Query the Registry for any user, using the SysInternals Tools

#####aid_begin
#description: registry query - query all user registry hives for the use of sysinternals tools
#id: aid2201231953
#processtype: query
#category: registry
#sourcelink: <na>
#tacticidlist: <na>
#techniqueidlist: <na>
#compatibleos: |-
#  windows 7
#  windows 8.*
#  windows 10
#  windows 11
#  windows server 2008 r2
#  windows server 2012
#  windows server 2012 r2
#  windows server 2016
#  windows server 2019
#compatibleengine: |-
#  powershell 2
#  powershell 3
#  powershell 4
#  powershell 5.*
#  powershell 7.*
#bgcommandlist: |-
#  invoke-loadallprofilehives
#  get-bgloadedreghives
#  get-bgmruactivityview
#  invoke-bgunloadallprofilehives
#notes: |-
#  this query will load all local user registry hives, scan each user hive under hkey_users, and unload any registry hives loaded by the first command.
#####aid_end
commands:
- Invoke-BGLoadAllProfileHives
- Get-BGLoadedRegHives
- Get-BGRegistry -Path HKEY_USERS\SOFTWARE\Sysinternals
postcommands:
- Invoke-BGUnLoadAllProfileHives