Overview
AppCompatCacheParser is a command line tool developed by Eric Zimmerman, to process the ShimCache (AppCompatCache) on Windows operating systems, identifying items such as:
- Executable filepaths
- Timestamp of last execution
Results can output the hive entries files into .csv for further analysis. Further Information the ShimCache can be found on Darkcybe - Evidence of Execution
| Tool Name | Version | MITRE ATT&CK Tactic | MITRE ATT&CK Technique |
|---|---|---|---|
| AppCompatCacheParser | V1.5 | Execution |
Instructions
Interesting Fields
- Path: Full filepath of executable
- LastModifiedTimeUTC: Timestamp in UTC of last modification
- Executed: Execution flag (applications can be shimmed without being executed)
Parsing the ShimCache (AppCompatCache) on a Live System
1
appcompatcacheparser.exe --csvf %OUTPUT_FILENAME%.csv --csv %OUTPUT_DIRECTORY%
Parsing the ShimCache (AppCompatCache) from a Forensic Copy
1
appcompatcacheparser.exe -f /PATH/TO/SYSTEM hive --csvf %OUTPUT_FILENAME%.csv --csv %OUTPUT_DIRECTORY%
Output
