This value controls whether Windows logs application launch activity to the UserAssist and RunMRU keys. When set to 1 (default), app tracking is enabled. When set to 0, application launch tracking is disabled, significantly reducing the availability of user activity artifacts for forensic reconstruction.

A subject modifying this setting may be attempting to operate without leaving standard execution traces, making it a low-noise anti-forensics technique that can persist across sessions and reboots.

Sections

ID	Name	Description
AF007.003	Disabling Application Launch Tracking via Registry	The subject modifies the Windows Registry to disable the operating system’s application launch tracking, thereby preventing the creation of key forensic artifacts used to reconstruct user activity. This technique suppresses the generation of records in RunMRU (Run Most Recently Used) and UserAssist, both of which are commonly referenced in forensic timelines to identify command execution and GUI application use. By setting the registry value: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs = 0` Windows stops logging user application launches, resulting in missing or incomplete histories. This technique is subtle and persistent, particularly effective on systems where registry auditing is not actively enforced. Example Scenario: A subject disables application tracking on a corporate workstation using a script that sets `Start_TrackProgs = 0` under their HKCU hive. Over several days, they use various portable administrative tools (e.g., credential viewers, compression utilities) without creating entries in RunMRU or UserAssist. When an internal investigation is launched, investigators find an unexpected absence of user activity in these artifacts, delaying attribution and requiring deeper memory analysis to reconstruct events.
PR040.003	Testing Endpoint and Application Controls	A subject performs a limited action on an organizational endpoint to determine whether software restrictions, endpoint security controls, browser management, device controls, or application policies prevent or report the behavior. The subject may install a low-impact unauthorized application, add a browser extension, execute a portable utility, alter a minor endpoint setting, or attempt to run software from an unusual location. They may also connect a removable device or use a test script to establish whether application allowlisting, Endpoint Detection and Response (EDR), antivirus, mobile device management, or device-control policies are active. The test may be designed to resemble ordinary experimentation or troubleshooting. Investigators should consider whether the subject subsequently used the same installation method, application type, device, or control weakness to support data collection, persistence, circumvention, or another infringement.

MITRE ATT&CK® Mapping (1)

ATT&CK Enterprise Matrix Version 19.1