Windows Registry

The hives, the keys that matter for triage, and the reg.exe / PowerShell to read them — a defender's map of where configuration and persistence live. Click any command or key to copy it.

Start here

Hives & structure

The registry is a tree of keys (folders) and values (name → data, with a type). Five root hives; the two you live in are HKLM (machine-wide) and HKCU (the current user). Each persistent hive is backed by a file on disk — that's what you pull for offline forensics.

HKLMHKEY_LOCAL_MACHINE — machine-wide settings, services, and software. System-level config and persistence live here; changing it needs admin.
HKCUHKEY_CURRENT_USER — the logged-on user's settings. Really a link into HKU\<SID>; per-user persistence runs from here without admin.
HKUHKEY_USERS — every loaded user profile by SID, including .DEFAULT. Where you look at another user's Run keys.
HKCRHKEY_CLASSES_ROOT — file associations and COM classes (a merge of HKLM and HKCU \Software\Classes). Home of shell-open and COM hijacks.
HKLM\SYSTEM\CurrentControlSetThe live hardware/service control set — a pointer to the active ControlSet00x. Services and drivers live under here.
Value typesREG_SZ string · REG_EXPAND_SZ string with %vars% · REG_DWORD/REG_QWORD numbers · REG_BINARY raw · REG_MULTI_SZ list.
Hive files · %SystemRoot%\System32\configSYSTEM, SOFTWARE, SAM, SECURITY on disk. Per-user is NTUSER.DAT (profile root) and UsrClass.dat (AppData\...\Windows). Locked while running — grab via VSS / forensic image.

Core

reg.exe

The built-in CLI. query to read, export to preserve, load to mount an offline hive.

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"Read a key's values. The staple — point it at any persistence path below.
reg query HKCU /f "password" /t REG_SZ /sRecursive search (/s) for a string (/f) — hunt secrets or an IOC string across a hive.
reg query "HKLM\...\Run" /v Updater/v reads one named value; /ve reads the key's default value.
reg export "HKLM\...\Run" run.regSave a key (and children) to a .reg file — preserve evidence before you touch anything.
reg save HKLM\SYSTEM system.hivSave a live hive to a raw file (needs the backup privilege). reg save HKLM\SAM is a known credential-theft move — watch for it.
reg load HKLM\Tmp C:\mnt\Users\x\NTUSER.DATMount an offline hive from an image under a temp key, then query it like any other. reg unload when done.
reg add "HKCU\...\Run" /v X /t REG_SZ /d "c:\x.exe" /fWrite a value (/f = no prompt). Shown so you recognize the attack — this is how a Run-key implant is dropped.
reg delete "HKCU\...\Run" /v X /fRemove a value — remediation, or an attacker cleaning up. Export first.

Core

PowerShell

Registry hives are drives (HKLM:, HKCU:). Richer output and scripting than reg.exe.

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"All values of a key as object properties — the readable way to dump Run keys.
Get-ChildItem "HKLM:\...\Services" | Select NameList subkeys (each service is a subkey). Get-ChildItem = the keys, Get-ItemProperty = the values.
Get-ItemPropertyValue "HKLM:\...\Run" -Name UpdaterRead one value's data directly.
Get-ChildItem HKU:\ HKU: isn't mapped by default — New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS first, then enumerate every user's hive.
Get-ChildItem "HKLM:\...\Run" | Get-ItemPropertyPipe keys into property reads to sweep many persistence locations at once.
reg.exe HKLM, Get-ItemProperty HKLM:Note the syntax: reg.exe uses HKLM\... (backslash, no colon); PowerShell uses HKLM:\... (colon). Mixing them is the usual typo.

Persistence

Autostart keys — check these first

The classic run-at-logon / run-at-boot values. Enumerate HKLM and every user's HKCU. Tools like Autoruns and Sysmon (Event 13, RegistryValueSet) cover these — these are the paths behind them.

...\CurrentVersion\RunRuns at logon. Exists under both HKLM\Software\Microsoft\Windows and HKCU\Software\Microsoft\Windows. The #1 persistence spot — read both.
...\CurrentVersion\RunOnceRuns once at next logon then deletes itself. HKLM and HKCU. Good for a one-shot payload that leaves little trace.
...\Policies\Explorer\RunA second Run location under Policies — often missed because it's not the obvious path.
...\Wow6432Node\...\RunThe 32-bit view of Run/RunOnce on a 64-bit host. Don't forget the Wow6432Node mirrors — a 32-bit implant hides here.
...\Winlogon\UserinitShould be exactly C:\Windows\system32\userinit.exe,. Anything appended after the comma runs at logon — a favorite hijack.
...\Winlogon\ShellShould be exactly explorer.exe. An extra binary here launches alongside the shell at every logon.
...\Winlogon\NotifyLegacy notification-package DLLs loaded by Winlogon — abused for DLL-based persistence on older systems.
HKLM\...\Windows\CurrentVersion\RunServicesRunServices / RunServicesOnce — older service-style autostart, still worth a glance.

Shorthand to remember: Run, RunOnce, and the Policies\Explorer\Run variant, each in HKLM, HKCU, and their Wow6432Node mirrors — that's the first sweep. Then Winlogon's Userinit and Shell.

Persistence

Stealthier spots

Where persistence hides when the Run keys are clean. Each has a legitimate purpose, so read the value, not just its presence.

HKLM\SYSTEM\CurrentControlSet\ServicesEvery service and driver. ImagePath is the binary, Start the mode (0/1 = boot/system driver, 2 = auto). A service pointing at a user-writable path or an odd binary is persistence. Pairs with the net and wmic sheets.
...\Image File Execution Options\<exe>\DebuggerA Debugger value makes Windows launch your binary instead of the named exe. Classic "sethc.exe → cmd.exe" sticky-keys / accessibility hijack.
...\Image File Execution Options\...\GlobalFlagPaired with SilentProcessExit keys to run a payload when a watched process exits — a sneaky trigger.
HKCU\Software\Classes\<ext>\shell\open\commandFile-association / shell-open hijack — opening a file type runs the attacker's command. Also ms-settings & mscfile for UAC-bypass.
...\Classes\CLSID\{...}\InprocServer32COM hijacking — repoint a CLSID at a malicious DLL and it loads when that COM object is called. Check HKCU, which overrides HKLM.
...\Control\Session Manager\BootExecuteNative apps run by smss at boot before the UI. Should normally be just autocheck autochk *.
...\Windows\CurrentVersion\Explorer\Shell Folders — StartupPoints at the Startup folder path; redirecting it is a quieter autostart than a Run value.
...\AppInit_DLLs & ...\Winlogon\GPExtensionsAppInit_DLLs loads a DLL into nearly every GUI process (now usually disabled by Secure Boot). Still check the value — a non-empty one is a flag.
...\Services\<svc>\Parameters\ServiceDllFor svchost-hosted services the real code is a DLL here, not in ImagePath. A hijacked ServiceDll is service persistence that hides behind a legit svchost.

The move: don't eyeball these one by one in production — run Autoruns (Sysinternals) with "Hide Microsoft entries" and "Verify signatures" on; it enumerates all of the above plus scheduled tasks and drivers. Use this sheet to know why each line it shows is a persistence spot.

Recon

System & host facts

...\CurrentVersion\ProductName & DisplayVersionUnder HKLM\Software\Microsoft\Windows NT\CurrentVersion — OS edition and build. InstallDate too.
HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerNameThe host name — useful when reading an offline hive you can't otherwise identify.
...\Control\TimeZoneInformationThe host's time zone — essential for lining registry and log timestamps up correctly.
...\Microsoft\Windows NT\CurrentVersion\ProfileListSID → user profile path mapping. Turn a SID from a log into a username.
...\Services\Tcpip\Parameters\Interfaces\{...}Per-adapter IP, gateway, DNS, and DHCP lease — network config from the hive.
...\Microsoft\Windows\CurrentVersion\UninstallInstalled software inventory (HKLM and the Wow6432Node mirror). Spot unexpected apps.
...\Control\Network + ...\NetworkList\ProfilesKnown networks the host has joined, with first/last-connected times — placement and travel history.

Forensics

Evidence of execution & user activity

The registry remembers what ran and what a user touched. These are parsed by tools (RegRipper, KAPE, Registry Explorer) — here's what each key means.

...\Explorer\UserAssist\{...}\CountGUI programs the user launched, with run counts and last-run time (ROT13-encoded names). Strong "they ran this" evidence. In HKCU/NTUSER.DAT.
...\Control\Session Manager\AppCompatCacheShimCache — programs that existed / were run, with path and (often) size. Survives reboots; written at shutdown. A top execution artifact.
Amcache.hve — ...\Root\InventoryApplicationFileAmCache (separate hive in ...\AppCompat\Programs) — binaries with full path and SHA-1 hash. Pivot a hash straight to VirusTotal.
...\Explorer\RecentDocsRecently opened files by extension, most-recent first — what the user has been touching.
...\Explorer\RunMRUEverything typed into the Win+R Run box, in order — often catches an attacker's hands-on-keyboard commands.
...\Explorer\TypedPaths & ...\ComDlg32\OpenSavePidlMRUPaths typed into Explorer's bar and files chosen in open/save dialogs — navigation and exfil staging.
...\Explorer\UserAssist & ...\BAM\State\UserSettings\<SID>BAM/DAM (Background Activity Moderator) records executables run per user with last-execution time — another execution timeline.
NTUSER.DAT\...\TerminalServerClient\ServersRDP connection history — remote hosts this user connected out to. Lateral-movement trail.
...\Microsoft\Office\<ver>\...\File MRU & Security\Trusted DocumentsRecently opened Office docs and which ones the user clicked "Enable Content" on — often the macro-maldoc entry point.
USRCLASS.DAT\...\Shell\BagMRU (Shellbags)Folders the user browsed — including removable and now-deleted paths. Proof a folder existed and was viewed.

Reading these for real: they're binary and encoded — don't try to eyeball them. Export the hive and run RegRipper or Eric Zimmerman's Registry Explorer / AppCompatCacheParser / AmcacheParser. Cross-check any hit against event logs (4688) and the Core Processes sheet.

Put it together

SOC one-liners

Quick reads against a live box. Run elevated; export anything interesting before you change it.

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" && reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"The fast two-line persistence check — machine and user Run keys back to back.
reg query "HKLM\...\Winlogon" /v Userinit && reg query "HKLM\...\Winlogon" /v ShellConfirm Userinit and Shell are exactly the defaults — anything appended is a hijack.
Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services | ForEach-Object { Get-ItemProperty $_.PSPath | Select PSChildName,ImagePath,Start } | Where ImagePath -match "users|temp|appdata|programdata"Services whose binary lives in a user-writable path — a strong service-persistence flag.
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s | findstr /i "Debugger"Any IFEO Debugger value — the accessibility/sticky-keys hijack and debugger-redirect trick.
Get-ItemProperty "HKLM:\...\Run","HKCU:\...\Run","HKLM:\...\Wow6432Node\...\Run" -EA SilentlyContinueAll Run locations including the 32-bit mirror in one read.
reg query HKU /f ".exe" /s /d | findstr /i "temp appdata public"Hunt every loaded user hive for values whose data points an exe at a suspicious folder.
reg save HKLM\SYSTEM sys.hiv & reg save HKLM\SOFTWARE soft.hivGrab the key hives for offline parsing with RegRipper/KAPE. (Watch for an attacker doing reg save HKLM\SAM + SECURITY — that's credential theft.)

Detection note: registry writes to these keys surface as Sysmon Event 12/13/14 and, with auditing on, Security Event 4657. reg save HKLM\SAM / HKLM\SECURITY is high-signal credential access — alert on it.