MUICache Program Execution History

info Nessus Plugin ID 92424

Synopsis

Nessus was able to enumerate recently executed programs on the remote host.

Description

Nessus was able to query the MUIcache registry key to find evidence of program execution.

See Also

https://forensicartifacts.com/2010/08/registry-muicache/

http://windowsir.blogspot.com/2005/12/mystery-of-muicachesolved.html

http://www.nirsoft.net/utils/muicache_view.html

Plugin Details

Severity: Info

ID: 92424

File Name: microsoft_windows_muicache.nasl

Version: 1.5

Type: local

Agent: windows

Family: Windows

Published: 7/19/2016

Updated: 5/16/2018

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/Registry/Enumerated