domains / families / security / analyzing-windows-amcache-artifacts

analyzing-windows-amcache-artifacts

separate

'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s

When to use

• Determining which programs have existed or executed on a Windows system during incident response
• Correlating SHA-1 hashes from Amcache against known malware databases (VirusTotal, CIRCL, MISP)
• Building an application installation and execution timeline for forensic investigations
• Identifying deleted executables that leave traces in Amcache even after file removal
• Investigating insider threats by documenting which portable or unauthorized applications were present
• Analyzing driver loading history to detect rootkits or malicious kernel modules

When not to use

• sole proof of program execution

Skill page

Source