Skip to content
Get packs

Windows Registry Forensics

Lets the agent pull persistence, user-activity and software evidence out of Windows registry hive files during incident response.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent follows a step-by-step forensic workflow for Windows registry files copied from a disk image. It guides mounting the image read-only, hashing the extracted hives, running RegRipper plugins, and using Python (python-registry, and regipy in the bundled script) to list autorun/persistence keys, UserAssist program-run history, recent documents and typed URLs. It is written for incident responders and digital forensics analysts, not for general users.

Great for

  • DFIR analysts triaging a Windows disk image for signs of malware persistence
  • Students learning how Windows registry artifacts are used in forensic investigations
  • Security teams reconstructing user activity during an insider threat case

Skip it if

  • Live analysis of a production machine: the workflow assumes offline hive copies, and running tools against live systems can alter evidence
  • Anyone without authorisation to examine the system or image, since it targets personal or employee data forensically
  • Legal evidence handling without a qualified examiner: the output is investigative guidance, not a validated forensic procedure

Try asking

  • “Analyze these NTUSER.DAT and SOFTWARE hives and list all Run and RunOnce persistence entries”
  • “Use RegRipper to produce a userassist and usbstor report from this case's registry folder”
  • “Show me which programs were executed by this user based on UserAssist data”
  • “Map registry autorun findings to MITRE ATT&CK technique T1547.001”
Step-by-step guide: how to use Windows Registry ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-windows-registry-for-artifacts.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-windows-registry-for-artifacts.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-windows-registry-for-artifacts.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work only on copies of hive files and confirm hashes match before analysis, as the skill recommends.
  • Review the bundled scripts/agent.py before running it, since it executes Python code that reads hive paths you supply.
  • Verify findings with a second tool such as Registry Explorer, because the skill's example code and paths are not validated against real images.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.