/microsoft-windows-8-forensic-first-look']
---
name: WindowsMostRecentApplication
doc: Windows Most Recent Application name key
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\*\MostRecentApplication', value: 'Name'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\*\MostRecentApplication', value: 'Name'}
supported_os: [Windows]
urls:
- 'http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_ransom.smc7'
- 'https://www.symantec.com/security_response/writeup.jsp?docid=2014-092314-3644-99&tabid=2'
---
name: WindowsMountedDevices
doc: Windows mounted devices
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_LOCAL_MACHINE\System\MountedDevices']}
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Mounted-devices.html']
---
name: WindowsMSDTCDLLs
doc: Windows MSDTC attempts to load these DLLs on start
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\MSDTC\MTxOCI\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\MSDTC\MTxOCI\*'
supported_os: [Windows]
urls: ['https://www.mandiant.com/blog/hikit-rootkit-advanced-persistent-attack-techniques-part-1-2/']
---
name: WindowsMultiMediaDrivers
doc: Configured drivers for different multimedia filetypes.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\*'
    - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\*'
    - 'HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\*'
    - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://support.microsoft.com/en-us/kb/126054'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
---
name: WindowsNetworkShellHelpers
doc: Windows Network Shell (netsh) helpers are loaded on boot
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Netsh'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Netsh'
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/242468']
---
name: WindowsOpenSaveMRU
doc: Information about files opened or saved in a Windows shell dialog.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDIg32\OpenSaveMRU\*\*']
supported_os: [Windows]
urls: ['https://forensics.wiki/opensavemru']
---
name: WindowsOpenSavePidlMRU
doc: Information about files opened or saved in a Windows shell dialog.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\*']
supported_os: [Windows]
urls: ['https://forensics.wiki/opensavepidlmru']
---
name: WindowsPendingFileRenames
doc: Windows Pending file renames on reboot
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'PendingFileRenameOperations'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc960241.aspx']
---
name: WindowsPendingGPOs
doc: |
  Windows Pending GPOs registry settings.

  This is a persistence mechanism known to be used by the Gootkit malware family.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\IEAK\GroupPolicy\PendingGPOs', value: 'Path1'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\IEAK\GroupPolicy\PendingGPOs', value: 'Path1'}
supported_os: [Windows]
urls: ['https://www.certego.net/en/news/malware-tales-gootkit/']
---
name: WindowsPersistenceMechanisms
doc: Persistence mechanisms in Windows.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - WindowsPersistenceRegistryKeys
    - WindowsPowerShellDefaultProfiles
    - WindowsServices
supported_os: [Windows]
---
name: WindowsPersistenceRegistryKeys
doc: Windows Registry keys used for persistence.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - InternetExplorerBrowserHelperObjects
    - WindowsActiveDesktop
    - WindowsActiveSyncAutoStart
    - WindowsAlternateShell
    - WindowsAppCertDLLs
    - WindowsAppInitDLLs
    - WindowsBootVerificationProgram
    - WindowsCommandProcessorAutoRun
    - WindowsCredentialProviderFilters
    - WindowsCredentialProviders
    - WindowsDebugger
    - WindowsEnvironmentUserLoginScripts
    - WindowsExplorerAutoplayHandlers
    - WindowsFileTypeAutorunAssociations
    - WindowsFontDrivers
    - WindowsIconServiceLib
    - WindowsLSAAuthenticationPackages
    - WindowsLSANotificationPackages
    - WindowsLSASecurityPackages
    - WindowsMSDTCDLLs
    - WindowsMultiMediaDrivers
    - WindowsNetworkShellHelpers
    - WindowsPendingGPOs
    - WindowsPLAPProviders
    - WindowsPrintMonitors
    - WindowsRunGrpConv
    - WindowsRunKeys
    - WindowsRunServices
    - WindowsScreenSaverExecutable
    - WindowsSearchFilterHandlers
    - WindowsSecurityProviders
    - WindowsServiceControlManagerExtension
    - WindowsSessionManagerBootExecute
    - WindowsSessionManagerExecute
    - WindowsSessionManagerS0InitialCommand
    - WindowsSessionManagerSetupExecute
    - WindowsSessionManagerSubSystems
    - WindowsSessionManagerWOWCommandLine
    - WindowsSetupCommandLine
    - WindowsSharedTaskScheduler
    - WindowsShellExecuteHooks
    - WindowsShellExtensions
    - WindowsShellIconOverlayIdentifiers
    - WindowsShellLoadAndRun
    - WindowsShellOpenCommand
    - WindowsShellRunasCommand
    - WindowsShellServiceObjects
    - WindowsStubPaths
    - WindowsSystemPolicyShell
    - WindowsTerminalServerInitialProgram
    - WindowsTerminalServerRunKeys
    - WindowsTerminalServerStartupPrograms
    - WindowsToolPaths
    - WindowsWinlogonAppSetup
    - WindowsWinlogonAvailableShells
    - WindowsWinlogonGinaDLL
    - WindowsWinlogonGPExtensions
    - WindowsWinlogonNotify
    - WindowsWinlogonShell
    - WindowsWinlogonSystem
    - WindowsWinlogonTaskman
    - WindowsWinlogonUiHost
    - WindowsWinlogonUserinit
    - WindowsWinlogonVMApplet
    - WinSock2LayeredServiceProviders
    - WinSock2NamespaceProviders
supported_os: [Windows]
---
name: WindowsPLAPProviders
doc: Windows Pre-Logon Access Provider (PLAP) Providers
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\*'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/bb530584(v=vs.85).aspx']
---
name: WindowsPolicyDisallowRun
doc: Restrict users from running specific applications, typically used by malware to block AV.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\*'
supported_os: [Windows]
urls:
- 'https://support.microsoft.com/en-us/kb/323525'
- 'https://blog.malwarebytes.com/detections/pum-optional-disallowrun/'
---
name: WindowsPortProxyConfiguration
doc: Windows PortProxy registry keys (set by netsh portproxy command or manually).
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\*\*\*'
supported_os: [Windows]
urls:
- 'https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html'
- 'https://adepts.of0x.cc/netsh-portproxy-code/'
- 'https://www.dfirnotes.net/portproxy_detection/'
---
name: WindowsPowerShellDefaultProfiles
doc: Default PowerShell Profile files. These files are executed by default when PowerShell starts up.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\system32\WindowsPowerShell\v1.0\profile.ps1'
    - '%%environ_systemroot%%\system32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1'
    - '%%users.userprofile%%\Documents\WindowsPowerShell\profile.ps1'
    - '%%users.userprofile%%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1'
    separator: '\'
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/magazine/2008.10.windowspowershell.aspx#id0190010'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: WindowsPowerShellEnableScripts
doc: Registry keys that control whether PowerShell scripts can execute directly.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\PowerShell', value: 'EnableScripts'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell', value: 'EnableScripts'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/library/hh847748.aspx'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: WindowsPowerShellExecutionPolicies
doc: PowerShell Script Execution Policies for all users, and the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\PowerShell', value: 'ExecutionPolicy'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell', value: 'ExecutionPolicy'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/library/hh847748.aspx'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: WindowsPowerShellHistory
doc: History of commands executed in an interactive PowerShell session.
sources:
- type: FILE
  attributes:
    paths: ['%%users.appdata%%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt']
    separator: '\'
supported_os: [Windows]
urls:
- 'https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html'
- 'https://docs.microsoft.com/en-us/powershell/module/psreadline/get-psreadlineoption?view=powershell-7.1'
---
name: WindowsPrefetchFiles
doc: Windows Prefetch files.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\Prefetch\*.pf']
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/prefetch']
---
name: WindowsPrintMonitors
doc: Windows Print Monitor DLL config.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Monitors\*', value: 'Driver'}]
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://support.microsoft.com/en-us/kb/102966'
---
name: WindowsProductName
doc: The Windows product name
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'ProductName'}]}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/System%20keys.asciidoc']
---
name: WindowsProgramsCache
doc: Windows Programs Cache
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage', value: 'ProgramsCache'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2', value: 'ProgramsCache'}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/Programs%20Cache%20values.asciidoc']
---
name: WindowsProgramsCacheJumpLists
doc: Windows Programs Cache Jump Lists
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2', value: 'ProgramsCacheSMP'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2', value: 'ProgramsCacheTBP'}
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/JumpLists.html']
---
name: WindowsProxyPACAutoConfigURL
doc: Windows Proxy PAC AutoConfigURL.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Internet Settings', value: 'AutoConfigURL'}
supported_os: [Windows]
urls: ['https://blogs.msdn.microsoft.com/askie/2015/07/17/how-can-i-configure-proxy-autoconfigurl-setting-using-group-policy-preference-gpp/']
---
name: WindowsProxyServerSettings
doc: |
  Windows Proxy Server Settings.

  Malware can modify these settings to redirect traffic through
  a malicious program running on the machine (for instance, by
  specifying 127.0.0.1 as the IP address of the proxy server to
  use) or to a malicious host on the local network or internet.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings', value: 'ProxyServer'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Internet Settings', value: 'ProxyServer'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings', value: 'ProxyServer'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings', value: 'ProxyServer'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NlaSvc\Parameters\Internet\ManualProxies', value: 'ProxyServer'}
    - {key: 'HKEY_USERS\%%users.sid%%\System\CurrentControlSet\Services\NlaSvc\Parameters\Internet\ManualProxies', value: 'ProxyServer'}
supported_os: [Windows]
urls: ['https://blog.malwarebytes.com/detections/pum-optional-proxyhijacker/']
---
name: WindowsPushNotificationDatabaseFile
doc: The Windows Push Notification (WPN) database file.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Microsoft\Windows\Notifications\wpndatabase.db'
    - '%%environ_systemroot%%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db'
    separator: '\'
supported_os: [Windows]
---
name: WindowsRDPClientBitmapCache
doc: Artifacts of RDP connection contents
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Microsoft\Terminal Server Client\Cache\*.*']
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#rdp-bitmap-cache']
---
name: WindowsRecentFileCacheBCF
doc: The RecentFileCache.bcf file.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\AppCompat\Programs\RecentFileCache.bcf']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RecentFileCache.html']
---
name: WindowsRecycleBin
doc: Windows Recycle Bin (Recyler, $Recycle.Bin) files.
sources:
- type: FILE
  attributes:
    paths:
    - '\$Recycle.Bin\**'
    - '\Recycler\**'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#recycle-bin']
---
name: WindowsRecycleBinMetadata
doc: Windows Recycle Bin (Recyler, $Recycle.Bin) metadata files only.
sources:
- type: FILE
  attributes:
    paths:
    - '\$Recycle.Bin\*\$I*'
    - '\Recycler\*\INFO2'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#recycle-bin']
---
name: WindowsRegistryCurrentControlSet
aliases: [CurrentControlSet]
doc: The current control set of the Windows Registry.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\Select', value: 'Current'}]}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/main/documentation/System%20keys.asciidoc']
---
name: WindowsRegistryFilesAndTransactionLogs
doc: Windows user and system Registry files and transaction logs.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'WindowsSystemRegistryFiles'
    - 'WindowsSystemRegistryTransactionLogFiles'
    - 'WindowsUserRegistryFiles'
    - 'WindowsUserRegistryTransactionLogFiles'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsRegistryProfiles
doc: |
  Get SIDs for all users on the system with profiles present in the Registry.

  This looks in the Windows Registry where the profiles are stored and retrieves
  the paths for each profile.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\*', value: 'ProfileImagePath'}]}
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/windows/desktop/bb776892(v=vs.85).aspx']
---
name: WindowsReleaseIdentifier
doc: |
  The Windows 10 release identifier (or version number).

  This Windows Registry value contains the semi-annual Windows 10 version number.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'ReleaseID'}]}
supported_os: [Windows]
urls: ['https://www.microsoft.com/en-us/itpro/windows-10/release-information']
---
name: WindowsRoverAutostartDLL
doc: |
  Windows Rover autostart DLL.

  The DLL loaded via the Windows Rover autostart mechanism.
  If this file exists, and the Rover autostart Registry key is set,
  userinit.exe will load this file and call its RunMonitor export.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\rover.dll']
    separator: '\'
supported_os: [Windows]
urls: ['http://www.hexacorn.com/blog/2014/05/21/beyond-good-ol-run-key-part-12/']
---
name: WindowsRoverAutostartKey
doc: |
  Windows Rover autostart Registry key.

  When set userinit.exe will load the DLL at %SystemRoot%\System32\rover.dll and call its RunMonitor export.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_CLASSES_ROOT\CLSID\{16d12736-7a9e-4765-bec6-f301d679caaa}']}
supported_os: [Windows]
urls: ['http://www.hexacorn.com/blog/2014/05/21/beyond-good-ol-run-key-part-12/']
---
name: WindowsRunGrpConv
doc: |
  The Windows RunGrpConv Registry value.

  When this Registry value is non-zero userinit.exe will launch grpconv.exe at user login.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'RunGrpConv'}]}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2014/06/18/beyond-good-ol-run-key-part-13/'
- 'http://www.exploit-id.com/local-exploits/windows-xp-sp2-grpconv-exe'
---
name: WindowsRunKeys
doc: |
  Windows Run and RunOnce keys.

  Note users.sid will currently only expand to SIDs with profiles
  on the system, not all SIDs.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Run\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnce\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx'
- 'https://support.microsoft.com/en-us/kb/137367'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://technet.microsoft.com/en-us/magazine/ee851671.aspx'
---
name: WindowsRunServices
doc: Windows Run Services.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunServices\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\*'
supported_os: [Windows]
urls:
- 'https://support.microsoft.com/en-us/kb/179365'
- 'https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html'
---
name: WindowsScheduledTasks
doc: Windows Scheduled Tasks.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\Tasks\**10'
    - '%%environ_systemroot%%\System32\Tasks\**10'
    - '%%environ_systemroot%%\SysWow64\Tasks\**10'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#scheduled-tasks']
---
name: WindowsScreenSaverExecutable
doc: ScreenSaver Executable
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\Control Panel\Desktop', value: 'scrnsave.exe'}
    - {key: 'HKEY_USERS\%%users.sid%%\Control Panel\Desktop', value: 'scrnsave.exe'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://technet.microsoft.com/en-us/library/cc737855(v=ws.10).aspx'
- 'https://technet.microsoft.com/en-us/library/cc957840.aspx'
---
name: WindowsSearchDatabaseFile
aliases: [WindowsSearchDatabase]
doc: Windows Search database (Windows.edb).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\Microsoft\Search\Data\Applications\Windows\Windows.edb']
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows_desktop_search']
---
name: WindowsSearchFilterHandlers
doc: |
  Windows Search filter handlers configured for file types and applications.

  Windows Search loads DLLs that implement the IFilter interface in order to
  scan files for text and extract certain types of information. Malware can
  replace the filter handler for a given file type or CLSID with itself to gain
  execution when a search operation is performed on that file. Search
  operations can be performed indirectly in a number of cases; for instance,
  the .txt, .html, and .rtf filter handlers are invoked when indexing email
  message bodies.

  The filter handler to use is specified indirectly via a persistent handler.
  The persistent handler GUID is indicated via the PersistentHandler subkey for
  a file type or application GUID.  The filter handler CLSID is indicated via
  the PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF} subkey
  under the persistent handler GUID key path. This artifact inspects both of
  these paths.

  NOTE: Only the HKEY_LOCAL_MACHINE root key needs be checked, because these
  are the only keys used. SearchFilterHost.exe runs under the SYSTEM account,
  which does not have access to HKEY_CURRENT_USER.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\*\PersistentHandler', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\PersistentHandler', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\PersistentHandler', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\PersistentHandler', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\CLSID\*\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\*\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}', value: ''}
supported_os: [Windows]
urls:
- 'https://docs.microsoft.com/en-us/windows/desktop/search/-search-ifilter-about'
- 'https://docs.microsoft.com/en-us/windows/desktop/search/-search-ifilter-implementations'
- 'https://docs.microsoft.com/en-us/windows/desktop/search/-search-ifilter-registering-filters'
---
name: WindowsSecurityCenterSettings
doc: |
  Windows Security Center Settings

  Malware can modify these settings to avoid detection on
  an infected machine. For instance, Emotet modifies some of
  these settings after gaining execution.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'AntiSpyWareDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'AntiSpyWareDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'AntiVirusDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'AntiVirusDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'AntiVirusOverride'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'AntiVirusOverride'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'AutoUpdateDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'AutoUpdateDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'FirewallDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'FirewallDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'FirewallOverride'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'FirewallOverride'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'UpdatesDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'UpdatesDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'UpdatesOverride'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'UpdatesOverride'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center', value: 'UacDisableNotify'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Security Center', value: 'UacDisableNotify'}
supported_os: [Windows]
urls:
- 'https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html'
- 'https://blog.appriver.com/phorphiex/trik-botnet-campaign-leads-to-multiple-infections-ransomware-banking-trojan-cryptojacking'
- 'https://ccm.net/faq/1446-disabling-security-alerts-under-vista'
---
name: WindowsSecurityProviders
doc: Security Providers DLLs
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\*']
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://github.com/wmark/security-configuration/blob/master/Windows/disable-weak-ciphers-and-enable-TLS1.x.reg'
---
name: WindowsSecuritySettingsDatabases
doc: Windows security settings databases (secedit.sdb and spsecupd.sdb)
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\security\Database\secedit.sdb'
    - '%%environ_systemroot%%\security\templates\spsecupd.sdb'
    separator: '\'
supported_os: [Windows]
---
name: WindowsServiceControlManagerExtension
doc: Windows service control manager extension
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control', value: 'ServiceControlManagerExtension'}]
supported_os: [Windows]
urls:
- 'http://forum.sysinternals.com/autoruns-and-windows-7_topic19770.html'
- 'https://support.microsoft.com/en-us/kb/102985'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.silentrunners.org/Silent%20Runners.vbs'
---
name: WindowsServices
doc: Windows service and driver configurations.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\*']
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ServicesAndDrivers.html']
---
name: WindowsSessionManagerBootExecute
doc: Windows Session Manager BootExecute persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'BootExecute'}]
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc963230.aspx']
---
name: WindowsSessionManagerExecute
doc: |
  Windows Session Manager Execute persistence

  This entry shouldn't be populated after Windows has been installed
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'Execute'}]
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/cc976130.aspx'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
---
name: WindowsSessionManagerS0InitialCommand
doc: |
  Windows Session Manager S0InitialCommand persistence

  This entry shouldn't be populated after Windows has been installed
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'S0InitialCommand'}]
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/dd392286%28v=vs.85%29.aspx'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
---
name: WindowsSessionManagerSetupExecute
doc: |
  Windows Session Manager SetupExecute persistence

  This entry shouldn't be populated after Windows has been installed
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', value: 'SetupExecute'}]
supported_os: [Windows]
urls:
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/dd392286%28v=vs.85%29.aspx'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
---
name: WindowsSessionManagerSubSystems
doc: Windows Session Manager SubSystems persistence
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems', value: 'Windows'}]
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/cc976130.aspx'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsSessionManagerWOWCommandLine
doc: Windows Session Manager Windows-on-Windows (WOW) command line
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\WOW', value: 'cmdline'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\WOW', value: 'wowcmdline'}
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/102986']
---
name: WindowsSetupCommandLine
doc: Command line invocation used for custom setup and deployment tasks
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\Setup', value: 'CmdLine'}
supported_os: [Windows]
urls: ['https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2']
---
name: WindowsSharedTaskScheduler
doc: Runs on windows boot.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.bleepingcomputer.com/tutorials/windows-program-automatic-startup-locations/'
---
name: WindowsShellExecuteHooks
doc: Shell execution hooks are called when ShellExecuteEx() is called.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
- 'https://code.google.com/p/regripper/wiki/ASEPs'
---
name: WindowsShellExtensions
doc: Approved extensions to the Windows Shell (explorer.exe).
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/cc144110(v=vs.85).aspx']
---
name: WindowsShellHandlersRegistryKeys
doc: |
  Windows registry values for shell handler artifacts.

  ContextMenuHandlers are added to right-click menus.
  CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
  settings to trigger on these actions.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\ColumnHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\ContextMenuHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\CopyHookHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\DragDropHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\PropertySheetHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\CopyHookHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\DragDropHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\PropertySheetHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\ColumnHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\ContextMenuHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\CopyHookHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\DragDropHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\ShellEx\PropertySheetHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Directory\Background\ShellEx\ContextMenuHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Directory\Background\ShellEx\CopyHookHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Directory\Background\ShellEx\DragDropHandlers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Directory\Background\ShellEx\PropertySheetHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\ColumnHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\ContextMenuHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\CopyHookHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\DragDropHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\PropertySheetHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\CopyHookHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\DragDropHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\PropertySheetHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\ColumnHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\ContextMenuHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\CopyHookHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\DragDropHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\ShellEx\PropertySheetHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Directory\Background\ShellEx\ContextMenuHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Directory\Background\ShellEx\CopyHookHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Directory\Background\ShellEx\DragDropHandlers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\Directory\Background\ShellEx\PropertySheetHandlers\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm'
- 'http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r'
---
name: WindowsShellIconOverlayIdentifiers
doc: Called to display custom icons.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/hh127455(v=vs.85).aspx'
---
name: WindowsShellLoadAndRun
doc: Windows Shell Load and Run values
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'Load'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'Run'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows', value: 'Load'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows', value: 'Run'}
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/103865']
---
name: WindowsIconServiceLib
doc: |
  Windows Icon Service Library Name

  The value should default to 'IconCodecService.dll'
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'IconServiceLib'}
supported_os: [Windows]
urls: ['https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2']
---
name: WindowsShellOpenCommand
doc: Executed every time this file type is opened. For most file types, the value should be '"%1" %*'.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\*\shell\open\command', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\*\shell\open\command', value: 'IsolatedCommand'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\shell\open\command', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\shell\open\command', value: 'IsolatedCommand'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\*\shell\open\command', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\*\shell\open\command', value: 'IsolatedCommand'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\shell\open\command', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\shell\open\command', value: 'IsolatedCommand'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
- 'https://pentestlab.blog/2017/06/09/uac-bypass-sdclt/'
---
name: WindowsShellRunasCommand
doc: |
  Executed every time an executable or script file type is run as administrator.

  For most file types, the value should be '"%1" %*' or something similar.
  Example file type subkeys include 'exefile', 'batfile', and 'cmdfile'. These
  keys can be modified by malware as a way to be periodically executed or to
  bypass UAC.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\*\shell\runas\command', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\*\shell\runas\command', value: 'IsolatedCommand'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\shell\runas\command', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\*\shell\runas\command', value: 'IsolatedCommand'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\*\shell\runas\command', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\*\shell\runas\command', value: 'IsolatedCommand'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\shell\runas\command', value: ''}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Classes\Wow6432Node\*\shell\runas\command', value: 'IsolatedCommand'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
- 'https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/'
---
name: WindowsShellServiceObjects
doc: Windows Shell (explorer.exe) service objects delayed load.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad'
supported_os: [Windows]
urls: ['http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=TrojanClicker:Win32/Zirit.X#tab=2']
---
name: WindowsSmsRouterInterceptStoreDatabaseFile
doc: Windows SmsRouter intercept store database file (SmsInterceptStore.db)
sources:
- type: FILE
  attributes:
    paths: ['%%environ_programdata%%\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db']
    separator: '\'
supported_os: [Windows]
---
name: WindowsSetupApiLogs
doc: Windows setup API logs.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\setupapi.log'
    - '%%environ_systemroot%%\inf\setupapi.app.log'
    - '%%environ_systemroot%%\inf\setupapi.dev.log'
    - '%%environ_systemroot%%\inf\setupapi.offline.log'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/setup_api_logs']
---
name: WindowsShutdownScript
doc: Windows policy shutdown script
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Shutdown'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\*\*', value: 'Script'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\*\*', value: 'Parameters'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\*\*', value: 'Script'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\*\*', value: 'Parameters'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/ff404236.aspx'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
---
name: WindowsStateRepositoryDeploymentDatabaseFile
doc: The State Reposistory deployment database file (StateRepository-Deployment.srd).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_programdata%%\Microsoft\Windows\AppRepository\StateRepository-Deployment.srd']
    separator: '\'
supported_os: [Windows]
---
name: WindowsStateRepositoryMachineDatabaseFile
doc: The State Reposistory machine database file (StateRepository-Machine.srd).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_programdata%%\Microsoft\Windows\AppRepository\StateRepository-Machine.srd']
    separator: '\'
supported_os: [Windows]
---
name: WindowsStartupFolderModification
doc: Windows startup folder Registry values.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
supported_os: [Windows]
---
name: WindowsStartupFolders
doc: Windows startup folder persistence.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_allusersprofile%%\Microsoft\Windows\Start Menu\Programs\Startup\*'
    - '%%environ_allusersprofile%%\Start Menu\Programs\Startup\*'
    - '%%users.appdata%%\Microsoft\Windows\Start Menu\Programs\Startup\*'
    - '%%users.userprofile%%\Start Menu\Programs\Startup\*'
    separator: '\'
supported_os: [Windows]
---
name: WindowsStartupScript
doc: Windows policy startup script
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts', value: 'Startup'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\*\*', value: 'Script'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\*\*', value: 'Parameters'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\*\*', value: 'Script'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\*\*', value: 'Parameters'}
supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/library/ff404236.aspx'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
---
name: WindowsStubPaths
doc: |
  Windows StubPath persistence.

  Each time a user logs in, the Active Setup Installed Components in HKLM
  are compared ot the ones in HKCU, and if any are missing, or if the
  associated version is less, the program is executed.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\*', value: 'Version'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\*', value: 'Version'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Active Setup\Installed Components\*', value: 'Version'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\*', value: 'Version'}
supported_os: [Windows]
urls:
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
- 'http://bonemanblog.blogspot.com/2004/12/active-setup-registry-keys-and-their.html'
---
name: WindowsSuperFetchFiles
doc: Windows SuperFetch files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\Prefetch\Ag*.db'
    - '%%environ_systemroot%%\Prefetch\Ag*.db.trx'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/superfetch']
---
name: WindowsSystemRestoreSettings
doc: |
  Windows System Restore Settings

  Some malware, especially ransomware, will disable system restore
  to make system recovery more difficult.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore', value: 'DisableConfig'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore', value: 'DisableConfig'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows NT\SystemRestore', value: 'DisableConfig'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore', value: 'DisableConfig'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore', value: 'DisableSR'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore', value: 'DisableSR'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows NT\SystemRestore', value: 'DisableSR'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore', value: 'DisableSR'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer', value: 'LimitSystemRestoreCheckpointing'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows\Installer', value: 'LimitSystemRestoreCheckpointing'}
supported_os: [Windows]
urls:
- 'https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html'
- 'https://www.windows-commandline.com/enable-disable-system-restore-service/'
- 'https://docs.microsoft.com/en-us/windows/desktop/msi/limitsystemrestorecheckpointing'
---
name: WindowsSystemSettings
doc: |
  Windows System Settings

  Malware can modify these keys to make it more difficult for the
  user to detect and remove malicious software.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableCAD'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableCAD'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableCAD'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableCAD'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableRegistryTools'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableRegistryTools'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableRegistryTools'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableRegistryTools'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableTaskMgr'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableTaskMgr'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableTaskMgr'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'DisableTaskMgr'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'NoDispCPL'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'NoDispCPL'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'NoDispCPL'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'NoDispCPL'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System', value: 'DisableCMD'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\System', value: 'DisableCMD'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows\System', value: 'DisableCMD'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Policies\Microsoft\Windows\System', value: 'DisableCMD'}
supported_os: [Windows]
urls:
- 'https://www.sdkhere.com/2016/02/analysis-of-malware-using-wmi-query.html'
- 'https://www.thewindowsclub.com/enable-disable-command-prompt-windows'
- 'https://blog.malwarebytes.com/detections/pum-optional-disableregistrytools/'
- 'https://blog.malwarebytes.com/detections/pum-optional-disabletaskmgr/'
- 'https://www.stigviewer.com/stig/windows_7/2014-04-02/finding/V-1154'
- 'https://blog.malwarebytes.com/detections/pum-optional-nodispcpl/'
- 'https://blog.malwarebytes.com/detections/pum-optional-disablecmdprompt/'
---
name: WindowsSystemIniFiles
doc: Windows system ini files
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemdrive%%\system.ini'
    - '%%environ_windir%%\win.ini'
    - '%%environ_windir%%\wininit.ini'
    separator: '\'
supported_os: [Windows]
---
name: WindowsSystemPolicyShell
doc: Windows System policy replacement shell (custom user interface).
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'Shell'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'Shell'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc728472(v=ws.10).aspx']
---
name: WindowsSystemRegistryFilesBackup
doc: Backup of Windows system Registry files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\config\RegBack\SAM'
    - '%%environ_systemroot%%\System32\config\RegBack\SECURITY'
    - '%%environ_systemroot%%\System32\config\RegBack\SOFTWARE'
    - '%%environ_systemroot%%\System32\config\RegBack\SYSTEM'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsSystemRegistryTransactionLogFilesBackup
doc: |
  Backup of Windows system Registry transaction log files.

  These files have been observed to be typically 0 byte in size.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\config\RegBack\SAM.LOG'
    - '%%environ_systemroot%%\System32\config\RegBack\SAM.LOG1'
    - '%%environ_systemroot%%\System32\config\RegBack\SAM.LOG2'
    - '%%environ_systemroot%%\System32\config\RegBack\SECURITY.LOG'
    - '%%environ_systemroot%%\System32\config\RegBack\SECURITY.LOG1'
    - '%%environ_systemroot%%\System32\config\RegBack\SECURITY.LOG2'
    - '%%environ_systemroot%%\System32\config\RegBack\SOFTWARE.LOG'
    - '%%environ_systemroot%%\System32\config\RegBack\SOFTWARE.LOG1'
    - '%%environ_systemroot%%\System32\config\RegBack\SOFTWARE.LOG2'
    - '%%environ_systemroot%%\System32\config\RegBack\SYSTEM.LOG'
    - '%%environ_systemroot%%\System32\config\RegBack\SYSTEM.LOG1'
    - '%%environ_systemroot%%\System32\config\RegBack\SYSTEM.LOG2'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsSystemRegistryFilesAndTransactionLogsBackup
doc: Backup of Windows system Registry files and transaction logs.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'WindowsSystemRegistryFilesBackup'
    - 'WindowsSystemRegistryTransactionLogFilesBackup'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsSystemRegistryFiles
doc: Windows system Registry files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemdrive%%\System Volume Information\Syscache.hve'
    - '%%environ_systemroot%%\System32\config\SAM'
    - '%%environ_systemroot%%\System32\config\SECURITY'
    - '%%environ_systemroot%%\System32\config\SOFTWARE'
    - '%%environ_systemroot%%\System32\config\SYSTEM'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsSystemRegistryTransactionLogFiles
doc: Windows system Registry transaction log files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\config\SAM.LOG'
    - '%%environ_systemroot%%\System32\config\SAM.LOG1'
    - '%%environ_systemroot%%\System32\config\SAM.LOG2'
    - '%%environ_systemroot%%\System32\config\SECURITY.LOG'
    - '%%environ_systemroot%%\System32\config\SECURITY.LOG1'
    - '%%environ_systemroot%%\System32\config\SECURITY.LOG2'
    - '%%environ_systemroot%%\System32\config\SOFTWARE.LOG'
    - '%%environ_systemroot%%\System32\config\SOFTWARE.LOG1'
    - '%%environ_systemroot%%\System32\config\SOFTWARE.LOG2'
    - '%%environ_systemroot%%\System32\config\SYSTEM.LOG'
    - '%%environ_systemroot%%\System32\config\SYSTEM.LOG1'
    - '%%environ_systemroot%%\System32\config\SYSTEM.LOG2'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsSystemRegistryFilesAndTransactionLogs
doc: Windows system Registry files and transaction logs.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'WindowsSystemRegistryFiles'
    - 'WindowsSystemRegistryTransactionLogFiles'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsSystemResourceUsageMonitorDatabaseFile
doc: Windows System Resource Usage Monitor (SRUM) database file.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\sru\SRUDB.dat']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/SystemResourceUsageMonitor.html']
---
name: WindowsStartupInfo
doc: |
  StartupInfo XML files.

  The files include the user account's Security Identifier (SID) in the name
  and there could be up to 5 per user account. They contain a list of processes
  that were executed within the first 90 seconds from the time the user logged
  in. The info includes start time, the full command line and the parent
  process info, among other things.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\WDI\LogFiles\StartupInfo\*.xml']
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#startup-info']
---
name: WindowsTempDirectories
doc: Contents of the Windows temporary directories
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemdrive%%\Temp\*'
    - '%%environ_systemroot%%\Temp\*'
    - '%%users.localappdata%%\Temp\*'
    separator: '\'
supported_os: [Windows]
---
name: WindowsTerminalServerRunKeys
doc: Windows Terminal Server Run keys
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
    - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
supported_os: [Windows]
urls: ['http://gladiator-antivirus.com/forum/index.php?showtopic=24610']
---
name: WindowsTerminalServerStartupPrograms
doc: Windows Terminal Server Startup Programs
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd', value: 'StartupPrograms'}
supported_os: [Windows]
urls: ['http://forum.sysinternals.com/rdpclip_topic4729.html']
---
name: WindowsTerminalServerInitialProgram
doc: Windows Terminal Server Initial Program
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp', value: 'InitialProgram'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services', value: 'InitialProgram'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows NT\Terminal Services', value: 'InitialProgram'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows NT\Terminal Services', value: 'InitialProgram'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Policies\Microsoft\Windows NT\Terminal Services', value: 'InitialProgram'}
supported_os: [Windows]
urls: ['https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2']
---
name: WindowsThumbcacheDatabaseFiles
doc: Windows thumbcache_*.db files.
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Microsoft\Windows\Explorer\thumbcache_*.db']
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/vista_thumbcache/']
---
name: WindowsTimezone
aliases: [WinTimeZone]
doc: The time zone of the system as a Windows time zone name or in MUI form.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation', value: 'StandardName'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation', value: 'TimeZoneKeyName'}
supported_os: [Windows]
urls: ['https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/Time-zones.html']
---
name: WindowsToolPaths
doc: Paths to windows tools such as defrag, chkdsk.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath'
    - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\ChkDskPath'
    - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath'
    - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.liutilities.com/products/registrybooster/tweaklibrary/tweaks/11118/'
---
name: WindowsTileDataLayerDatabase
doc: |
  Windows tile data layer database (vedatamodel.edb)

  The tile data layer database is used to store information about Start Tiles.
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\TileDataLayer\Database\vedatamodel.edb']
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/extensible_storage_engine_(ese)_database_file_(edb)_format#tile-data-layer-database']
---
name: WindowsUninstallKeys
doc: Uninstall Registry keys
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*\*'
    - 'HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*\*'
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Uninstall\*\*'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/aa372105(v=vs.85).aspx']
---
name: WindowsUpdateBuildRevision
doc: |
  Windows kernel update build revision (UBR).

  This Windows Registry value contains the monthly rollup patch version.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion', value: 'UBR'}]}
supported_os: [Windows]
urls: ['https://social.technet.microsoft.com/Forums/en-US/cadee4de-24d0-403e-9f3e-75868abf8f34']
---
name: WindowsUpdateCatalogDatabaseFile
doc: Windows Update catalog package signatures database file (catdb).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\catroot2\{*-*-*-*-*}\catdb']
    separator: '\'
supported_os: [Windows]
urls: ['https://learn.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files']
---
name: WindowsUpdateDataStoreDatabaseFile
doc: Windows Update data store database file (DataStore.edb).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_windir%%\SoftwareDistribution\DataStore\DataStore.edb']
    separator: '\'
supported_os: [Windows]
---
name: WindowsUpdateLogFile
doc: Windows Update log files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_programdata%%\USOShared\Logs\System\*.etl'
    - '%%environ_systemroot%%\Logs\CBS\CBS*.log'
    - '%%environ_systemroot%%\Logs\WindowsUpdate\WindowsUpdate*.etl'
    separator: '\'
supported_os: [Windows]
urls: ['https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-logs']
---
name: WindowsUpdateSettings
doc: Windows Update Settings
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU', value: 'NoAutoUpdate'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate\AU', value: 'NoAutoUpdate'}
supported_os: [Windows]
urls:
- 'https://docs.microsoft.com/en-us/windows/deployment/update/waas-wu-settings'
- 'https://blog.talosintelligence.com/2019/06/threat-roundup-0531-0607.html'
---
name: WindowsUpdateStatus
doc: Windows auto update status.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect', value: 'LastError'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect', value: 'LastSuccessTime'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download', value: 'LastError'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download', value: 'LastSuccessTime'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install', value: 'LastError'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install', value: 'LastSuccessTime'}
supported_os: [Windows]
urls:
- 'https://forensics.wiki/windows_update'
- 'http://blogs.msdn.com/b/aruns_blog/archive/2011/06/20/active-setup-registry-key-what-it-is-and-how-to-create-in-the-package-using-admin-studio-install-shield.aspx'
---
name: WindowsUpdateStoreDatabaseFile
doc: The Update Service Orchestrator (USO) private update store database file.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_programdata%%\USOPrivate\UpdateStore\store.db']
    separator: '\'
supported_os: [Windows]
---
name: WindowsUpgradeSettings
doc: |
  Windows Upgrade Settings

  Malware sometimes disables a machine ability to upgrade from
  previous versions of Windows to Windows 10. One malware family
  known to modify these keys is Kovter, a well-known trojan.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate', value: 'DisableOSUpgrade'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate', value: 'DisableOSUpgrade'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\OSUpgrade', value: 'ReservationsAllowed'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate\OSUpgrade', value: 'ReservationsAllowed'}
supported_os: [Windows]
urls:
- 'https://www.ghacks.net/2016/01/08/disableosupgrade-prevents-the-upgrade-to-windows-10/'
- 'https://blog.talosintelligence.com/2019/05/threat-roundup-0517-0524.html'
---
name: WindowsUserAccessLogging
doc: |
  User Access Logging (UAL) databases.

  UAL is a local data aggregation feature (enabled by default) on Windows
  Servers 2012 and above, recording client usage by role and product on each
  system providing the resource. It's typically between 2 and 4 extensible
  storage engine (ESE) databases ("Current.mdb", "SystemIdentity.mdb, and
  "<GUID>.mdb").
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\LogFiles\SUM\*.mdb']
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#user-access-logging-ual']
---
name: WindowsUserAccountControlSettings
doc: |
  Windows User Account Control Settings

  Malware sometimes disables UAC to make it easier to perform
  actions on an infected machine.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'EnableLUA'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'EnableLUA'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'ConsentPromptBehaviorAdmin'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System', value: 'ConsentPromptBehaviorAdmin'}
supported_os: [Windows]
urls:
- 'https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/958053ae-5397-4f96-977f-b7700ee461ec'
- 'https://blog.talosintelligence.com/2019/05/threat-roundup-0503-0510.html'
- 'https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4'
---
name: WindowsUserAutomaticDestinationsJumpLists
doc: Windows user AutomaticDestinations Jump Lists.
sources:
- type: FILE
  attributes:
    paths: ['%%users.appdata%%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/JumpLists.html']
---
name: WindowsUserCustomDestinationsJumpLists
doc: Windows user CustomDestinations Jump Lists.
sources:
- type: FILE
  attributes:
    paths: ['%%users.appdata%%\Microsoft\Windows\Recent\CustomDestinations\*.customDestinations-ms']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/JumpLists.html']
---
name: WindowsUserJumpLists
doc: Windows user Jump Lists.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'WindowsProgramsCacheJumpLists'
    - 'WindowsUserAutomaticDestinationsJumpLists'
    - 'WindowsUserCustomDestinationsJumpLists'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/JumpLists.html']
---
name: WindowsUserRecentFiles
doc: Windows user specific recent files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.appdata%%\Microsoft\Office\Recent\*'
    - '%%users.appdata%%\Microsoft\Windows\Recent\*'
    separator: '\'
supported_os: [Windows]
---
name: WindowsUserRegistryFiles
doc: Windows user specific Registry files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.userprofile%%\NTUSER.DAT'
    - '%%users.userprofile%%\NTUSER.MAN'
    - '%%users.localappdata%%\Microsoft\Windows\UsrClass.dat'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsUserRegistryTransactionLogFiles
doc: Windows user Registry transaction log files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.userprofile%%\NTUSER.DAT.LOG'
    - '%%users.userprofile%%\NTUSER.DAT.LOG1'
    - '%%users.userprofile%%\NTUSER.DAT.LOG2'
    - '%%users.localappdata%%\Microsoft\Windows\UsrClass.dat.LOG'
    - '%%users.localappdata%%\Microsoft\Windows\UsrClass.dat.LOG1'
    - '%%users.localappdata%%\Microsoft\Windows\UsrClass.dat.LOG2'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsUserRegistryFilesAndTransactionLogs
doc: Windows user Registry files and transaction logs.
sources:
- type: ARTIFACT_GROUP
  attributes:
    names:
    - 'WindowsUserRegistryFiles'
    - 'WindowsUserRegistryTransactionLogFiles'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/RegistryFiles.html']
---
name: WindowsUserShellFolders
doc: The Shell Folders information for Windows users.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\*'
    - 'HKEY_USERS\%%users.sid%%\Environment\*'
    - 'HKEY_USERS\%%users.sid%%\Volatile Environment\*'
supported_os: [Windows]
---
name: WindowsWebCacheStorageQuotaDatabaseFile
doc: Windows WebCache storage quota database file (CacheStorage.edb)
sources:
- type: FILE
  attributes:
    paths: ['%%users.localappdata%%\Packages\*\AppData\CacheStorage\CacheStorage.edb']
    separator: '\'
supported_os: [Windows]
---
name: WindowsWinlogonGinaDLL
doc: Windows Gina DLL replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'GinaDLL'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'GinaDLL'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinlogonNotify
doc: Windows Winlogon Notify DLL names.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*', value: 'DLLName'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\*', value: 'DLLName'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/aa379402(v=vs.85).aspx']
---
name: WindowsWinlogonShell
doc: Windows shell replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Shell'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Shell'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/ms838576%28v=winembedded.5%29.aspx']
---
name: WindowsWinlogonSystem
doc: Applications launched by Winlogon in the system context during the system initialisation.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'System'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'System'}
supported_os: [Windows]
urls:
- 'https://code.google.com/p/regripper/wiki/ASEPs'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
---
name: WindowsWinlogonTaskman
doc: Windows Winlogon Taskman replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Taskman'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Taskman'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinlogonUiHost
doc: Windows Winlogon UI screen application
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'UiHost'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'UiHost'}
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://www.bleepingcomputer.com/forums/t/14028/change-the-loginwelcome-screen/'
---
name: WindowsWinlogonUserinit
doc: Windows Winlogon Userinit replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Userinit'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Userinit'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939862.aspx']
---
name: WindowsWinlogonAvailableShells
doc: |
  Windows Server Winlogon Available Shells

  Used to specify an alternate shell application to be launched when
  logging into Windows Server 2012 and later. Legitimate keys under
  AvailableShells should just cause cmd.exe or explorer.exe to be executed,
  whereas malicious programs may create keys that cause malware to be run
  when a user logs in.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells\AvailableShells\*']
supported_os: [Windows]
urls:
- https://andymorgan.wordpress.com/2012/03/30/changing-the-default-shell-of-windows-server-8-core/
- https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2
---
name: WindowsWinlogonVMApplet
doc: Windows VMApplet replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'VMApplet'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'VMApplet'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinstart
doc: Windows winstart.bat file
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_windir%%\winstart.bat'
    - '%%environ_windir%%\dosstart.bat'
    separator: '\'
supported_os: [Windows]
---
name: WindowsWinlogonAppSetup
doc: Windows Winlogon Appsetup
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'AppSetup'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinlogonGPExtensions
doc: |
  Windows Winlogon Group Policy Extensions

  These keys specify DLLs that should be loaded when the group policy
  engine loads, and can act as a persistence mechanism for malware.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\*', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\*', value: 'DllName'}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\*', value: ''}
    - {key: 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\*', value: 'DllName'}
supported_os: [Windows]
urls: ['https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2']
---
name: WindowsWordWheelQueryRegistryKey
doc: Keywords searched in from the Windows start menu, potentially resulting in files or folders access or program executions.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery\*']
supported_os: [Windows]
---
name: WindowsXMLEventLogApplication
doc: Application Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Application.evtx']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsXMLEventLogPowerShell
doc: PowerShell Windows XML Event Logs.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx'
    - '%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx'
    - '%%environ_systemroot%%\System32\winevt\Logs\PowerShellCore Operational.evtx'
    - '%%environ_systemroot%%\System32\winevt\Logs\Windows PowerShell.evtx'
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsXMLEventLogSecurity
doc: Security Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Security.evtx']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsXMLEventLogSysmon
doc: Sysmon Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsXMLEventLogSystem
doc: System Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\System.evtx']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WindowsXMLEventLogTerminalServices
doc: TerminalServices Windows XML Event Log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx']
    separator: '\'
supported_os: [Windows]
urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/EventLog.html']
---
name: WinSock2LayeredServiceProviders
doc: Used to filter TCP/IP traffic through WinSock2.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\*'
    - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'https://en.wikipedia.org/wiki/Layered_Service_Provider'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
---
name: WinSock2NamespaceProviders
doc: Used to provide name-resolution services through WinSock2
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\*', value: 'LibraryPath'}
    - {key: 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\*', value: 'LibraryPath'}
supported_os: [Windows]
urls:
- 'https://www.symantec.com/security_response/writeup.jsp?docid=2012-020609-4221-99&tabid=2'
- 'http://www.nirsoft.net/utils/winsock_service_providers.html'
- 'https://msdn.microsoft.com/en-us/library/windows/desktop/ms739923(v=vs.85).aspx'
- 'https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2'
