Registry: FeatureUsage
Brief
Maurice posted on LinkedIn recently about one of the FeatureUsage Registry key subkeys; specifically, the AppSwitched subkey. Being somewhat, maybe even only slightly aware of the Windows Registry, I read the post with casual, even mild interest.
Someone posted recently that cybersecurity runs on caffeine and sarcasm... I've got my cup of coffee right in front of me, and I've placed the sarcasm in front of us all. ;-)
The RegRipper featureusage plugin was originally written in 2019, and includes a reference to a Crowdstrike blog post written in 2020, authored by Jai Minton (who is now with Huntress). The figure to the right was captured from the blog post, and provides a succinct description of how the AppSwitched key is populated.
Specifically, Jai stated, "This key provides the number of times an application switched focus (was left-clicked on the taskbar)."