UserAssist

Source: GitHub Author: unknown URL: https://github.com/MHaggis/PowerShell-Hunter/tree/main/UserAssist

  1. ONE SENTENCE SUMMARY: The UserAssist Registry Analyzer is a forensic PowerShell tool that extracts and decodes Windows UserAssist registry data to reveal user activity.

  2. MAIN POINTS:

  3. UserAssist keys track application execution, usage frequency, and timestamps for digital forensic investigations.

  4. Located in the registry under HKEY_CURRENT_USER with specific GUIDs for different execution types.

  5. Entries use ROT13 encoding and contain binary data like session ID, run count, and focus time.

  6. Compatible with Windows 7 through 11, automatically handling version-specific structure differences.

  7. No installation required; script runs with PowerShell 5.1+ and administrator privileges.

  8. Outputs data in JSON, CSV, and HTML formats for flexibility in analysis and reporting.

  9. Extracted data includes decoded application names, run frequency, and last execution timestamps.

  10. Useful for reconstructing user timelines, detecting unusual behavior, and identifying anti-forensics attempts.

  11. Integrates with other forensic tools like Prefetch, Event Logs, Jump Lists, and BAM/DAM data.

  12. Part of the PowerShell-Hunter project, designed for defenders conducting Windows forensic analysis.

  13. TAKEAWAYS:

  14. UserAssist keys are crucial for proving and analyzing program execution on Windows systems.

  15. The analyzer simplifies decoding ROT13-obfuscated registry entries into readable user activity data.

  16. Data export options make it easy to visualize and correlate findings with other forensic artifacts.

  17. Effective in uncovering tampering, hidden activity, or suspicious application usage.

  18. Streamlines incident response and forensic workflows by automating registry data extraction and analysis.