Full Report
Useful feature that can help forensic analysts and incident responders to reconstruct user activities.
Analysis Summary
# Tool/Technique: FeatureUsage Registry Artifacts
## Overview
FeatureUsage is a Windows registry artifact located within the user's `NTUSER.DAT` hive. While designed by Microsoft to track UI interactions and application "badges" on the Taskbar, it serves as a valuable forensic source for reconstructing user activity and providing evidence of execution (EoE). It is particularly useful for identifying which applications a user prioritized or interacted with frequently via the Taskbar.
## Technical Details
- **Type:** Forensic Technique / OS Artifact
- **Platform:** Windows (Commonly observed in Windows 10 and 11)
- **Capabilities:** Tracking application launches, application switching, taskbar interactions, and "jump list" views.
- **First Seen:** Discovery dates vary, but it is a standard component of modern Windows Taskbar telemetry.
## MITRE ATT&CK Mapping
- **[TA0007 - Discovery]**
- **[T1012 - Query Registry]** (Used by analysts to recover evidence; also used by malware to detect environment tools).
- **[TA0009 - Collection]**
- **[T1119 - Automated Collection]** (Collection of registry hives during forensic imaging).
## Functionality
### Core Capabilities
The artifact resides in: `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage`
- **AppLaunch:** Records the number of times an application pinned to the Taskbar has been launched.
- **AppSwitched:** Logs left-clicks on Taskbar icons when a user switches between active windows. This is a high-fidelity source for proving a user was actively interacting with a specific tool.
- **TrayButtonClicked:** Monitors interaction with system tray elements like the Start button, Clock, and Search box.
### Advanced Features
- **AppBadgeUpdated:** Tracks how often an application's badge (e.g., unread message counts in Telegram or Outlook) was updated.
- **ShowJumpView:** Tracks right-clicks on Taskbar icons, which usually indicates the user was accessing "Recent Files" or specific application tasks via the Jump List.
## Indicators of Compromise
*Note: As a forensic artifact, this tool is used to find evidence of other malicious tools rather than being malicious itself.*
- **Behavioral Indicators:** The presence of entries for known hacking tools (e.g., `mimikatz.exe`, `powershell.exe`) within the **AppSwitched** or **AppLaunch** subkeys suggests manual execution and interaction by a threat actor.
## Associated Threat Actors
This is a native Windows feature; however, forensic analysis of this key has been used to identify activity by various actors who utilize GUI-based tools or interact with pinned applications during a session.
## Detection Methods
- **Manual Analysis:** Examining the `NTUSER.DAT` hive using registry viewers or forensic suites (e.g., Registry Explorer).
- **Behavioral detection:** Monitoring for unusual processes appearing in the Taskbar telemetry, which may indicate a lateral movement session where the attacker interacted with the GUI.
## Mitigation Strategies
- **Prevention measures:** As this is a native OS logging feature, it cannot be "mitigated" without impacting OS functionality.
- **Hardening:** Restrict administrative access to prevent attackers from clearing registry keys to hide their tracks (anti-forensics).
- **Policy:** Implement regular collection of `NTUSER.DAT` files as part of a proactive hunting or incident response strategy.
## Related Tools/Techniques
- **UserAssist:** Another registry key (`Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist`) that tracks GUI-based application execution.
- **Shimcache (AppCompatCache):** Tracks executable files to ensure backward compatibility, often used for evidence of execution.
- **Prefetch:** System-level files that speed up application loading and provide execution history.
- **Jump Lists:** Files located in `%AppData%\Microsoft\Windows\Recent\AutomaticDestinations`.