ShimcacheParser

ShimcacheParser.py -r SYSTEM > shim.csv

Extracts the ShimCache (AppCompatCache) from the SYSTEM hive, the Windows kernel program execution log.

Run it when you need the execution log that the kernel maintains: the ShimCache (AppCompatCache) stores in the SYSTEM hive the list of executables with their path, size, and last execution — and it is especially valuable because the system updates it continuously and it is difficult to fully clean (attackers delete prefetch, but ShimCache resists them). In IR, ShimCache answers 'what ran on this system?' from the registry — the payload and attacker tools with their trace. The parser runs from Linux (Python), allowing you to analyze hives without a Windows machine.

Do not use it as a complete log: ShimCache has limited capacity (it gets overwritten with new executions) and does not store reliable timestamps in all Windows versions (only last execution, and in some versions without time). Deleted files from the system (attacker cleanup) leave the ShimCache entry without the file — the finding is the entry, not confirmation. And watch out: the parser needs the correct SYSTEM hive (the one from the analyzed system, not the analysis host); hives in use are copied first. For exact temporal correlation, combine with Amcache and MFT.