Prefetch Analysis

:: Parse all Prefetch files in a directory
:: PECmd.exe from Eric Zimmermann Tools

:: Parse all .pf files, output CSV
PECmd.exe -d "D:\evidence\C\Windows\Prefetch" --csv "D:\analysis\prefetch" --csvf prefetch.csv -q

:: CSV output columns:
::   SourceFilename    — the .pf filename
::   SourceCreated     — when the .pf file was created (not execution time)
::   SourceModified    — when the .pf was last updated (correlates to last run)
::   ExecutableName    — name of the executable
::   Hash              — path hash (used to disambiguate same-name executables)
::   Size              — prefetch file size
::   Version           — Windows version
::   RunCount          — total times run
::   LastRun           — most recent execution timestamp
::   PreviousRun0..6   — up to 7 prior run timestamps (Windows 10+)
::   Directories       — directories accessed on first run
::   FilesLoaded       — files (DLLs etc) accessed on first run

:: Parse a single .pf file with full detail (loaded files list)
PECmd.exe -f "D:\evidence\C\Windows\Prefetch\MIMIKATZ.EXE-A1B2C3D4.pf" -q

# Hunt for suspicious executables in Prefetch CSV output
$pf = Import-Csv "D:\analysis\prefetch\prefetch.csv"

# Executables that ran from suspicious locations
$suspiciousLocations = @(
    "\\TEMP\\",
    "\\APPDATA\\LOCAL\\TEMP\\",
    "\\USERS\\PUBLIC\\",
    "\\PROGRAMDATA\\",
    "\\RECYCLE",
    "\\WINDOWS\\TASKS\\"  # scripts in Tasks dir
)

foreach ($loc in $suspiciousLocations) {
    $pf | Where-Object { $_.ExecutableName -match [regex]::Escape($loc) } |
        Select-Object ExecutableName, RunCount, LastRun |
        ForEach-Object {
            Write-Host "SUSPICIOUS LOCATION: $($_.ExecutableName)"
            Write-Host "  Runs: $($_.RunCount), Last: $($_.LastRun)"
        }
}

# Known attacker tool names
$toolNames = @(
    "MIMIKATZ", "MIMI", "PROCDUMP", "PWDUMP",
    "PSEXEC", "PSEXESVC", "COBALT", "COBALTSTRIKE",
    "METERPRETER", "BEACON", "RUBEUS", "BLOODHOUND",
    "SHARPHOUND", "LAZAGNE", "WCEWIN", "FGDUMP",
    "GSECDUMP", "GETSYSTEM", "GETPASS"
)

foreach ($tool in $toolNames) {
    $pf | Where-Object { $_.ExecutableName -match $tool } |
        Select-Object ExecutableName, RunCount, LastRun
}

# Executables with unusual names — single char names, numeric names
$pf | Where-Object {
    $name = ($_.ExecutableName -split "\\")[-1] -replace "\.EXE$",""
    $name -match "^[a-z0-9]{1,3}$"  # 1-3 char names are unusual
} | Select-Object ExecutableName, RunCount, LastRun

# Build a chronological execution timeline from Prefetch data
# Combines all run timestamps (up to 8 per entry) into a flat timeline

$pf = Import-Csv "D:\analysis\prefetch\prefetch.csv"

$timeline = @()

foreach ($entry in $pf) {
    # Add LastRun
    if ($entry.LastRun -and $entry.LastRun -ne "") {
        $timeline += [PSCustomObject]@{
            Timestamp  = [datetime]$entry.LastRun
            Executable = ($entry.ExecutableName -split "\\")[-1]
            FullPath   = $entry.ExecutableName
            RunCount   = $entry.RunCount
        }
    }

    # Add PreviousRun0 through PreviousRun6 if they exist
    for ($i = 0; $i -le 6; $i++) {
        $col = "PreviousRun$i"
        if ($entry.$col -and $entry.$col -ne "") {
            $timeline += [PSCustomObject]@{
                Timestamp  = [datetime]$entry.$col
                Executable = ($entry.ExecutableName -split "\\")[-1]
                FullPath   = $entry.ExecutableName
                RunCount   = "(prior run $i)"
            }
        }
    }
}

# Sort by time and filter to incident window
$incidentStart = [datetime]"2026-09-15 00:00:00"
$incidentEnd   = [datetime]"2026-09-20 23:59:59"

$timeline |
    Where-Object { $_.Timestamp -ge $incidentStart -and $_.Timestamp -le $incidentEnd } |
    Sort-Object Timestamp |
    Format-Table Timestamp, Executable, FullPath -AutoSize