cit.telemetry#

$ target-query <path/to/target> -f cit.telemetry
Details#

Module

os.windows.regf.cit.CITPlugin

Output

records

Module documentation

Plugin that parses CIT data from the registry.

Reference: - https://dfir.ru/2018/12/02/the-cit-database-and-the-syscache-hive/

Function documentation

Parse CIT process telemetry answers from the registry.

In some versions of Windows, processes would get “telemetry answers” set on their process struct, based on if certain events happened.

Generally only available before Windows 10.