NetworkCards Registry Key

The NetworkCards registry key will provide the name and interface GUID of the system's attached network interface adatpers.

Analysis Value

🖥️System Enumeration

Operating System Availability

Major Version	Support	Major Version	Support
Windows 11	✅	Server 2019	✅
Windows 10	✅	Server 2016	✅
Windows 8	✅	Server 2012	✅
Windows 7	✅	Server 2008	✅
Windows Vista	✅	Server 2003	✅
Windows XP	✅

Artifact Location(s)

🔌 Offline System

• File: %SystemRoot%\System32\config\SOFTWARE

• Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\*

🔋 Live System

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\*

Artifact Parsers

• RegistryExplorer (Eric Zimmerman)

Artifact Interpretation

Each network interface adapter will have its own subkey with the following values:

• Description: The name of the network adapter

• ServiceName: The GUID of the network adapter

Examples

Description     REG_SZ      Microsoft Hyper-V Network Adapter
ServiceName     REG_SZ      {4C7FB48D-33EB-4277-A3FB-37D5EF39C990}

This example was produced on Windows Server 2019 Standard, Version 10.0.17763 Build 17763

Description     REG_SZ      Realtek USB GbE Family Controller
ServiceName     REG_SZ      {737FB1FE-88FF-4F5E-943A-A46C057E68B9}

This example was produced on Windows 10, Version 10.0.19044 Build 19044