UserAssist

1. Introduction

UserAssist artifacts are Windows components that record programs and items executed by the user in the graphical interface (GUI). Windows stores this information inside ROT13-encoded registry keys.

UserAssist reveals:

• Which programs were opened

• How many times they were executed (count)

• The last time the execution occurred (timestamp)

• Full paths of executables

• Items executed via Explorer, Start Menu, Control Panel, etc.

Storage Location

Inside NTUSER.DAT:

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

• Each GUID represents a different monitoring category (varies by Windows version).

• Entry names are stored in ROT13 and must be decoded.

---

2. Tools

RegRipper (userassist plugin)

Command-line tool that extracts:

• Program name (decoded)

• Path

• Execution count

• Last execution timestamp

Useful for fast automation and reporting.

Registry Explorer (Eric Zimmerman)

GUI tool for advanced registry analysis:

• Automatically decodes ROT13

• Displays complete metadata

• Allows navigating the NTUSER.DAT tree

• Shows timestamps with FILETIME precision

---

3. Practical Example: How to Analyze UserAssist

Obtain the NTUSER.DAT hive

• Extract it from the user’s profile:

C:\Users\<user>\NTUSER.DAT

---

Method 1: UserAssist using RegRipper

Command:

rip.exe -r NTUSER.DAT -p userassist_tln

Typical Output:

• Executable name (decoded)

• Full program path

• LastExecutionTime

• Execution Count

Interpretation:

• Persistence or malicious activity may appear as repeated execution of specific tools.

• Suspicious tools will show recent execution timestamps.

Example:

C:\Users\User\Downloads\mimikatz.exe
Last executed: 2025-01-14 23:41:12
Count: 3

---

Method 2: UserAssist using Registry Explorer

1. Open Registry Explorer

2. File > Load hive > select NTUSER.DAT

3. Navigate to:

   Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

4. Click on the GUID, then open Count

You will see:

• A decoded list of programs, shortcuts, or items

• Fields such as:

  • Path

  • Count

  • Last Execution Time

  • Item type (exe, lnk, control panel item, shell item, etc.)

Practical Example:

If you see:

Item: C:\Windows\System32\cmd.exe
Count: 89
Last Execution: 2025-02-10 16:22:10

This indicates heavy use of cmd.exe, which may suggest:

• Advanced manual activity

• Repeated command execution

• Script or batch file usage