Query the Most Recently Used items from the Registry

AID2112302008.YAML

#####aid_begin
#description: fetch the information from lastvisitedmrus
#id: aid2112302008
#processtype: query
#category: registry
#sourcelink: <na>
#tacticidlist: <na>
#techniqueidlist: <na>
#compatibleos: |-
#  windows 7
#  windows 8.*
#  windows 10
#  windows 11
#  windows server 2008 r2
#  windows server 2012
#  windows server 2012 r2
#  windows server 2016
#  windows server 2019
#compatibleengine: |-
#  powershell 2
#  powershell 3
#  powershell 4
#  powershell 5.*
#  powershell 7.*
#bgcommandlist: |-
#  get-bgregistry
#notes: |-
#  this key correlates to the previous opensavemru key to provide extra information. whenever a new entry is added to the previous opensavemru key, registry value is created or updated in this key. each binary registry value under this key contains a recently used program executable filename, and the folder path of a file to which the program has been used to open or save it.         
#####aid_end
commands:
- Get-BGRegistry -StartKey "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU"
- Get-BGRegistry -StartKey "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU"