UserAssist

Per-user record of programs launched through the GUI, kept by Explorer to power the Start menu. It is the artifact that answers "which account did this", which Prefetch and Shimcache cannot.

windows · Execution · T1204.002

where it lives

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

Windows 7 through 11

Value names are ROT13-encoded, which is obfuscation rather than protection and is undone by every parser.

what it proves

A specific user account launched a program through the GUI
Run count and last execution time
Focus time and focus count, which distinguishes something opened and used from something opened and closed

what it does not prove

Anything launched from a console, a script, a service or a scheduled task — this is GUI activity only, so most attacker tooling is absent
Execution on a host the user has not logged into interactively

parsing it

UserAssist (Didier Stevens)
RegRipper
Registry Explorer

tampering and anti-forensics

Cleared by the same tools that clear browser history, and the absence of entries for a period a user was demonstrably logged on is itself a finding.

how long it survives