Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Tool

Evidence-gap checker

Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.

A named executable was run on this host.

collect, in this order

  1. Prefetch

    C:\Windows\Prefetch\<NAME>-<HASH>.pf

    survivesUntil rolled out by the 1024-entry cap. On a normal workstation this is months.

    does not proveWHO ran it — Prefetch carries no user context at all

  2. UserAssist

    NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

    survivesUntil the profile is removed.

    does not proveAnything launched from a console, a script, a service or a scheduled task — this is GUI activity only, so most attacker tooling is absent

  3. Amcache.hve

    C:\Windows\AppCompat\Programs\Amcache.hve

    survivesLong — often the full life of the installation.

    does not proveExecution, despite being widely cited as an execution artifact — presence is what it records

  4. Shimcache (AppCompatCache)volatile

    SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

    survivesUntil pushed out by the 1024-entry cap, which on a busy host can be days.

    does not proveEXECUTION. This is the mistake to avoid. On Windows 10 and 11 there is no execution flag at all, and even on Windows 7 the flag was unreliable

  5. srum

    Collect it. The full entry, paths, retention and limitations, lives in the artifact reference, and this one is part of membership.

the trap

Shimcache. An entry means Windows saw the file, not that it ran, on Windows 10 and 11 there is no execution flag at all. Presence in Shimcache and Amcache together still only establishes that the binary was there.

if you find nothing

Prefetch is capped at 1024 entries and is off by default on servers, so absence is weak evidence on a busy or server host. Check whether prefetching is even enabled before drawing a conclusion.

Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.