Friday, January 4, 2019

Daily Blog #587: Forensic Lunch Test Kitchen 1/4/19 Server 2019 Amache

Hello Reader,
     Tonight we continued our exploration of Server 2019 with a look into how Amcache is behaving on it.

Here is what we learned:

  • Amcache is still scanning the desktop for executables and adding them to the Amcache when the Application experience scheduled task runs, even if the executable was never run
  • Like Server 2008 R2 Amcache is including the contents of the Desktop directory for executions and executables
  • Server 2019 appears to be storing command line executions! This is a very different behavior than we've seen before and requires more testing
You can watch the video here:

No comments:

Post a Comment