Windows Registry Forensics
Lets the agent pull persistence, user-activity and software evidence out of Windows registry hive files during incident response.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, the agent follows a step-by-step forensic workflow for Windows registry files copied from a disk image. It guides mounting the image read-only, hashing the extracted hives, running RegRipper plugins, and using Python (python-registry, and regipy in the bundled script) to list autorun/persistence keys, UserAssist program-run history, recent documents and typed URLs. It is written for incident responders and digital forensics analysts, not for general users.
Great for
- DFIR analysts triaging a Windows disk image for signs of malware persistence
- Students learning how Windows registry artifacts are used in forensic investigations
- Security teams reconstructing user activity during an insider threat case
Skip it if
- Live analysis of a production machine: the workflow assumes offline hive copies, and running tools against live systems can alter evidence
- Anyone without authorisation to examine the system or image, since it targets personal or employee data forensically
- Legal evidence handling without a qualified examiner: the output is investigative guidance, not a validated forensic procedure
Try asking
- “Analyze these NTUSER.DAT and SOFTWARE hives and list all Run and RunOnce persistence entries”
- “Use RegRipper to produce a userassist and usbstor report from this case's registry folder”
- “Show me which programs were executed by this user based on UserAssist data”
- “Map registry autorun findings to MITRE ATT&CK technique T1547.001”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-windows-registry-for-artifacts.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-windows-registry-for-artifacts.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-windows-registry-for-artifacts.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Work only on copies of hive files and confirm hashes match before analysis, as the skill recommends.
- Review the bundled scripts/agent.py before running it, since it executes Python code that reads hive paths you supply.
- Verify findings with a second tool such as Registry Explorer, because the skill's example code and paths are not validated against real images.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.