2026-05-21

Windows.Registry.UserAssist

https://github.com/Velocidex/velociraptor/blob/master/artifacts/definitions/Windows/Registry/UserAssist.yaml

Improved UserAssist output to populate GUID values and present execution data more clearly for analysis.

Notes#

The original submission was PR #4840, but the final upstream change was resubmitted and merged by Mike Cohen as #4841 on 2026-05-21.

This update improves Windows.Registry.UserAssist by expanding GUID-based paths into more meaningful values and cleaning up the overall output format for better presentation.