windows registry artifacts every investigator checks

the registry remembers everything, whether you wanted it to or not

windows keeps a diary. it's called the registry, and it is absolutely terrible at keeping secrets. every program you install, every usb drive you plug in, every file you open, it all leaves a fingerprint somewhere in these hives. if you're trying to figure out "what happened on this machine" after an incident, or you just want to know what's quietly living on your own system, the registry is where you start looking.

this isn't about hacking anything. it's about reading what's already sitting on your own box so you can catch persistence, weird usb activity, or malware that ran once and tried to disappear.

run keys: the autostart hall of fame

malware loves persistence, and persistence loves run keys. these are registry locations that tell windows "launch this thing every time a user logs in." legit software uses them too, which is exactly why attackers hide there, it blends in.

the big ones to check:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

on your own machine, pull these up with regedit or autoruns from sysinternals and actually read every entry. if there's something pointing to a random path in appdata with a name like "svchost32helper" that is not a windows service, that's your red flag. real system processes don't need a nickname.

usbstor: the drive that never left a trace, except it did

every usb storage device you've ever connected gets logged here, including the vendor, serial number, and first/last connection times.

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

for defenders this matters two ways. one, if you're investigating data exfiltration, this tells you exactly which drives touched the machine and when. two, if you're auditing your own environment, this is how you catch unauthorized usb use on machines that shouldn't have any, like a kiosk or a locked-down workstation. if policy says "no usb drives," this key is how you prove or disprove it.

shimcache and amcache: proof something ran

these two get confused a lot but they answer the same core question: did this executable run on this system. shimcache (application compatibility cache) tracks metadata about executed programs including file paths and timestamps. amcache goes further, capturing hashes, install paths, and publisher info.

SYSTEM hive (shimcache): SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
Amcache.hve file: C:\Windows\AppCompat\Programs\Amcache.hve

why this matters if you're defending your own network: an attacker can delete the malware file after it runs, but these artifacts often survive. if you're doing your own incident triage, this is how you confirm execution even when the payload is long gone. it's the digital equivalent of finding footprints after someone swept the floor.

recentdocs: what the user actually opened

this one's less about malware and more about human behavior, which matters when you're figuring out if an account was compromised or misused.

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

it logs recently opened files by extension. if you're checking whether someone accessed sensitive documents they shouldn't have, or verifying your own activity trail after a security scare, this is where you look. it's also handy for confirming a timeline: does the file access match when the user says they were working.

the takeaway

the registry isn't some hidden hacker tool, it's a built-in logbook that windows keeps whether you ask it to or not. the defensive move here is simple: know these locations, check them periodically on systems you own or manage, and use tools like autoruns, regripper, or eric zimmerman's tooling to pull and parse hives without guessing through regedit by hand. if you see persistence you didn't set up, a usb you don't recognize, or execution evidence for something you never installed, that's your signal to isolate and investigate further, not ignore it and hope it goes away. the registry already knows what happened. your job is just to go read it before someone else does.