userassist
#
$ target-query <path/to/target> -f userassist
Module |
|
Output |
|
Module documentation
UserAssist plugin.
Function documentation
Return the UserAssist information for each user.
The UserAssist registry keys contain information about programs that were recently executed on the system. Programs launch via the commandline are not registered within these registry keys.
- References:
- Yields UserAssistRecords with fields:
hostname (string): The target hostname. domain (string): The target domain. ts (datetime): The entry timestamp. path (path): The entry path. number_of_executions (int): The number of executions for this entry. application_focus_count (int): The number of focus acount for this entry. application_focus_duration (int): The duration of focus for this entry.