[Osquery_manager] UserAssist artifact saved query

[tomsonpl]

UserAssist Artifact

The UserAssist registry artifact tracks applications executed via Windows Explorer, providing forensic investigators with execution timestamps, run counts, and user attribution. This artifact is essential for reconstructing user activity timelines and identifying potentially malicious programs launched through the Windows shell.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	UserAssist	✅	Windows	userassist_windows_elastic	e9e51a33	Track Explorer-launched applications with user resolution and hash enrichment

Queries by Platform

---

🪟 Windows - User Execution Tracking via Explorer

Description

UserAssist Registry: Track applications executed via Windows Explorer. Shows execution count and last execution time per user. Useful for forensic investigation of user-initiated program execution. MITRE ATT&CK: T1204 (User Execution).

Detection Focus:

• Applications launched by users via Windows Explorer shell
• Execution frequency and patterns per user account
• Timeline reconstruction of user-initiated program execution
• Identification of suspicious or unauthorized application usage
• Correlation of file hashes with threat intelligence

Forensic Value:

• Provides execution count for frequency analysis
• Last execution timestamp for timeline correlation
• User SID resolution to human-readable usernames
• Hash enrichment for executable verification (when file path exists on disk)

Result

Query results include application paths, extracted filenames, user SIDs with resolved usernames, execution timestamps in UTC, run counts, and MD5/SHA256 hashes when the executable exists on disk.

Platform

windows

Interval

3600 seconds (1 hour)

Query ID

userassist_windows_elastic

ECS Field Mappings

• file.path → path
• file.name → name
• user.id → sid
• user.name → username
• file.hash.md5 → md5
• file.hash.sha256 → sha256
• event.category → ["process"] (static)
• event.type → ["info"] (static)
• tags → ["userassist", "mitre_t1204", "forensics"] (static)

SQL Query

-- UserAssist: Track applications executed via Windows Explorer
-- Forensic value: Shows user-initiated program executions with timestamps
SELECT
  ua.path AS path,
  REPLACE(ua.path, RTRIM(ua.path, REPLACE(ua.path, '\', '')), '') AS name,
  ua.sid AS sid,
  u.username AS username,
  datetime(ua.last_execution_time, 'unixepoch', 'UTC') AS last_execution_utc,
  ua.last_execution_time,
  ua.count AS execution_count,
  h.md5 AS md5,
  h.sha256 AS sha256
FROM userassist ua
LEFT JOIN users u ON ua.sid = u.uuid
LEFT JOIN hash h ON ua.path = h.path
WHERE ua.path != ''
  AND ua.last_execution_time > 0

---

MITRE ATT&CK Coverage

• T1204 - User Execution: Tracks when users execute malicious files via social engineering or other means

---

This PR was AI assisted with Claude Code

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: e5f862e