← Write-ups
Windows forensics1 min readSample

Proving execution with Prefetch and Amcache

Two artifacts that show a program ran on a machine, what each one tells you, and what each one does not.

PECmdAmcacheParserT1204 User Execution

The question

"Did this program run?" comes up in almost every case. A file on disk only shows it existed. Two artifacts help show execution.

Prefetch

Windows records the name of an executable, how many times it ran and the last run times in a .pf file under C:\Windows\Prefetch.

bash
$ PECmd.exe -d "C:\Windows\Prefetch" --csv D:\case\out

Prefetch can be turned off, and it is limited on servers, so a missing file does not prove the program never ran.

Amcache

Amcache records programs that were present or run, with file paths and SHA-1 hashes. The hash lets you check the file against threat intelligence even after the file is deleted.

bash
$ AmcacheParser.exe -f "C:\Windows\appcompat\Programs\Amcache.hve" --csv D:\case\out

Amcache shows a program was on the system, and in some entries that it ran. Read it together with Prefetch.

Putting it together

Artifact Shows Limit
Prefetch Run count and last run times Can be disabled
Amcache Path and hash of the program Not always proof of execution

When both agree, you can say the program ran with more confidence. Add the event logs to anchor the time.

More write-ups

See all →
Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection Writing a Sigma rule for suspicious service creationA short, testable rule that flags new Windows services whose binary sits in a user-writable folder. Detection