EvidenceOfExecution
Evidence of execution related files
- 13 paths from 5 artifacts
- Version 1.1
- Eric Zimmerman
Paths on disk
13 paths from 5 targets
Includes 5 targets
Each one is collected with this target
Notes
ShimCache is not included in this Compound Target, as that would require pulling the entire SYSTEM Registry Hive. To ensure the ShimCache is pulled and parsed, use RegistryHivesSystem.tkape and parse with AppCompatCacheParser.mkape