Skip to content

AppPaths

Evidence: AppPaths
Description: Enumerate AppPaths
Category: System
Platform: windows
Short Name: apppaths
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

The App Paths registry key allows applications to register custom search paths so they can be launched by name without specifying the full path. When a user types just the executable name (e.g., “chrome”), Windows searches the App Paths registry to find the full path.

Malware can abuse this mechanism to hijack application launches or establish persistence by registering malicious executables under legitimate application names.

This collector gathers structured data about apppaths.

FieldDescriptionExample
KeyNameApplication executable namechrome.exe
KeyDefaultValueDefault value (full path to exe)C:\Program Files\Google\Chrome\Application\chrome.exe
PathAdditional search pathC:\Program Files\Google\Chrome\Application
UsernameUser account (empty for HKLM)user or empty
KeyPathRegistry key pathSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
LastWriteTimeRegistry key last write time2023-10-15T14:30:00
RegPathPath to registry hiveRegistry/SOFTWARE or Registry/ntuser.dat

This collector searches both machine and user registry locations:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\*
  • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\*

For each application, it reads:

  • Default value (full executable path)
  • Path value (additional search path)
  • Registry key last write time

App Paths can reveal application installations and detect persistence mechanisms. Investigators use this data to identify registered applications, detect application hijacking, track custom executable paths, identify persistence mechanisms, verify application locations, and detect malware masquerading as legitimate applications.