<commit_before># Windows specific artifacts.

name: AppCompatCache
doc: Windows Application Compatibility Cache
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility', value: 'AppCompatCache'}
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache', value: 'AppCompatCache'}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/master/documentation/Application%20Compatibility%20Cache%20key.asciidoc']
---
name: WindowsActiveDesktop
doc: Windows Active Desktop executable paths, used for persistence.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Desktop\Components\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Desktop\General'
conditions: [os_major_version < 6]
supported_os: [Windows]
urls:
- 'https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~DwnLdr-GWV/detailed-analysis.aspx'
- 'https://support.microsoft.com/en-us/kb/929200'
- 'https://en.wikipedia.org/wiki/Active_Desktop'
---
name: ApplicationEventLog
doc: Windows Application Event log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\AppEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: ApplicationEventLogEvtx
doc: Windows Application Event log for Vista or later systems.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Application.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: ApplicationRegistration
doc: Application Registration (AppPath) registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\*'
    - 'HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\*'
supported_os: [Windows]
urls:
  - 'https://github.com/keydet89/RegRipper2.8/blob/master/plugins/apppaths.pl'
  - 'http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/'
  - 'https://msdn.microsoft.com/en-us/library/windows/desktop/ee872121(v=vs.85).aspx'
---
name: APPX_PROCESSEnvironmentVariable
doc: |
  APPX_PROCESS environment variable. If this variable is set, .NET applications will attempt to load WinAppXRT.dll
  from PATH, which is a potential persistence mechanism.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'APPX_PROCESS'}
supported_os: [Windows]
conditions: [os_major_version >= 6 AND os_minor_version >= 2]
urls: ['http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/']
---
name: AvailableTimeZones
doc: The timezones available on the system.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\*\*']}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Time-zone-keys']
---
name: BITSQueueManagerDatabases
doc: Databases that control BITS job specs and state.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_allusersprofile%%\Microsoft\Network\Downloader\qmgr*.dat'
supported_os: [Windows]
urls: ['http://dfrws.org/2015/proceedings/presentations/DFRWS2015-pres3.pdf']
---
name: EnvironmentUserLoginScripts
doc: User login scripts configured via environment variables.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
        - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitLogonServer'}
        - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitLogonScript'}
        - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserMprLogonScript'}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/'
- 'https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/cb6f1d6f-60a6-4369-803e-ec03d902e638/gina-how-to-run-domain-scripts-after-logon'
---
name: EventLogs
doc: Windows Event logs.
sources:
- type: ARTIFACT
  attributes:
    names:
      - 'ApplicationEventLog'
      - 'ApplicationEventLogEvtx'
      - 'SecurityEventLog'
      - 'SecurityEventLogEvtx'
      - 'SystemEventLog'
      - 'SystemEventLogEvtx'
labels: [Logs]
supported_os: [Windows]
---
name: FileTypeAutorunAssociations
doc: Registry value for what application class identifier (CLSID) to launch for a file extension.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\software\classes\*'
      - 'HKEY_USERS\%%users.sid%%\software\classes\*'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/ms678415(v=vs.85).aspx']
---
name: MFTFiles
doc: |
  $MFT and $MFTMirr files.

  GRR collection note: you currently need to specify 'use tsk' and
  'ignore download size limits' for this artifact to work. This will go away in
  the future.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\$MFT'
      - '%%environ_systemdrive%%\$MFTMirr'
    separator: '\'
labels: [System]
supported_os: [Windows]
---
name: MostRecentApplication
doc: Most Recent Application name key
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\*\MostRecentApplication', value: 'Name'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\*\MostRecentApplication', value: 'Name'}
supported_os: [Windows]
urls:
- 'http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_ransom.smc7'
- 'https://www.symantec.com/security_response/writeup.jsp?docid=2014-092314-3644-99&tabid=2'
---
name: PowerShellEnableScripts
doc: Registry keys that control whether PowerShell scripts can execute directly.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\PowerShell', value: 'EnableScripts'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell', value: 'EnableScripts'}
  supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/library/hh847748.aspx'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: PowerShellExecutionPolicies
doc: Powershell Script Execution Policies for all users, and the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\PowerShell', value: 'ExecutionPolicy'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell', value: 'ExecutionPolicy'}
  supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/library/hh847748.aspx'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: PowershellDefaultProfiles
doc: Default PowerShell Profile files. These files are executed by default when Powershell starts up.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\system32\Windows­PowerShell\v1.0\profile.ps1'
      - '%%environ_systemroot%%\system32\Windows­PowerShell\v1.0\Microsoft.PowerShell_profile.ps1'
      - '%%users.homedir%%\Documents\WindowsPowerShell\profile.ps1'
      - '%%users.homedir%%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1'
  supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/magazine/2008.10.windowspowershell.aspx#id0190010'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: PrefetchFiles
doc: Windows Prefetch files.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\Prefetch\*.pf']
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Prefetch']
---
name: ProgramsCache
doc: Windows Programs Cache
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\RunGrpConv']}
supported_os: [Windows]
conditions: [os_major_version <= 5]
urls:
- 'http://www.hexacorn.com/blog/2014/06/18/beyond-good-ol-run-key-part-13/'
- 'http://www.exploit-id.com/local-exploits/windows-xp-sp2-grpconv-exe'
---
name: ScheduledTasks
doc: Windows Scheduled Tasks.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\Tasks\**10'
      - '%%environ_systemroot%%\System32\Tasks\**10'
      - '%%environ_systemroot%%\SysWow64\Tasks\**10'
    separator: '\'
supported_os: [Windows]
urls: ['http://forensicswiki.org/wiki/Windows#Scheduled_Tasks']
---
name: SecurityEventLog
doc: Windows Security Event log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\SecEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: SecurityEventLogEvtx
doc: Windows Security Event log for Vista or later systems.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Security.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: SetupApiLogs
doc: Windows setup API logs.
sources:
- type: FILE
  attributes: {paths: ['%%environ_systemroot%%\setupapi.log']}
  conditions: [os_major_version < 6]
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\inf\setupapi.app.log'
      - '%%environ_systemroot%%\inf\setupapi.dev.log'
      - '%%environ_systemroot%%\inf\setupapi.offline.log'
    separator: '\'
  conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Setup_API_Logs']
---
name: SuperFetchFiles
doc: Windows SuperFetch files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\Prefetch\Ag*.db'
      - '%%environ_systemroot%%\Prefetch\Ag*.db.trx'
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/SuperFetch']
---
name: SystemEventLog
doc: Windows System Event log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\SysEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: SystemEventLogEvtx
doc: Windows System Event log for Vista or later systems.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\System.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: TerminalServicesEventLogEvtx
doc: Windows TerminalServices Event log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: WindowsHostsFiles
doc: The Windows hosts and lmhosts file.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\Drivers\etc\Lmhosts'
      - '%%environ_systemroot%%\System32\Drivers\etc\hosts'
    separator: '\'
supported_os: [Windows]
---
name: WindowsPersistenceMechanisms
doc: Persistence mechanisms in Windows.
sources:
- type: ARTIFACT
  attributes:
    names:
      - WindowsRunKeys
      - WindowsServices
  returned_types: [PersistenceFile]
labels: [Software]
supported_os: [Windows]
---
name: WindowsRecycleBin
doc: Windows Recycle Bin (Recyler, $Recycle.Bin) files.
sources:
- type: FILE
  attributes:
    paths:
      - '\$Recycle.Bin\**'
      - '\Recycler\**'
    separator: '\'
labels: [Users]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows#Recycle_Bin']
---
name: WindowsRunKeys
doc: |
  Windows Run and RunOnce keys.

  Note users.sid will currently only expand to SIDs with profiles
  on the system, not all SIDs.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
labels: [Software]
supported_os: [Windows]
urls:
  - 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx'
  - 'https://support.microsoft.com/en-us/kb/137367'
  - 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsSearchDatabase
doc: Windows Search database (Windows.edb).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\Microsoft\Search\Data\Applications\Windows\Windows.edb']
    separator: '\'
labels: [Software]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Desktop_Search']
---
name: WindowsServices
doc: Windows services from the Registry.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - '%%current_control_set%%\services\*\*'
      - '%%current_control_set%%\services\*\Parameters\*'
labels: [Software]
supported_os: [Windows]
urls:
  - 'http://support.microsoft.com/kb/103000'
  - 'https://github.com/libyal/winreg-kb/wiki/System-keys'
---
name: WindowsSystemRegistryFiles
doc: Windows system Registry files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\config\SAM'
      - '%%environ_systemroot%%\System32\config\SECURITY'
      - '%%environ_systemroot%%\System32\config\SOFTWARE'
      - '%%environ_systemroot%%\System32\config\SYSTEM'
      - '\System Volume Information\Syscache.hve'
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Registry-files']
---
name: WindowsUserRecentFiles
doc: Windows user specific recent files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.appdata%%\Roaming\Microsoft\Office\Recent\*'
      - '%%users.appdata%%\Roaming\Microsoft\Windows\Recent\*'
    separator: '\'
labels: [Users]
supported_os: [Windows]
---
name: WindowsUserRegistryFiles
doc: Windows user specific Registry files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%\NTUSER.DAT'
      - '%%users.homedir%%\NTUSER.MAN'
      - '%%users.localappdata%%\Microsoft\Windows\UsrClass.dat'
    separator: '\'
labels: [Users]
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Registry-files']
---
name: WMIComputerSystemProduct
doc: Computer System Product including Identifiying number queried from WMI.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_ComputerSystemProduct}
labels: [System]
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/aa394105(v=vs.85).aspx']
---
name: WMIDrivers
doc: Installed drivers via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: 'SELECT DisplayName, Description, InstallDate, Name, PathName, Status,
      State, ServiceType from Win32_SystemDriver'}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMIEnumerateASEC
doc: Enumerate instances of ActiveScriptEventConsumer.
sources:
- type: WMI
  attributes: {query: SELECT * FROM ActiveScriptEventConsumer, base_object: 'winmgmts:\root\subscription'}
supported_os: [Windows]
---
name: WMIEnumerateCLEC
doc: Enumerate instances of CommandLineEventConsumer.
sources:
- type: WMI
  attributes: {query: SELECT * FROM CommandLineEventConsumer, base_object: 'winmgmts:\root\subscription'}
supported_os: [Windows]
---
name: WMIHotFixes
doc: Installed hotfixes via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: SELECT * from Win32_QuickFixEngineering}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMIInstalledSoftware
doc: Installed software via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: 'SELECT Name, Vendor, Description, InstallDate, InstallDate2, Version
      from Win32_Product'}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMILogicalDisks
doc: Disk information via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_LogicalDisk}
labels: [System]
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/aa394173(v=vs.85).aspx']
---
name: WMILoginUsers
doc: |
  Login Users via Windows Management Instrumentation (WMI).

  This WMI query may take a long time to complete when run on a domain and
  will create load on a domain controller.
sources:
- type: WMI
  attributes: {query: SELECT * from Win32_GroupUser where Name = "login_users"}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMIPhysicalMemory
doc: Physical memory information via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: SELECT * from Win32_PhysicalMemory}
conditions: [os_major_version >= 6]
labels: [System]
supported_os: [Windows]
urls: ["http://msdn.microsoft.com/en-us/library/aa394347%28v=vs.85%29.aspx"]
---
name: WMIProcessList
doc: Process listing via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: SELECT * from Win32_Process}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMIUsers
doc: |
  Users via Windows Management Instrumentation (WMI).

  Note that in a domain setup, this will probably return all users in the
  domain which will be expensive and slow. Consider limiting by SID like
  WMIProfileUsersHomeDir.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_UserAccount}
labels: [Users]
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/windows/desktop/aa394507(v=vs.85).aspx']
---
name: WindowsHotkeyReplacement
doc: Hotkey executable replacement.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\sethc.exe'
      - '%%environ_systemroot%%\System32\utilman.exe'
      - '%%environ_systemroot%%\System32\magnifier.exe'
    separator: '\'
supported_os: [Windows]
---
name: WindowsAutorun
doc: Filebased Tests.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemdrive%%\autorun.inf']
    separator: '\'
supported_os: [Windows]
---
name: WindowsCommonFilePlacementAttacks
doc: Common files associated with search order hijacking and other file placement attacks.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\program.exe'
      - '%%environ_systemdrive%%\explorer.exe'
      - '%%environ_systemroot%%\System32\oci.dll'
      - '%%environ_systemroot%%\SysWOW64\oci.dll'
      - '%%environ_systemroot%%\linkinfo.dll'
      - '%%environ_systemroot%%\ntshrui.dll'
      - '%%environ_systemroot%%\System32\sysprep\cryptbase.dll'
      - '%%environ_systemroot%%\SysWOW64\sysprep\cryptbase.dll'
      - '%%environ_programfiles%%\Internet Explorer\sxs.dll'
      - '%%environ_programfilesx86%%\Internet Explorer\sxs.dll'
    separator: '\'
supported_os: [Windows]
urls:
- 'http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf'
- 'https://www.mandiant.com/blog/fxsst/'
---
name: WindowsStartupFolders
doc: Windows startup folder persistence.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*'
      - '%%environ_allusersprofile%%\Microsoft\Windows\Start Menu\Programs\Startup\*'
    separator: '\'
supported_os: [Windows]
---
name: WindowsStubPaths
doc: Windows StubPath persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
supported_os: [Windows]
urls: ['http://blogs.msdn.com/b/aruns_blog/archive/2011/06/20/active-setup-registry-key-what-it-is-and-how-to-create-in-the-package-using-admin-studio-install-shield.aspx']
---
name: WindowsBootExecute
doc: Windows BootExecute persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'BootExecute'}]
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc963230.aspx']
---
name: WindowsExcludeFromKnownDlls
doc: ExcludeFromKnownDlls can be used to bypass search order hijacking protection.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'ExcludeFromKnownDlls'}]
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586%28v=vs.85%29.aspx']
---
name: WindowsLSASecurityPackages
doc: CurrentControlSet Security Packages can be injected into LSASS.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa', value: 'Security Packages'}
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig', value: 'Security Packages'}
supported_os: [Windows]
urls:
  - 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa379392(v=vs.85).aspx'
  - 'https://dl.mandiant.com/EE/library/MIRcon2014/MIRcon_2014_IR_Track_Analysis_of_Malicious_SSP.pdf'
---
name: WindowsAppCertDlls
doc: Windows AppCertDlls persistence.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls']
supported_os: [Windows]
urls: ['http://blogs.technet.com/b/mmpc/archive/2011/03/19/how-to-defang-the-fake-defragmenter.aspx']
---
name: WindowsStartupFolderModification
doc: Windows startup folder Registry values.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
supported_os: [Windows]
---
name: WindowsShellExecuteHooks
doc: Shell execution hooks are called when ShellExecuteEx() is called.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
- 'https://code.google.com/p/regripper/wiki/ASEPs'
---
name: WindowsDebugger
doc: Windows Debugger peristence or AV disable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
      - {key: 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/a329t4ed%28VS.71%29.aspx']
---
name: WindowsRunServices
doc: Windows Run Services.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunServices\*'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx']
---
name: WindowsWinlogonNotify
doc: Windows Winlogon Notify.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/aa379402%28v=vs.85%29.aspx']
---
name: WindowsWinlogonUserinit
doc: Windows Winlogon Userinit.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Userinit'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Userinit'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939862.aspx']
---
name: WindowsWinlogonShell
doc: Windows shell replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Shell'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Shell'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/ms838576%28v=winembedded.5%29.aspx']
---
name: WindowsWinlogonSystem
doc: Applications launched by Winlogon in the system context during the system initialisation.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'System'}
supported_os: [Windows]
urls:
- 'https://code.google.com/p/regripper/wiki/ASEPs'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
---
name: WindowsAppInit
doc: Windows AppInit persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
supported_os: [Windows]
urls: ['http://support.microsoft.com/en-us/kb/197571']
---
name: WindowsUpdateStatus
doc: Windows auto update status.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect', value: 'LastSuccessTime'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download', value: 'LastSuccessTime'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install', value: 'LastSuccessTime'}
supported_os: [Windows]
urls: ['http://forensicswiki.org/wiki/Windows_Update']
---
name: WinRARExternalViewer
doc: Executable run when a file is opened by WinRAR inside an archive.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_USERS\%%users.sid%%\Software\WinRAR\Viewer\', value: 'ExternalViewer'}]}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2012/09/16/beyond-good-ol-run-key-part-2/'
- 'http://acritum.com/software/manuals/winrar/html/helpinterfaceviewing.htm'
---
name: WinRARAVScan
doc: Executable run to scan a file when it is opened by WinRAR.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_USERS\%%users.sid%%\Software\WinRAR\VirusScan\', value: 'Name'}]}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2012/09/16/beyond-good-ol-run-key-part-2/'
- 'http://acritum.com/software/manuals/winrar/html/helpcommandsvirusscan.htm'
---
name: WMILoggedOnSessions
doc: Logged on users queried from WMI.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_LogonSession}
supported_os: [Windows]
---
name: WMILoggedOnUsers
doc: Logged on users queried from WMI.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_LoggedonUser}
supported_os: [Windows]
---
name: WMIServices
doc: Services queried from WMI.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_Service}
supported_os: [Windows]
---
name: WinAppXRT
doc: WinAppXRT DLL loaded by .Net applications when the APPX_PROCESS environment variable is set.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\system32\WinAppXRT.dll'
    - '%%environ_systemroot%%\WinAppXRT.dll'
    - '%%environ_systemroot%%\System32\Wbem\WinAppXRT.dll'
    - '%%environ_systemroot%%\\System32\WindowsPowerShell\v1.0\WinAppXRT.dll'
supported_os: [Windows]
conditions: [os_major_version >= 6 AND os_minor_version >= 2]
urls: ['http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/']
---
name: WindowsAutoexecBat
doc: Windows autoexec.bat file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\autoexec.bat'
      - '%%environ_windir%%\autoexec.nt'
    separator: '\'
supported_os: [Windows]
---
name: WindowsConfigSys
doc: Windows config.sys file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\config.sys'
      - '%%environ_windir%%\config.nt'
    separator: '\'
supported_os: [Windows]
---
name: WindowsGroupPolicyScripts
doc: Windows group policy scripts
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\GroupPolicy\User\Scripts\scripts.ini'
    separator: '\'
supported_os: [Windows]
---
name: WindowsShellHandlersRegistryKeys
doc: |
  Windows registry values for shell handler artifacts.

  ContextMenuHandlers are added to right-click menus.
  CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
  settings to trigger on these actions.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\CopyHookHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\DragDropHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\CopyHookHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\DragDropHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\ColumnHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\CopyHookHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\DragDropHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\CopyHookHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\DragDropHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Folder\ShellEx\ColumnHandlers\*'
supported_os: [Windows]
urls:
  - 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
  - 'http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm'
  - 'http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r'
---
name: WindowsWinstart
doc: Windows winstart.bat file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_windir%%\winstart.bat'
      - '%%environ_windir%%\dosstart.bat'
    separator: '\'
supported_os: [Windows]
---
name: WindowsIniFiles
doc: Windows ini file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\system.ini'
      - '%%environ_windir%%\win.ini'
      - '%%environ_windir%%\wininit.ini'
    separator: '\'
supported_os: [Windows]
---
name: WindowsSessionManagerSetupExecute
doc: Windows Session Manager SetupExecute persistence
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'SetupExecute'}]
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/dd392286%28v=vs.85%29.aspx']
---
name: WindowsSessionManagerExecute
doc: Windows Session Manager Execute persistence
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'Execute'}]
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc976130.aspx']
---
name: WindowsNetshHelpers
doc: Windows Netsh helpers are loaded on boot
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Netsh'
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/242468']
---
name: WindowsPendingFileRenames
doc: Windows Pending file renames on reboot
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'PendingFileRenameOperations'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc960241.aspx']
---
name: WindowsMSDTCDLLs
doc: Windows MSDTC attempts to load these DLLs on start
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI\*'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\MSDTC\MTxOCI\*'
supported_os: [Windows]
urls: ['https://www.mandiant.com/blog/hikit-rootkit-advanced-persistent-attack-techniques-part-1-2/']
---
name: WindowsTerminalServerRunKeys
doc: Windows Terminal Server Run Keys
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
supported_os: [Windows]
urls: ['http://gladiator-antivirus.com/forum/index.php?showtopic=24610']
---
name: WindowsWinlogonMSGina
doc: Windows Winlogon MSGina
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'GinaDll'}
      - {key: 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'GinaDll'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinlogonTaskman
doc: Windows Winlogon Taskman
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Taskman'}
      - {key: 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Taskman'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsPolicyShell
doc: Windows shell replacement
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'Shell'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'Shell'}
supported_os: [Windows]
---
name: WindowsProgManRunKeys
doc: Windows Legacy shell run keys
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'load'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'load'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'run'}<commit_msg>Update windows.yaml<commit_after># Windows specific artifacts.

name: AppCompatCache
doc: Windows Application Compatibility Cache
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility', value: 'AppCompatCache'}
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache', value: 'AppCompatCache'}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/blob/master/documentation/Application%20Compatibility%20Cache%20key.asciidoc']
---
name: WindowsActiveDesktop
doc: Windows Active Desktop executable paths, used for persistence.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Desktop\Components\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Internet Explorer\Desktop\General'
conditions: [os_major_version < 6]
supported_os: [Windows]
urls:
- 'https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~DwnLdr-GWV/detailed-analysis.aspx'
- 'https://support.microsoft.com/en-us/kb/929200'
- 'https://en.wikipedia.org/wiki/Active_Desktop'
---
name: ApplicationEventLog
doc: Windows Application Event log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\AppEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: ApplicationEventLogEvtx
doc: Windows Application Event log for Vista or later systems.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Application.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: ApplicationRegistration
doc: Application Registration (AppPath) registry keys.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
    - 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\*'
    - 'HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\*'
supported_os: [Windows]
urls:
  - 'https://github.com/keydet89/RegRipper2.8/blob/master/plugins/apppaths.pl'
  - 'http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/'
  - 'https://msdn.microsoft.com/en-us/library/windows/desktop/ee872121(v=vs.85).aspx'
---
name: APPX_PROCESSEnvironmentVariable
doc: |
  APPX_PROCESS environment variable. If this variable is set, .NET applications will attempt to load WinAppXRT.dll
  from PATH, which is a potential persistence mechanism.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'APPX_PROCESS'}
supported_os: [Windows]
conditions: [os_major_version >= 6 AND os_minor_version >= 2]
urls: ['http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/']
---
name: AvailableTimeZones
doc: The timezones available on the system.
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\*\*']}
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Time-zone-keys']
---
name: BITSQueueManagerDatabases
doc: Databases that control BITS job specs and state.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_allusersprofile%%\Microsoft\Network\Downloader\qmgr*.dat'
supported_os: [Windows]
urls: ['http://dfrws.org/2015/proceedings/presentations/DFRWS2015-pres3.pdf']
---
name: EnvironmentUserLoginScripts
doc: User login scripts configured via environment variables.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
        - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitLogonServer'}
        - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserInitLogonScript'}
        - {key: 'HKEY_USERS\%%users.sid%%\Environment', value: 'UserMprLogonScript'}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/'
- 'https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/cb6f1d6f-60a6-4369-803e-ec03d902e638/gina-how-to-run-domain-scripts-after-logon'
---
name: EventLogs
doc: Windows Event logs.
sources:
- type: ARTIFACT
  attributes:
    names:
      - 'ApplicationEventLog'
      - 'ApplicationEventLogEvtx'
      - 'SecurityEventLog'
      - 'SecurityEventLogEvtx'
      - 'SystemEventLog'
      - 'SystemEventLogEvtx'
labels: [Logs]
supported_os: [Windows]
---
name: FileTypeAutorunAssociations
doc: Registry value for what application class identifier (CLSID) to launch for a file extension.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\software\classes\*'
      - 'HKEY_USERS\%%users.sid%%\software\classes\*'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/ms678415(v=vs.85).aspx']
---
name: MFTFiles
doc: |
  $MFT and $MFTMirr files.

  GRR collection note: you currently need to specify 'use tsk' and
  'ignore download size limits' for this artifact to work. This will go away in
  the future.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\$MFT'
      - '%%environ_systemdrive%%\$MFTMirr'
    separator: '\'
labels: [System]
supported_os: [Windows]
---
name: MostRecentApplication
doc: Most Recent Application name key
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\*\MostRecentApplication', value: 'Name'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\*\MostRecentApplication', value: 'Name'}
supported_os: [Windows]
urls:
- 'http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_ransom.smc7'
- 'https://www.symantec.com/security_response/writeup.jsp?docid=2014-092314-3644-99&tabid=2'
---
name: PowerShellEnableScripts
doc: Registry keys that control whether PowerShell scripts can execute directly.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\PowerShell', value: 'EnableScripts'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell', value: 'EnableScripts'}
  supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/library/hh847748.aspx'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: PowerShellExecutionPolicies
doc: Powershell Script Execution Policies for all users, and the system.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Policies\Microsoft\Windows\PowerShell', value: 'ExecutionPolicy'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell', value: 'ExecutionPolicy'}
  supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/library/hh847748.aspx'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: PowershellDefaultProfiles
doc: Default PowerShell Profile files. These files are executed by default when Powershell starts up.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\system32\Windows­PowerShell\v1.0\profile.ps1'
      - '%%environ_systemroot%%\system32\Windows­PowerShell\v1.0\Microsoft.PowerShell_profile.ps1'
      - '%%users.homedir%%\Documents\WindowsPowerShell\profile.ps1'
      - '%%users.homedir%%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1'
  supported_os: [Windows]
urls:
- 'https://technet.microsoft.com/en-us/magazine/2008.10.windowspowershell.aspx#id0190010'
- 'http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/'
---
name: PrefetchFiles
doc: Windows Prefetch files.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\Prefetch\*.pf']
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Prefetch']
---
name: ProgramsCache
doc: Windows Programs Cache
sources:
- type: REGISTRY_KEY
  attributes: {keys: ['HKEY_USERS\\%%users.sid%%\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\RunGrpConv']}
supported_os: [Windows]
conditions: [os_major_version <= 5]
urls:
- 'http://www.hexacorn.com/blog/2014/06/18/beyond-good-ol-run-key-part-13/'
- 'http://www.exploit-id.com/local-exploits/windows-xp-sp2-grpconv-exe'
---
name: ScheduledTasks
doc: Windows Scheduled Tasks.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\Tasks\**10'
      - '%%environ_systemroot%%\System32\Tasks\**10'
      - '%%environ_systemroot%%\SysWow64\Tasks\**10'
    separator: '\'
supported_os: [Windows]
urls: ['http://forensicswiki.org/wiki/Windows#Scheduled_Tasks']
---
name: SecurityEventLog
doc: Windows Security Event log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\SecEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: SecurityEventLogEvtx
doc: Windows Security Event log for Vista or later systems.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Security.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: SetupApiLogs
doc: Windows setup API logs.
sources:
- type: FILE
  attributes: {paths: ['%%environ_systemroot%%\setupapi.log']}
  conditions: [os_major_version < 6]
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\inf\setupapi.app.log'
      - '%%environ_systemroot%%\inf\setupapi.dev.log'
      - '%%environ_systemroot%%\inf\setupapi.offline.log'
    separator: '\'
  conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Setup_API_Logs']
---
name: SuperFetchFiles
doc: Windows SuperFetch files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\Prefetch\Ag*.db'
      - '%%environ_systemroot%%\Prefetch\Ag*.db.trx'
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/SuperFetch']
---
name: SystemEventLog
doc: Windows System Event log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\SysEvent.evt']
    separator: '\'
conditions: [os_major_version < 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Event_Log_(EVT)']
---
name: SystemEventLogEvtx
doc: Windows System Event log for Vista or later systems.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\System.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: TerminalServicesEventLogEvtx
doc: Windows TerminalServices Event log.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemroot%%\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx']
    separator: '\'
conditions: [os_major_version >= 6]
labels: [Logs]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
---
name: WindowsHostsFiles
doc: The Windows hosts and lmhosts file.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\Drivers\etc\Lmhosts'
      - '%%environ_systemroot%%\System32\Drivers\etc\hosts'
    separator: '\'
supported_os: [Windows]
---
name: WindowsPersistenceMechanisms
doc: Persistence mechanisms in Windows.
sources:
- type: ARTIFACT
  attributes:
    names:
      - WindowsRunKeys
      - WindowsServices
  returned_types: [PersistenceFile]
labels: [Software]
supported_os: [Windows]
---
name: WindowsRecycleBin
doc: Windows Recycle Bin (Recyler, $Recycle.Bin) files.
sources:
- type: FILE
  attributes:
    paths:
      - '\$Recycle.Bin\**'
      - '\Recycler\**'
    separator: '\'
labels: [Users]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows#Recycle_Bin']
---
name: WindowsRunKeys
doc: |
  Windows Run and RunOnce keys.

  Note users.sid will currently only expand to SIDs with profiles
  on the system, not all SIDs.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\*'
labels: [Software]
supported_os: [Windows]
urls:
  - 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx'
  - 'https://support.microsoft.com/en-us/kb/137367'
  - 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
---
name: WindowsSearchDatabase
doc: Windows Search database (Windows.edb).
sources:
- type: FILE
  attributes:
    paths: ['%%environ_allusersappdata%%\Microsoft\Search\Data\Applications\Windows\Windows.edb']
    separator: '\'
labels: [Software]
supported_os: [Windows]
urls: ['http://www.forensicswiki.org/wiki/Windows_Desktop_Search']
---
name: WindowsServices
doc: Windows services from the Registry.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - '%%current_control_set%%\services\*\*'
      - '%%current_control_set%%\services\*\Parameters\*'
labels: [Software]
supported_os: [Windows]
urls:
  - 'http://support.microsoft.com/kb/103000'
  - 'https://github.com/libyal/winreg-kb/wiki/System-keys'
---
name: WindowsSystemRegistryFiles
doc: Windows system Registry files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\config\SAM'
      - '%%environ_systemroot%%\System32\config\SECURITY'
      - '%%environ_systemroot%%\System32\config\SOFTWARE'
      - '%%environ_systemroot%%\System32\config\SYSTEM'
      - '\System Volume Information\Syscache.hve'
    separator: '\'
labels: [System]
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Registry-files']
---
name: WindowsUserRecentFiles
doc: Windows user specific recent files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.appdata%%\Roaming\Microsoft\Office\Recent\*'
      - '%%users.appdata%%\Roaming\Microsoft\Windows\Recent\*'
    separator: '\'
labels: [Users]
supported_os: [Windows]
---
name: WindowsUserRegistryFiles
doc: Windows user specific Registry files.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%\NTUSER.DAT'
      - '%%users.homedir%%\NTUSER.MAN'
      - '%%users.localappdata%%\Microsoft\Windows\UsrClass.dat'
    separator: '\'
labels: [Users]
supported_os: [Windows]
urls: ['https://github.com/libyal/winreg-kb/wiki/Registry-files']
---
name: WMIComputerSystemProduct
doc: Computer System Product including Identifiying number queried from WMI.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_ComputerSystemProduct}
labels: [System]
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/aa394105(v=vs.85).aspx']
---
name: WMIDrivers
doc: Installed drivers via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: 'SELECT DisplayName, Description, InstallDate, Name, PathName, Status,
      State, ServiceType from Win32_SystemDriver'}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMIEnumerateASEC
doc: Enumerate instances of ActiveScriptEventConsumer.
sources:
- type: WMI
  attributes: {query: SELECT * FROM ActiveScriptEventConsumer, base_object: 'winmgmts:\root\subscription'}
supported_os: [Windows]
---
name: WMIEnumerateCLEC
doc: Enumerate instances of CommandLineEventConsumer.
sources:
- type: WMI
  attributes: {query: SELECT * FROM CommandLineEventConsumer, base_object: 'winmgmts:\root\subscription'}
supported_os: [Windows]
---
name: WMIHotFixes
doc: Installed hotfixes via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: SELECT * from Win32_QuickFixEngineering}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMIInstalledSoftware
doc: Installed software via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: 'SELECT Name, Vendor, Description, InstallDate, InstallDate2, Version
      from Win32_Product'}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMILogicalDisks
doc: Disk information via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_LogicalDisk}
labels: [System]
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/aa394173(v=vs.85).aspx']
---
name: WMILoginUsers
doc: |
  Login Users via Windows Management Instrumentation (WMI).

  This WMI query may take a long time to complete when run on a domain and
  will create load on a domain controller.
sources:
- type: WMI
  attributes: {query: SELECT * from Win32_GroupUser where Name = "login_users"}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMIPhysicalMemory
doc: Physical memory information via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: SELECT * from Win32_PhysicalMemory}
conditions: [os_major_version >= 6]
labels: [System]
supported_os: [Windows]
urls: ["http://msdn.microsoft.com/en-us/library/aa394347%28v=vs.85%29.aspx"]
---
name: WMIProcessList
doc: Process listing via Windows Management Instrumentation (WMI).
sources:
- type: WMI
  attributes: {query: SELECT * from Win32_Process}
conditions: [os_major_version >= 6]
labels: [Software]
supported_os: [Windows]
---
name: WMIUsers
doc: |
  Users via Windows Management Instrumentation (WMI).

  Note that in a domain setup, this will probably return all users in the
  domain which will be expensive and slow. Consider limiting by SID like
  WMIProfileUsersHomeDir.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_UserAccount}
labels: [Users]
supported_os: [Windows]
urls: ['http://msdn.microsoft.com/en-us/library/windows/desktop/aa394507(v=vs.85).aspx']
---
name: WindowsHotkeyReplacement
doc: Hotkey executable replacement.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\System32\sethc.exe'
      - '%%environ_systemroot%%\System32\utilman.exe'
      - '%%environ_systemroot%%\System32\magnifier.exe'
    separator: '\'
supported_os: [Windows]
---
name: WindowsAutorun
doc: Filebased Tests.
sources:
- type: FILE
  attributes:
    paths: ['%%environ_systemdrive%%\autorun.inf']
    separator: '\'
supported_os: [Windows]
---
name: WindowsCommonFilePlacementAttacks
doc: Common files associated with search order hijacking and other file placement attacks.
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\program.exe'
      - '%%environ_systemdrive%%\explorer.exe'
      - '%%environ_systemroot%%\System32\oci.dll'
      - '%%environ_systemroot%%\SysWOW64\oci.dll'
      - '%%environ_systemroot%%\linkinfo.dll'
      - '%%environ_systemroot%%\ntshrui.dll'
      - '%%environ_systemroot%%\System32\sysprep\cryptbase.dll'
      - '%%environ_systemroot%%\SysWOW64\sysprep\cryptbase.dll'
      - '%%environ_programfiles%%\Internet Explorer\sxs.dll'
      - '%%environ_programfilesx86%%\Internet Explorer\sxs.dll'
    separator: '\'
supported_os: [Windows]
urls:
- 'http://web.cs.ucdavis.edu/~su/publications/issta10-loading.pdf'
- 'https://www.mandiant.com/blog/fxsst/'
---
name: WindowsStartupFolders
doc: Windows startup folder persistence.
sources:
- type: FILE
  attributes:
    paths:
      - '%%users.homedir%%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*'
      - '%%environ_allusersprofile%%\Microsoft\Windows\Start Menu\Programs\Startup\*'
    separator: '\'
supported_os: [Windows]
---
name: WindowsStubPaths
doc: Windows StubPath persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Active Setup\Installed Components\*', value: 'StubPath'}
supported_os: [Windows]
urls: ['http://blogs.msdn.com/b/aruns_blog/archive/2011/06/20/active-setup-registry-key-what-it-is-and-how-to-create-in-the-package-using-admin-studio-install-shield.aspx']
---
name: WindowsBootExecute
doc: Windows BootExecute persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'BootExecute'}]
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc963230.aspx']
---
name: WindowsExcludeFromKnownDlls
doc: ExcludeFromKnownDlls can be used to bypass search order hijacking protection.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'ExcludeFromKnownDlls'}]
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586%28v=vs.85%29.aspx']
---
name: WindowsLSASecurityPackages
doc: CurrentControlSet Security Packages can be injected into LSASS.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa', value: 'Security Packages'}
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig', value: 'Security Packages'}
supported_os: [Windows]
urls:
  - 'https://msdn.microsoft.com/en-us/library/windows/desktop/aa379392(v=vs.85).aspx'
  - 'https://dl.mandiant.com/EE/library/MIRcon2014/MIRcon_2014_IR_Track_Analysis_of_Malicious_SSP.pdf'
---
name: WindowsAppCertDlls
doc: Windows AppCertDlls persistence.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: ['HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls']
supported_os: [Windows]
urls: ['http://blogs.technet.com/b/mmpc/archive/2011/03/19/how-to-defang-the-fake-defragmenter.aspx']
---
name: WindowsStartupFolderModification
doc: Windows startup folder Registry values.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', value: 'Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Common Startup'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders', value: 'Startup'}
supported_os: [Windows]
---
name: WindowsShellExecuteHooks
doc: Shell execution hooks are called when ShellExecuteEx() is called.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*'
      - 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\*'
supported_os: [Windows]
urls:
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
- 'https://code.google.com/p/regripper/wiki/ASEPs'
---
name: WindowsDebugger
doc: Windows Debugger peristence or AV disable.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
      - {key: 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*', value: 'Debugger'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/a329t4ed%28VS.71%29.aspx']
---
name: WindowsRunServices
doc: Windows Run Services.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\*'
      - 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\RunServices\*'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx']
---
name: WindowsWinlogonNotify
doc: Windows Winlogon Notify.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify'
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/aa379402%28v=vs.85%29.aspx']
---
name: WindowsWinlogonUserinit
doc: Windows Winlogon Userinit.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Userinit'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Userinit'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939862.aspx']
---
name: WindowsWinlogonShell
doc: Windows shell replacement.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Shell'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Shell'}
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/ms838576%28v=winembedded.5%29.aspx']
---
name: WindowsWinlogonSystem
doc: Applications launched by Winlogon in the system context during the system initialisation.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'System'}
supported_os: [Windows]
urls:
- 'https://code.google.com/p/regripper/wiki/ASEPs'
- 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
- 'http://regenerus.com/malware-common-loadpoints/'
---
name: WindowsAppInit
doc: Windows AppInit persistence.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'AppInit_DLLs'}
supported_os: [Windows]
urls: ['http://support.microsoft.com/en-us/kb/197571']
---
name: WindowsUpdateStatus
doc: Windows auto update status.
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect', value: 'LastSuccessTime'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download', value: 'LastSuccessTime'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install', value: 'LastError'}
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install', value: 'LastSuccessTime'}
supported_os: [Windows]
urls: ['http://forensicswiki.org/wiki/Windows_Update']
---
name: WinRARExternalViewer
doc: Executable run when a file is opened by WinRAR inside an archive.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_USERS\%%users.sid%%\Software\WinRAR\Viewer\', value: 'ExternalViewer'}]}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2012/09/16/beyond-good-ol-run-key-part-2/'
- 'http://acritum.com/software/manuals/winrar/html/helpinterfaceviewing.htm'
---
name: WinRARAVScan
doc: Executable run to scan a file when it is opened by WinRAR.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_USERS\%%users.sid%%\Software\WinRAR\VirusScan\', value: 'Name'}]}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2012/09/16/beyond-good-ol-run-key-part-2/'
- 'http://acritum.com/software/manuals/winrar/html/helpcommandsvirusscan.htm'
---
name: WMILoggedOnSessions
doc: Logged on users queried from WMI.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_LogonSession}
supported_os: [Windows]
---
name: WMILoggedOnUsers
doc: Logged on users queried from WMI.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_LoggedonUser}
supported_os: [Windows]
---
name: WMIServices
doc: Services queried from WMI.
sources:
- type: WMI
  attributes: {query: SELECT * FROM Win32_Service}
supported_os: [Windows]
---
name: WinAppXRT
doc: WinAppXRT DLL loaded by .Net applications when the APPX_PROCESS environment variable is set.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_systemroot%%\system32\WinAppXRT.dll'
    - '%%environ_systemroot%%\WinAppXRT.dll'
    - '%%environ_systemroot%%\System32\Wbem\WinAppXRT.dll'
    - '%%environ_systemroot%%\\System32\WindowsPowerShell\v1.0\WinAppXRT.dll'
supported_os: [Windows]
conditions: [os_major_version >= 6 AND os_minor_version >= 2]
urls: ['http://www.hexacorn.com/blog/2014/08/31/beyond-good-ol-run-key-part-17/']
---
name: WindowsAutoexecBat
doc: Windows autoexec.bat file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\autoexec.bat'
      - '%%environ_windir%%\autoexec.nt'
    separator: '\'
supported_os: [Windows]
---
name: WindowsConfigSys
doc: Windows config.sys file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\config.sys'
      - '%%environ_windir%%\config.nt'
    separator: '\'
supported_os: [Windows]
---
name: WindowsGroupPolicyScripts
doc: Windows group policy scripts
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemroot%%\GroupPolicy\User\Scripts\scripts.ini'
    separator: '\'
supported_os: [Windows]
---
name: WindowsShellHandlersRegistryKeys
doc: |
  Windows registry values for shell handler artifacts.

  ContextMenuHandlers are added to right-click menus.
  CopyHookHandlers, DragDropHandlers, and ColumnHandlers are similar contextual
  settings to trigger on these actions.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\CopyHookHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\DragDropHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\CopyHookHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\DragDropHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\ColumnHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\CopyHookHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\DragDropHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Directory\Background\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\ContextMenuHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\CopyHookHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\DragDropHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\*\ShellEx\PropertySheetHandlers\*'
      - 'HKEY_USERS\%%users.sid%%\Software\Classes\Folder\ShellEx\ColumnHandlers\*'
supported_os: [Windows]
urls:
  - 'http://gladiator-antivirus.com/forum/index.php?showtopic=24610'
  - 'http://www.codeguru.com/cpp/com-tech/shell/article.php/c4515/Logging-the-Shell-Activity.htm'
  - 'http://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_qoolaid.r'
---
name: WindowsWinstart
doc: Windows winstart.bat file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_windir%%\winstart.bat'
      - '%%environ_windir%%\dosstart.bat'
    separator: '\'
supported_os: [Windows]
---
name: WindowsIniFiles
doc: Windows ini file
sources:
- type: FILE
  attributes:
    paths:
      - '%%environ_systemdrive%%\system.ini'
      - '%%environ_windir%%\win.ini'
      - '%%environ_windir%%\wininit.ini'
    separator: '\'
supported_os: [Windows]
---
name: WindowsSessionManagerSetupExecute
doc: Windows Session Manager SetupExecute persistence
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'SetupExecute'}]
supported_os: [Windows]
urls: ['https://msdn.microsoft.com/en-us/library/windows/desktop/dd392286%28v=vs.85%29.aspx']
---
name: WindowsSessionManagerExecute
doc: Windows Session Manager Execute persistence
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs: [{key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'Execute'}]
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc976130.aspx']
---
name: WindowsNetshHelpers
doc: Windows Netsh helpers are loaded on boot
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Netsh'
supported_os: [Windows]
urls: ['https://support.microsoft.com/en-us/kb/242468']
---
name: WindowsPendingFileRenames
doc: Windows Pending file renames on reboot
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager', value: 'PendingFileRenameOperations'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc960241.aspx']
---
name: WindowsMSDTCDLLs
doc: Windows MSDTC attempts to load these DLLs on start
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI\*'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\MSDTC\MTxOCI\*'
supported_os: [Windows]
urls: ['https://www.mandiant.com/blog/hikit-rootkit-advanced-persistent-attack-techniques-part-1-2/']
---
name: WindowsTerminalServerRunKeys
doc: Windows Terminal Server Run Keys
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
      - 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce\*'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx\*'
      - 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\*'
supported_os: [Windows]
urls: ['http://gladiator-antivirus.com/forum/index.php?showtopic=24610']
---
name: WindowsWinlogonMSGina
doc: Windows Winlogon MSGina
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'GinaDll'}
      - {key: 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'GinaDll'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsWinlogonTaskman
doc: Windows Winlogon Taskman
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Taskman'}
      - {key: 'HKEY_USERS\%%users.sid%%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', value: 'Taskman'}
supported_os: [Windows]
urls: ['https://technet.microsoft.com/en-us/library/cc939701.aspx']
---
name: WindowsPolicyDisallowRun
doc: |
  Restrict users from running specific applications.
  Typically used by malware to block AV application.
sources:
- type: REGISTRY_KEY
  attributes:
    keys:
      - 'HKEY_USERS\%%users.sid%%\software\microsoft\windows\currentversion\policies\explorer\DisallowRun'
labels: [Software]
supported_os: [Windows]
urls:
- 'https://support.microsoft.com/en-us/kb/323525'
---
name: WindowsPolicyShell
doc: Windows shell replacement
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'Shell'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System', value: 'Shell'}
supported_os: [Windows]
---
name: WindowsProgManRunKeys
doc: Windows Legacy shell run keys
sources:
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'load'}
      - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'load'}
      - {key: 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows', value: 'run'}
{'fraction_non_alphanumeric': 0.14198968349358973, 'fraction_numerical': 0.015099158653846154, 'mean_word_length': 4.61457893996907, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 33, 'https://': 75, 'lorem ipsum': 0, 'www.': 60, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 8, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3591753', 'n_tokens_mistral': 28398, 'n_tokens_neox': 26966, 'n_words': 4655}