AppCompatCacheParser
How to use AppCompatCacheParser to parse the Windows ShimCache or AppCompatCache registry in order to provide evidence of program execution during incident investigations.
AppCompatCacheParser is a command line tool developed by Eric Zimmerman, to process the ShimCache (AppCompatCache) on Windows operating systems, identifying items such as:
Executable filepaths
Timestamp of last execution
Results can output the hive entries files into .csv for further analysis. Further Information the ShimCache can be found on Darkcybe - Evidence of Execution
Tool Name | Version | MITRE ATT&CK Tactic | MITRE ATT&CK Technique |
---|---|---|---|
V1.5 |
Instructions
Parsing the ShimCache (AppCompatCache) on a Live System
Parsing the ShimCache (AppCompatCache) from a Forensic Copy
Interesting Fields
Path: Full filepath of executable
LastModifiedTimeUTC: Timestamp in UTC of last modification
Executed: Execution flag (applications can be shimmed without being executed)
Output
![AppCompat Cache Parser](https://darkcybe.gitbook.io/~gitbook/image?url=https%3A%2F%2F1729410104-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FUWgoU3Cxbipx0MCPbAcJ%252Fuploads%252FaLhgiTMYlHefZBCg4Sui%252FAppCompatCacheParser.png%3Falt%3Dmedia%26token%3Df85dee8a-2960-44d6-b23f-0504bf94e7c6&width=768&dpr=4&quality=100&sign=8daa039e&sv=1)
Sources
Last updated