shimcache

Here are 6 public repositories matching this topic...

KrishnenduOfficial / winforensics-correlator

A fast, cross-artifact Windows forensic timeline correlator in Python. Automatically stitches fragmented telemetry from MFT, SRUM, Shimcache, and BAM to spot timestomping, ghost execution, and account-level activity in one unified timeline.

incident-response dfir threat-hunting digital-forensics timeline-analysis srum windows-forensics shimcache timestomping

Updated Sep 19, 2026
Python

tagalston101 / x-way-forensics-tool

Star

X-Ways Forensics Community Edition

Updated Dec 10, 2025

Abdulfatah-Abdillahi / TRACE-Forensic-Triage-Engine

Star

AI-assisted forensic triage tool that correlates Windows Amcache, Prefetch and ShimCache artifacts with threat intelligence. A constrained LLM reasoning engine produces explainable verdicts. Capstone project.

incident-response prefetch dfir digital-forensics threat-intelligence amcache llm shimcache

Updated Nov 1, 2026
Python

ayinedjimi / ShimCacheDatabaseParser

Star

C++ ShimCache (AppCompatCache) parser for execution artifact forensics

cpp incident-response dfir digital-forensics windows-security shimcache

Updated Feb 20, 2026
C++

Devzinh / GhostTrace

Star

Read-only Windows forensic scanner for software traces persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks correlation. 20+ modules mapped to MITRE ATT&CK.

windows csharp dotnet persistence incident-response prefetch forensics dfir threat-hunting forensic-analysis blue-team mitre-attack artifact-collection shimcache

Updated Jul 24, 2026
C#

SecurityRonin / shimcache-forensic

Star

Windows AppCompatCache (ShimCache) forensic analyzer — reads the AppCompatCache value from a SYSTEM hive and r

windows rust forensics dfir shimcache execution-evidence appcompatcache

Updated Aug 20, 2026
Rust

Add this topic to your repo

To associate your repository with the shimcache topic, visit your repo's landing page and select "manage topics."

Learn more