# BluGenie

- [Full Function List](/blugenie/full-function-list.md)
- [Add-BluGenieFirewallRule](/blugenie/full-function-list/add-blugeniefirewallrule.md)
- [Clear-BlugenieMemory](/blugenie/full-function-list/clear-blugeniememory.md)
- [Connect-BluGenieToSystem](/blugenie/full-function-list/connect-blugenietosystem.md)
- [Convert-BluGenieSID2UserName](/blugenie/full-function-list/convert-blugeniesid2username.md)
- [Convert-BluGenieSize](/blugenie/full-function-list/convert-blugeniesize.md)
- [Convert-BluGenieUserName2SID](/blugenie/full-function-list/convert-blugenieusername2sid.md)
- [Convert-BluGenieUTCtoLocal](/blugenie/full-function-list/convert-blugenieutctolocal.md)
- [ConvertFrom-Yaml](/blugenie/full-function-list/convertfrom-yaml.md)
- [ConvertTo-BluGenieDate](/blugenie/full-function-list/convertto-blugeniedate.md)
- [ConvertTo-Yaml](/blugenie/full-function-list/convertto-yaml.md)
- [Disable-BluGenieAllFirewallRules](/blugenie/full-function-list/disable-blugenieallfirewallrules.md)
- [Disable-BluGenieFirewallRule](/blugenie/full-function-list/disable-blugeniefirewallrule.md)
- [Enable-BluGenieAllFirewallRules](/blugenie/full-function-list/enable-blugenieallfirewallrules.md)
- [Enable-BluGenieFirewallRule](/blugenie/full-function-list/enable-blugeniefirewallrule.md)
- [Enable-BluGenieWinRMoverWMI](/blugenie/full-function-list/enable-blugeniewinrmoverwmi.md)
- [Expand-BluGenieArchivePS2](/blugenie/full-function-list/expand-blugeniearchiveps2.md)
- [Format-BluGenieEvent](/blugenie/full-function-list/format-blugenieevent.md)
- [Get-BluGenieADGroupMembers](/blugenie/full-function-list/get-blugenieadgroupmembers.md)
- [Get-BluGenieADGroups](/blugenie/full-function-list/get-blugenieadgroups.md)
- [Get-BluGenieADMachineInfo](/blugenie/full-function-list/get-blugenieadmachineinfo.md)
- [Get-BluGenieAuditProcessTracking](/blugenie/full-function-list/get-blugenieauditprocesstracking.md)
- [Get-BluGenieAutoRuns](/blugenie/full-function-list/get-blugenieautoruns.md)
- [Get-BluGenieChildItemList](/blugenie/full-function-list/get-blugeniechilditemlist.md)
- [Get-BluGenieCOMObjectInfo](/blugenie/full-function-list/get-blugeniecomobjectinfo.md)
- [Get-BluGenieCurrentSessionAliases](/blugenie/full-function-list/get-blugeniecurrentsessionaliases.md)
- [Get-BluGenieCurrentSessionFunctions](/blugenie/full-function-list/get-blugeniecurrentsessionfunctions.md)
- [Get-BluGenieCurrentSessionVariables](/blugenie/full-function-list/get-blugeniecurrentsessionvariables.md)
- [Get-BluGenieErrorAction](/blugenie/full-function-list/get-blugenieerroraction.md)
- [Get-BluGenieFileADS](/blugenie/full-function-list/get-blugeniefileads.md)
- [Get-BluGenieFilePermissions](/blugenie/full-function-list/get-blugeniefilepermissions.md)
- [Get-BluGenieFileSnapshot](/blugenie/full-function-list/get-blugeniefilesnapshot.md)
- [Get-BluGenieFileStreams](/blugenie/full-function-list/get-blugeniefilestreams.md)
- [Get-BluGenieFirewallRules](/blugenie/full-function-list/get-blugeniefirewallrules.md)
- [Get-BluGenieHashInfo](/blugenie/full-function-list/get-blugeniehashinfo.md)
- [Get-BluGenieHelp](/blugenie/full-function-list/get-blugeniehelp.md)
- [Get-BluGenieHostingVersion](/blugenie/full-function-list/get-blugeniehostingversion.md)
- [Get-BluGenieIPrange](/blugenie/full-function-list/get-blugenieiprange.md)
- [Get-BluGenieLiteralPath](/blugenie/full-function-list/get-blugenieliteralpath.md)
- [Get-BluGenieLoadedRegHives](/blugenie/full-function-list/get-blugenieloadedreghives.md)
- [Get-BluGenieLockingProcess](/blugenie/full-function-list/get-blugenielockingprocess.md)
- [Get-BluGenieMRUActivityView](/blugenie/full-function-list/get-blugeniemruactivityview.md)
- [Get-BluGenieProcessList](/blugenie/full-function-list/get-blugenieprocesslist.md)
- [Get-BluGenieRegistry](/blugenie/full-function-list/get-blugenieregistry.md)
- [Get-BluGenieRegistryProcessTracking](/blugenie/full-function-list/get-blugenieregistryprocesstracking.md)
- [Get-BluGenieRegSnapshot](/blugenie/full-function-list/get-blugenieregsnapshot.md)
- [Get-BluGenieRunSpaceSessionAliases](/blugenie/full-function-list/get-blugenierunspacesessionaliases.md)
- [Get-BluGenieRunSpaceSessionFunctions](/blugenie/full-function-list/get-blugenierunspacesessionfunctions.md)
- [Get-BluGenieRunSpaceSessionVariables](/blugenie/full-function-list/get-blugenierunspacesessionvariables.md)
- [Get-BluGenieSchTaskInfo](/blugenie/full-function-list/get-blugenieschtaskinfo.md)
- [Get-BluGenieScriptDirectory](/blugenie/full-function-list/get-blugeniescriptdirectory.md)
- [Get-BluGenieServiceList](/blugenie/full-function-list/get-blugenieservicelist.md)
- [Get-BluGenieServiceStatus](/blugenie/full-function-list/get-blugenieservicestatus.md)
- [Get-BluGenieSessionAliasList](/blugenie/full-function-list/get-blugeniesessionaliaslist.md)
- [Get-BluGenieSessionFunctionList](/blugenie/full-function-list/get-blugeniesessionfunctionlist.md)
- [Get-BluGenieSessionVariableList](/blugenie/full-function-list/get-blugeniesessionvariablelist.md)
- [Get-BluGenieSettings](/blugenie/full-function-list/get-blugeniesettings.md)
- [Get-BluGenieSignature](/blugenie/full-function-list/get-blugeniesignature.md)
- [Get-BluGenieSystemInfo](/blugenie/full-function-list/get-blugeniesysteminfo.md)
- [Get-BluGenieToolsDirectory](/blugenie/full-function-list/get-blugenietoolsdirectory.md)
- [Get-BluGenieTranscriptsDir](/blugenie/full-function-list/get-blugenietranscriptsdir.md)
- [Get-BluGenieTranscriptsFile](/blugenie/full-function-list/get-blugenietranscriptsfile.md)
- [Get-BluGenieTrapData](/blugenie/full-function-list/get-blugenietrapdata.md)
- [Get-BluGenieWindowsTitle](/blugenie/full-function-list/get-blugeniewindowstitle.md)
- [Get-BluGenieWindowsUpdates](/blugenie/full-function-list/get-blugeniewindowsupdates.md)
- [Install-BluGenieHarvester](/blugenie/full-function-list/install-blugenieharvester.md)
- [Install-BluGenieSysMon](/blugenie/full-function-list/install-blugeniesysmon.md)
- [Invoke-BluGenieAnalyzer](/blugenie/full-function-list/invoke-blugenieanalyzer.md)
- [Invoke-BluGenieFileBrowser](/blugenie/full-function-list/invoke-blugeniefilebrowser.md)
- [Invoke-BluGenieLoadAllProfileHives](/blugenie/full-function-list/invoke-blugenieloadallprofilehives.md)
- [Invoke-BluGenieNetStat](/blugenie/full-function-list/invoke-blugenienetstat.md)
- [Invoke-BluGenieParallel](/blugenie/full-function-list/invoke-blugenieparallel.md)
- [Invoke-BluGenieProcess](/blugenie/full-function-list/invoke-blugenieprocess.md)
- [Invoke-BluGenieProcessHash](/blugenie/full-function-list/invoke-blugenieprocesshash.md)
- [Invoke-BluGeniePSQuery](/blugenie/full-function-list/invoke-blugeniepsquery.md)
- [Invoke-BluGeniePython](/blugenie/full-function-list/invoke-blugeniepython.md)
- [Invoke-BluGenieSQLLQuery](/blugenie/full-function-list/invoke-blugeniesqllquery.md)
- [Invoke-BluGenieThreadLock](/blugenie/full-function-list/invoke-blugeniethreadlock.md)
- [Invoke-BluGenieUnLoadAllProfileHives](/blugenie/full-function-list/invoke-blugenieunloadallprofilehives.md)
- [Invoke-BluGenieWalkThrough](/blugenie/full-function-list/invoke-blugeniewalkthrough.md)
- [Invoke-BluGenieWipe](/blugenie/full-function-list/invoke-blugeniewipe.md)
- [Invoke-BluGenieYara](/blugenie/full-function-list/invoke-blugenieyara.md)
- [Invoke-PSipcalc](/blugenie/full-function-list/invoke-psipcalc.md)
- [Invoke-PSnmap](/blugenie/full-function-list/invoke-psnmap.md)
- [Invoke-SQLiteBulkCopy](/blugenie/full-function-list/invoke-sqlitebulkcopy.md)
- [Invoke-SqliteQuery](/blugenie/full-function-list/invoke-sqlitequery.md)
- [Invoke-WalkThrough](/blugenie/full-function-list/invoke-walkthrough.md)
- [Join-BluGenieObjects](/blugenie/full-function-list/join-blugenieobjects.md)
- [New-BluGenieCommand](/blugenie/full-function-list/new-blugeniecommand.md)
- [New-BluGenieHelpMenu](/blugenie/full-function-list/new-blugeniehelpmenu.md)
- [New-BluGenieService](/blugenie/full-function-list/new-blugenieservice.md)
- [New-BluGenieSessionInfo](/blugenie/full-function-list/new-blugeniesessioninfo.md)
- [New-BluGenieTimeStamp](/blugenie/full-function-list/new-blugenietimestamp.md)
- [New-BluGenieUID](/blugenie/full-function-list/new-blugenieuid.md)
- [New-SQLiteConnection](/blugenie/full-function-list/new-sqliteconnection.md)
- [Open-BluGenieLog](/blugenie/full-function-list/open-blugenielog.md)
- [Open-BluGenieLogDir](/blugenie/full-function-list/open-blugenielogdir.md)
- [Open-BluGenieScriptDir](/blugenie/full-function-list/open-blugeniescriptdir.md)
- [Open-BluGenieToolDir](/blugenie/full-function-list/open-blugenietooldir.md)
- [Open-BluGenieTransDir](/blugenie/full-function-list/open-blugenietransdir.md)
- [Out-DataTable](/blugenie/full-function-list/out-datatable.md)
- [Publish-BluGenieArtifact](/blugenie/full-function-list/publish-blugenieartifact.md)
- [Publish-BluGenieFirewallRules](/blugenie/full-function-list/publish-blugeniefirewallrules.md)
- [Remove-BluGenieFile](/blugenie/full-function-list/remove-blugeniefile.md)
- [Remove-BluGenieFirewallRule](/blugenie/full-function-list/remove-blugeniefirewallrule.md)
- [Remove-BluGenieModule](/blugenie/full-function-list/remove-blugeniemodule.md)
- [Remove-BluGenieService](/blugenie/full-function-list/remove-blugenieservice.md)
- [Resolve-BluGenieDnsName](/blugenie/full-function-list/resolve-blugeniednsname.md)
- [Send-BluGenieItem](/blugenie/full-function-list/send-blugenieitem.md)
- [Set-BluGenieAuditProcessPol](/blugenie/full-function-list/set-blugenieauditprocesspol.md)
- [Set-BluGenieCommands](/blugenie/full-function-list/set-blugeniecommands.md)
- [Set-BluGenieCores](/blugenie/full-function-list/set-blugeniecores.md)
- [Set-BluGenieDebugger](/blugenie/full-function-list/set-blugeniedebugger.md)
- [Set-BluGenieFirewallGPOStatus](/blugenie/full-function-list/set-blugeniefirewallgpostatus.md)
- [Set-BluGenieFirewallStatus](/blugenie/full-function-list/set-blugeniefirewallstatus.md)
- [Set-BluGenieJobId](/blugenie/full-function-list/set-blugeniejobid.md)
- [Set-BluGenieJobMemory](/blugenie/full-function-list/set-blugeniejobmemory.md)
- [Set-BluGenieJobTimeout](/blugenie/full-function-list/set-blugeniejobtimeout.md)
- [Set-BluGenieNoBanner](/blugenie/full-function-list/set-blugenienobanner.md)
- [Set-BluGenieNoExit](/blugenie/full-function-list/set-blugenienoexit.md)
- [Set-BluGenieNoSetRes](/blugenie/full-function-list/set-blugenienosetres.md)
- [Set-BluGenieParallelCommands](/blugenie/full-function-list/set-blugenieparallelcommands.md)
- [Set-BluGeniePostCommands](/blugenie/full-function-list/set-blugeniepostcommands.md)
- [Set-BluGeniePrefetch](/blugenie/full-function-list/set-blugenieprefetch.md)
- [Set-BluGenieProcessCPUAffinity](/blugenie/full-function-list/set-blugenieprocesscpuaffinity.md)
- [Set-BluGenieProcessPriority](/blugenie/full-function-list/set-blugenieprocesspriority.md)
- [Set-BluGenieRange](/blugenie/full-function-list/set-blugenierange.md)
- [Set-BluGenieRemoteDesktopProcess](/blugenie/full-function-list/set-blugenieremotedesktopprocess.md)
- [Set-BluGenieScriptCredentials](/blugenie/full-function-list/set-blugeniescriptcredentials.md)
- [Set-BluGenieServiceJob](/blugenie/full-function-list/set-blugenieservicejob.md)
- [Set-BluGenieSessionInfo](/blugenie/full-function-list/set-blugeniesessioninfo.md)
- [Set-BluGenieSettingsPriority](/blugenie/full-function-list/set-blugeniesettingspriority.md)
- [Set-BluGenieSystems](/blugenie/full-function-list/set-blugeniesystems.md)
- [Set-BluGenieThreadCount](/blugenie/full-function-list/set-blugeniethreadcount.md)
- [Set-BluGenieTrapping](/blugenie/full-function-list/set-blugenietrapping.md)
- [Set-BluGenieUpdateMods](/blugenie/full-function-list/set-blugenieupdatemods.md)
- [Set-BluGenieVerbose](/blugenie/full-function-list/set-blugenieverbose.md)
- [Show-BluGenieGUI](/blugenie/full-function-list/show-blugeniegui.md)
- [Show-BluGenieMore](/blugenie/full-function-list/show-blugeniemore.md)
- [Start-BluGenieNewProcess](/blugenie/full-function-list/start-blugenienewprocess.md)
- [Start-BluGenieRunSpace](/blugenie/full-function-list/start-blugenierunspace.md)
- [Stop-BluGenieService](/blugenie/full-function-list/stop-blugenieservice.md)
- [Test-BluGenieIsFileLocked](/blugenie/full-function-list/test-blugenieisfilelocked.md)
- [Test-BluGenieIsMutexAvailable](/blugenie/full-function-list/test-blugenieismutexavailable.md)
- [Trace-BluGenieFireWallStatus](/blugenie/full-function-list/trace-blugeniefirewallstatus.md)
- [Update-BluGenieFirewallProfileStatus](/blugenie/full-function-list/update-blugeniefirewallprofilestatus.md)
- [Update-BluGenieSysinternals](/blugenie/full-function-list/update-blugeniesysinternals.md)
- [Update-Sqlite](/blugenie/full-function-list/update-sqlite.md)
- [Write BluGenieVerboseMsg](/blugenie/full-function-list/write-blugenieverbosemsg.md)
- [Functions by Category](/blugenie/functions-by-category.md)
- [Discovery](/blugenie/functions-by-category/discovery.md)
- [Registry](/blugenie/functions-by-category/discovery/registry.md)
- [File/Folder](/blugenie/functions-by-category/discovery/file-folder.md)
- [Process](/blugenie/functions-by-category/discovery/process.md)
- [System](/blugenie/functions-by-category/discovery/system.md)
- [Network](/blugenie/functions-by-category/discovery/network.md)
- [ActiveDirectory](/blugenie/functions-by-category/discovery/activedirectory.md)
- [Execution](/blugenie/functions-by-category/execution.md)
- [Registry](/blugenie/functions-by-category/execution/registry.md)
- [File/Folder](/blugenie/functions-by-category/execution/file-folder.md)
- [Process](/blugenie/functions-by-category/execution/process.md)
- [System](/blugenie/functions-by-category/execution/system.md)
- [Network](/blugenie/functions-by-category/execution/network.md)
- [Tools](/blugenie/functions-by-category/execution/tools.md)
- [Support](/blugenie/functions-by-category/support.md)
- [Artifacts](/blugenie/artifacts.md)
- [Example Template](/blugenie/artifacts/example-template.md)
- [Tactical Artifacts by Category](/blugenie/artifacts/tactical-artifacts-by-category.md)
- [Combination Query](/blugenie/artifacts/tactical-artifacts-by-category/combination-query.md)
- [Query Autorun locations for any item nested that is not digitally signed](/blugenie/artifacts/tactical-artifacts-by-category/combination-query/query-autorun-locations-for-any-item-nested-that-is-not-digitally-signed.md): AID2201221238.YAML
- [EventLog Query](/blugenie/artifacts/tactical-artifacts-by-category/eventlog-query.md)
- [Query for Process execution from unusual directories](/blugenie/artifacts/tactical-artifacts-by-category/eventlog-query/query-for-process-execution-from-unusual-directories.md): AID2201222048.yaml
- [Query suspicious programs processed by the Task Scheduler using the Event Log](/blugenie/artifacts/tactical-artifacts-by-category/eventlog-query/query-suspicious-programs-processed-by-the-task-scheduler-using-the-event-log.md): AID2201251952.YAML
- [Query for unusual instances of rundll32.exe via the Event Log](/blugenie/artifacts/tactical-artifacts-by-category/eventlog-query/query-for-unusual-instances-of-rundll32.exe-via-the-event-log.md)
- [Query for Unusual Instances of rundll32.exe making outbound network connections using SysMon Data](/blugenie/artifacts/tactical-artifacts-by-category/eventlog-query/query-for-unusual-instances-of-rundll32.exe-making-outbound-network-connections-using-sysmon-data.md): AID2201251645.YAML
- [Query Suspicious Powershell Command Line Executions](/blugenie/artifacts/tactical-artifacts-by-category/eventlog-query/query-suspicious-powershell-command-line-executions.md): AID2201251845.YAML
- [Query the Windows System Log for 104, 517, 1102](/blugenie/artifacts/tactical-artifacts-by-category/eventlog-query/query-the-windows-system-log-for-104-517-1102.md): AID2201232238.YAML
- [File and Folder Query](/blugenie/artifacts/tactical-artifacts-by-category/file-and-folder-query.md)
- [Query for malicious file types in all users and system temp directories](/blugenie/artifacts/tactical-artifacts-by-category/file-and-folder-query/query-for-malicious-file-types-in-all-users-and-system-temp-directories.md): AID2201202326.YAML
- [Query Malicious file types from any directory not including the default OS and Install directories](/blugenie/artifacts/tactical-artifacts-by-category/file-and-folder-query/query-malicious-file-types-from-any-directory-not-including-the-default-os-and-install-directories.md): AID2201220858.YAML
- [Query all users for their Powershell Profile content for Powershell, Powershell\_ISE, and VS Code](/blugenie/artifacts/tactical-artifacts-by-category/file-and-folder-query/query-all-users-for-their-powershell-profile-content-for-powershell-powershell_ise-and-vs-code.md): AID2201232312.YAML
- [Query to Determine if any lolbin files are installed outside the normal OS and Program Files dir's](/blugenie/artifacts/tactical-artifacts-by-category/file-and-folder-query/query-to-determine-if-any-lolbin-files-are-installed-outside-the-normal-os-and-program-files-dirs.md): AID2201232312.YAML
- [Network Query](/blugenie/artifacts/tactical-artifacts-by-category/network-query.md)
- [Query for Unusual Windows Network Activity](/blugenie/artifacts/tactical-artifacts-by-category/network-query/query-for-unusual-windows-network-activity.md): AID2201222121.YAML
- [Process Query](/blugenie/artifacts/tactical-artifacts-by-category/process-query.md)
- [Query for all Processes not running from the Windows and Program Files.\* Directories](/blugenie/artifacts/tactical-artifacts-by-category/process-query/query-for-all-processes-not-running-from-the-windows-and-program-files.-directories.md)
- [Registry Query](/blugenie/artifacts/tactical-artifacts-by-category/registry-query.md)
- [Query Information from the Registry on Recentdocs, Recentapps](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-information-from-the-registry-on-recentdocs-recentapps.md): AID2112301441.YAML
- [Query Registry for a list of mounted USB storage devices, including external memory cards](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-registry-for-a-list-of-mounted-usb-storage-devices-including-external-memory-cards.md): AID2112302000.YAML
- [Query the Most Recently Used items from the Registry](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-most-recently-used-items-from-the-registry.md): AID2112302008.YAML
- [Query the Most Recently Open and Saved File information from the Registry](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-most-recently-open-and-saved-file-information-from-the-registry.md): AID2112302009.YAML
- [Query all Run, RunOnce, and RunOnceEx Registry Keys](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-all-run-runonce-and-runonceex-registry-keys.md): AID2112302012.YAML
- [Query Command list from the MRU Registry List](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-command-list-from-the-mru-registry-list.md): AID2112302013.YAML
- [Query Startup Services from the Registry](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-startup-services-from-the-registry.md): AID2112302014.YAML
- [Query Map Network Drives from the Registry](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-map-network-drives-from-the-registry.md): AID2112302017.YAML
- [Query Shell Folders and User Shell Folders from both the HKLM and HKU Registry Information](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-shell-folders-and-user-shell-folders-from-both-the-hklm-and-hku-registry-information.md)
- [Query Typed Urls from the Registry](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-typed-urls-from-the-registry.md): AID2112302023.YAML
- [Query Current Control Set Services information from the Registry](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-current-control-set-services-information-from-the-registry.md): AID2112302027.YAML
- [Query Accessibility Features from Image File Execution Options from the Registry](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-accessibility-features-from-image-file-execution-options-from-the-registry.md): AID2112302043.YAML
- [Query the Registry for Commands that are automatically executed each time cmd.exe is run](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-commands-that-are-automatically-executed-each-time-cmd.exe-is-run.md): AID2112302048.YAML
- [Query the Registry for Mounted Device information](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-mounted-device-information.md): AID2112302049.YAML
- [Query the Registry for Browser Helper Objects (BHO)](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-browser-helper-objects-bho.md): AID2112302103.YAML
- [Query the Registry for Explore Run commands](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-explore-run-commands.md): AID2112302128.YAML
- [Query the Registry for Winlogon Helper Dll's](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-winlogon-helper-dlls.md): AID2112302152.YAML
- [Query the Registry for Active Setup information](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-active-setup-information.md): AID2201032000.YAML
- [Query the Registry for Bypassing UAC Mechanisms from the User-Accessible information](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-bypassing-uac-mechanisms-from-the-user-accessible-information.md): AID2201032010.YAML
- [Query the Registry for User-Logon, and Startup Scripts](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-user-logon-and-startup-scripts.md): AID2201032020.YAML
- [Query the Registry for the most common MRU information for All User Hives, including offline users](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-the-most-common-mru-information-for-all-user-hives-including-offline-users.md): AID2201202337.YAML
- [Query the Registry for any user, using the SysInternals Tools](/blugenie/artifacts/tactical-artifacts-by-category/registry-query/query-the-registry-for-any-user-using-the-sysinternals-tools.md)