Some of my co-workers recently became aware of information maintained in the Windows Registry by the LANDesk softmon utility, which is pretty fascinating when you look at it. The previously-linked post states that, "LANDesk Softmon.exe monitors application execution..."...so not just installed applications, or just services, but application execution. The post goes on to state:
Unfortunately, if an application is no longer available the usage information still lives on in the registry.
This goes back to what I've said before about indicators on Windows systems, particularly within the Registry, persisting beyond the deletion or removal of the application, which is pretty awesome.
The softmon utility maintains some basic information about the executed apps within the Software hive, with subkeys named for the path to the app. The path to the keys in question is:
MonitorLog\<path to executed app>
Information maintained within the keys includes the following values:
- Current User
- First Started
- Last Started
- Last Duration
- Total Duration
- Total Runs
This information isn't nearly as comprehensive as something like Sysmon, of course, but it's much better than nothing.
Sysforensics posted a LANDesk Registry Entry Parser script on GitHub, about 2 yrs ago. Don Weber wrote the original landesk.pl RegRipper plugin back in 2009, and I made some updates to it in 2013. There's also a landesk_tln.pl plugin that incorporates the data into a timeline.