network_history

$ target-query <path/to/target> -f network_history
Details

Module

dissect.target.plugins.os.windows.regf.nethist.NethistPlugin

Output

records

Module documentation

Windows network history plugin.

Function documentation

Return attached network history.

The HKLMSoftwareMicrosoftWindows NTCurrentVersionNetworklistSignatures and HKLMSoftwareMicrosoftWindows NTCurrentVersionNetworklistProfiles registry keys contain information about the networks to which the system has been connected, both wireless and wired.

References: