UserAssist Forensics 2025

Could you use some assistance with userAssist forensics? This article by DFIR expert Chris Ray explains what userAssist is, how it works, its forensic value, and so much more.

Let’s get into it.

Jump to…
Introduction to UserAssist
The Structure and Encoding of UserAssist Entries
How UserAssist Works
Forensic Value of UserAssist Data
When UserAssist Misses Data
UserAssist Forensics with Cyber Triage

Introduction to UserAssist

UserAssist is a Windows registry key that primarily records metadata relating to applications with a GUI component (similar to MUICache) and applications/lnk files launched from the Windows GUI.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

NTUser.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\count

{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\count

Notes
*On Windows 10 and up not all entries indicate a process actually ran. See, “How UserAssist Works” section for more info.
**There are other interesting keys on XP systems. We are focusing on Windows 10+ systems as UserAssist on older systems has been written about numerous times, check some out here and here.

The Structure and Encoding of UserAssist Entries

UserAssist data isn’t stored in a straightforward format.

It’s obfuscated using Rot13 encoding and organized under specific GUID-labeled subkeys. Understanding how UserAssist structures and encodes its data is crucial for accurate forensic analysis.

There are 3 key elements:

• GUID keys
• Value names
• Value data

Let’s look at each.

GUID Keys

The GUID key signifies the type of data being recorded under that key. There are numerous GUIDs on Windows 7+ as documented here.

2 with significant forensic value are:

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}

{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}

Value Names

Each value name under “GUID\count” is the path to a program Rot13 encoded. This means any alphabetic character a-zA-Z is shifted over by 13 places. Z becomes M, A becomes N, etc.

Example: Rundll32.exe appears as ehaqyy32.rkr.

Note not all entries will have resolved path:

_Microsoft.WindowsNotepad_8wekyb3d8bbwe!App

{F38BF404-1D43-42F2-9305-67DE0B28FC23}\regedit.exe

Value Data

Value data is a binary blob known to contain the following info (starting at index 0):

How UserAssist Works

This section outlines when UserAssist data is generated based on tests from Win10+.

This is a general guideline on when to expect data to show up, but there are always edge cases that may not be accounted for.

We recommend verifying findings with other sources of evidence.

High Level

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\count

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\count (for the exe)

{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\count (for the lnk)

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\count

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\count

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\count

Details

The following scenarios will result in:

• UserAssist entries being created.
• Run count/last run time being updated.

The following scenarios will not result in userAssist entries being created (unless exe has a GUI component):

Forensic Value of UserAssist Data

UserAssist data is a valuable artifact in digital forensic investigations, offering insights into user activity on a Windows system.

When UserAssist Misses Data

While it’s important to understand what data is contained in the userAssist artifact, it’s equally important to understand when data will not show up in the userAssist artifact.

Several scenarios result in data not showing up in the RunMRU key:

• UserAssist history is disabled.
• UserAssist history has been cleared.
• Process activity happens outside scope of userAssist monitoring.

Let’s look at each of these:

UserAssist History Is Disabled

The userAssist history can be disabled 2 ways, both are applied on a user-by-user basis:

Method 1: Disable Tracking app launch in Windows privacy settings.

Method 2: Update the userAssistregistry key with a Deny All ACL.

We have previously discussed these methods in our runMRU blog. Check that out for more details.

UserAssist History Has Been Cleared

UserAssist history can be manually cleared by attackers by deleting the userAssist key or specific subkeys/values. This will need to be done for every user the attacker has had interactive sessions with.

Process Activity Happens Outside Scope of UserAssist Monitoring

This is a major reason why we cannot rely on userAssist alone. It’s not an audit log of process activity, but a Windows feature used to derive forensic value.

The data contained here will:

• Best Case: Contains the last execution time of a process with a run count.
• Worst Case: Not have evidence of process execution at all.

For example, a command line tool like ping or whoami that may be used for recon by an attacker will not be recorded in userAssist when launched via command prompt.

The process will be missed if:

• It was not launched via the Windows GUI.
• It does not have a GUI component.

Extracting and Analyzing UserAssist Data

UserAssist is not an easy artifact to manually review given the encoded process names and binary data.

Some UserAssist forensics tools:

UserAssist Forensics with Cyber Triage

UserAssist is what we call a data artifact.

Information extracted from userAssist and other data artifacts we call information artifacts.

Information artifacts are a way of categorizing data artifacts, and userAssist falls into the “process run” information artifacts category.

We recommend investigators think about artifacts like this because it helps them focus on the right things. Many data artifacts have a similar computing function, but differ slightly in the details. If investigators think top-down, they can see the big picture more easily. If they think bottom up, they can easily get confused by details.

We built the Cyber Triage UI around this investigation philosophy.

Cyber Triage displays information artifacts regardless of data artifact (userAssist, MUICache, Prefetch, etc.) it came from.

With userAssist, we are looking at processes. So, Cyber Triage’s UI  puts all the “processes run” artifacts together. Instead of reviewing single data artifacts like userAssis t— especially when it’s missing arguments and other key details — you see everything in a single view. So you have context userAssist alone can’t provide.

This enables you to figure out — really quickly — what a user executed.

Cyber Triage’s process table is in the screenshot below.

It’s grouped by:

• Exe
• Arguments

The group can be updated to also include users if that is what we care about.

Groups show:

• Last execution time
• Earliest execution time
• Count of instances for each group

You can jump into each group and select individual process execution instances to get more details. Below is a process from userAssist. The arguments are unknown.

You can view:

• Original data normalized from the data artifact
• Associated user
• Execution time

Curious about where an information artifact came from? The sources tab has those details, and other tabs provide context about the item you’re reviewing, too.

For instance, we are looking at a process and can jump to the “Triggered Tasks” view to see if there is any persistence for it or the “File” view to get details about the file on disk (if it exists):

To focus on a specific data artifact, the artifact sources table shows all the data artifacts Cyber Triage processes:

Opening up the userAssist group lets you see all process execution artifacts pulled from userAssist.

If you’d like to try investigating userAssist with Cyber Triage now, try 7 days for free.