What Windows execution artifacts actually prove

You have closed this case before. Shimcache shows the binary, so the report says it ran. Nobody asked what Shimcache actually records.

Five artifacts on a Windows host get called evidence of execution. They are not interchangeable, and only some of them earn the name. One proves a file existed at a path. One hands you a hash of a file that is already deleted. One proves a program ran, and how many times. One proves it moved data. Treating them as one category is how a timeline ends up confidently wrong.

Presence is not execution

The distinction that matters is not which artifact is newest or most detailed. It is which question each one answers.

Did this file exist on this host? Shimcache and Amcache speak to that.

Did this program run? Prefetch, BAM and SRUM speak to that.

How much data did it move? Only SRUM speaks to that.

An artifact that answers the first question cannot answer the second, no matter how precise its timestamp looks.

Shimcache (AppCompatCache)

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

Proves: the file existed at that path, and the shim engine saw it.

Does not prove: that it ran. The timestamp Shimcache stores is the file's last modified time, not an execution time. Copy a binary to disk and never launch it, and it can still land here.

How it fails: the cache is written to the registry at shutdown. On a host that has not rebooted, the most recent entries exist only in memory. Pull the hive from a live box and you may be reading yesterday's state while assuming it is current.

What it is good for: ordering. Entries sit in most-recently-inserted order, which gives you relative sequencing even when the timestamps tell you nothing about execution.

Amcache

C:\Windows\AppCompat\Programs\Amcache.hve

Proves: the file was present and catalogued, with a SHA-1 hash, full path, size and publisher metadata.

Why it matters: the hash. When an attacker deletes their tooling, Amcache may still hold the SHA-1 of a file you no longer have. That is the difference between something ran from a temp folder and a hash you can pivot on across the estate.

The contested part, stated as contested: vendor write-ups commonly describe the Root\File key's last modified time as a first-execution time. Amcache is populated largely by the Microsoft Compatibility Appraiser inventory task, which catalogues files that were not necessarily launched. Treat an Amcache entry as strong evidence of presence and a reliable source of hash and path. Do not close a case on it as proof of execution without a second artifact.

Prefetch

C:\Windows\Prefetch\*.pf

Proves: execution. This is the one that earns the name. Run count, first run time, and on Windows 8 and later the last eight run times, plus the files and directories the process touched during startup.

How it fails: it is frequently disabled on servers, and the store is capped at 1024 entries on Windows 8 and later, 128 on Windows 7. On a busy host, an execution from three weeks ago may simply have aged out. Absence here is not absence of execution.

BAM and DAM

HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\[SID]

Proves: execution, with a last run timestamp, attributed to a user SID. That attribution is the value. Prefetch tells you a program ran; BAM tells you under whose account.

How it fails: retention is roughly a week. It answers who, recently, not who, last quarter.

SRUM

C:\Windows\System32\sru\SRUDB.dat

Proves: that an application ran and what it consumed. Bytes sent and received, per application, per user, typically across 30 to 60 days.

Why it is underused: it is the only one of the five that speaks to volume. When the question is whether data left, SRUM answers it rather than implying it.

How it fails: aggregation is coarse, roughly hourly. It will tell you 400 MB left via that process on that afternoon. It will not give you the minute.

Reading them together

Shimcache proves a file existed at a path. It does not prove execution. It persists until cache rollover and is written at shutdown.

Amcache proves presence and gives you a SHA-1 and a path. Execution is contested. It survives deletion of the file itself.

Prefetch proves execution with run counts and run times. It does not tell you who. Capped at 1024 entries on Windows 8 and later, and often disabled on servers.

BAM and DAM prove execution per user SID. They say nothing about data volume and retain about a week.

SRUM proves execution and bytes moved. Timing is coarse. Roughly 30 to 60 days.

A defensible finding usually needs two of these answering different questions. Shimcache plus Prefetch turns the file was there into the file was there and it ran. Prefetch plus BAM turns it ran into it ran as this account. Either plus SRUM turns it ran into it ran and moved 2 GB.

Four ways this goes wrong

Reading the Shimcache timestamp as a run time. It is the file's modification time. This is the most common error in this category.

Treating an empty artifact as a clean host. Prefetch is off on the server. BAM aged out. Shimcache has not flushed because the box has not rebooted. None of that is evidence that nothing happened.

Building a whole timeline on one artifact. Each answers one question. One artifact is a lead, not a finding.

Forgetting that root changes the rules. An attacker with SYSTEM can delete Prefetch files and clear the BAM keys. On a host you believe was fully compromised, local artifacts are a starting point and your corroboration lives off the box.

Frequently asked questions

Does Shimcache prove a program was executed?

No. It proves the file existed at that path and was seen by the application compatibility engine. The timestamp is the file's last modified time. Pair it with Prefetch, BAM or SRUM before concluding execution.

What is the difference between Shimcache and Amcache?

Both speak to presence. Amcache additionally records a SHA-1 hash, file size and publisher metadata, which makes it valuable when the file itself has been deleted. Shimcache gives you insertion ordering.

Which artifact actually proves execution?

Prefetch is the strongest, with run counts and run times. BAM adds the user SID. SRUM adds resource consumption.

If the artifacts are empty, is the host clean?

No. Prefetch is often disabled on servers, BAM retains about a week, and an attacker with SYSTEM can remove local traces. Empty means look elsewhere, not that nothing happened.

What This Means for Your Team

Execution evidence is a set of narrow answers, not one verdict. Decide which question you are asking before you pick the artifact, then corroborate with one that answers a different question. The conclusion that survives review is the one built on two artifacts that fail in different ways.

Inception Protection

Inception Protection is Inception Security's MDR on the Defender and Sentinel stack you already pay for. We correlate endpoint execution evidence with identity and network telemetry, so a finding does not rest on a single artifact that may have been cleared.

Inception Foresight

Want a clearer view of the visibility gaps that affect investigations like this? Grab our free Inception Foresight M365 Assessment. No strings. Follow Inception Security on LinkedIn and @inceptionsec on X.