search

EricZimmerman / AppCompatCacheParser

AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10
MIT License
110 stars 21 forks source link

Insert Flag being used as proof of execution on Windows 10 #9

Open kwilson7770 opened 4 months ago

kwilson7770 commented 4 months ago

The SANS instructor Chad Tilbury for the On Demand FOR508 course mentioned that the AppCompatCacheParser misleadingly labels the Insert Flag as proof of execution in the "Executed" column. He goes on to explain that it is an unreliable method of determining execution on modern systems (Windows 10+) despite being used for this purpose in the past.

My suggestion is to rename this column to Insert Flag to allow the the analyst to make the determination of execution.

EricZimmerman commented 4 months ago

That's part of understanding the artifact and training. It can be used for evidence of execution and insert flag takes away from that imo