ShimCache (AppCompatCache)

Location

Description

Application Compatibility Cache stored in the SYSTEM registry hive, recording file path, size, and last modification timestamp for executables the OS considered for compatibility shimming.

Forensic Value

ShimCache records executables that existed on disk even if they were never executed (on Windows 10+, execution flag is no longer set). Entries are ordered chronologically and written to the registry only at shutdown, making the insertion order a coarse timeline. Useful for confirming an attacker tool was present on disk at a particular time.

Tools Required

Collection Commands

kape.exe --tsource C: --tdest C:\output --target RegistryHives

AppCompatCacheParser.exe -f C:\output\SYSTEM --csv C:\output --csvf ShimCache.csv

rip.exe -r C:\output\SYSTEM -p appcompatcache

Collection Constraints

• •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.

MITRE ATT&CK Techniques

References