Forensic Friday - Profile Lists

Inception Security

May 16, 2022

3 min read

Updated: Oct 14

What are Profile Lists?

Windows keeps track of user-profiles and their locations in the registry. The profile location is stored under the key below:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

This registry key contains one subkey for each user profile on a Windows machine. Inside of each of these subkeys is a registry value called ProfileImagePath that holds that user's profile path. You can also see when each subkey was last written and other details about the profile.

When do Profile Lists have value?

Once a threat actor gains a foothold in an environment, the next step is to obtain valid credentials so that they can move laterally throughout the environment. As you would expect, identifying the user accounts that the attackers used will help in many ways, such as:

Identifying the systems that were accessed.
Understanding the access obtained in the environment.
Hunting the logs for the username.

Threat actors sometimes clean up by deleting the user profile on their way out, and sometimes the impacted organization deletes the profile the attackers used. Either way, some artifacts are lost. What survives in ProfileList depends on how the profile was removed. A proper delete (System Properties, Win32_UserProfile or the DeleteProfile API) removes the SID subkey along with the folder, though the deleted key can sometimes be recovered from the SOFTWARE hive's unallocated space or a volume shadow copy. If only the profile folder was deleted, the SID subkey stays behind with a ProfileImagePath pointing to a folder that no longer exists.

A subkey ending in .bak means something else. Windows renames a profile's key to SID.bak when it fails to load that profile, often because it is corrupt or its folder is missing, and signs the user in with a temporary profile. A .bak key is not proof of deletion, but it does show that the SID had a profile on the host.

How to analyze the Profile List?

There are many ways you can analyze the profile list. If you have access to the host, you can leverage the registry editor to navigate the profile lists' location. If you have a forensic image of the host, you can pull the SOFTWARE hive. The SOFTWARE hive is located at C:\Windows\System32\config\SOFTWARE.

Once you have a copy of the hive, you can use a tool like Registry Explorer to navigate the hive. In some cases, you might have an EDR installed on the host. Many EDR platforms allow you to navigate the registry using native features of the EDR platform.

We are here to help!

Are you looking for ongoing advisory services to assist in identifying vulnerabilities and security policies that should be in place and help improve your security posture? The team at Inception Security™ has been leveraged to enhance the security posture of Fortune 100 companies, small and medium-sized businesses. Our team has a depth of knowledge in the cybersecurity industry and will be able to provide value to your business right away.

Contact Inception Security if your company is looking for advisory services.