Attempt To Flush Shimcache
Shimcache flushing refers to the deliberate clearing or manipulation of the Application Compatibility Cache on a Windows system, which stores metadata about executables that have been run. This cache is valuable for forensic investigations because it provides evidence of program execution, even if the original binary has been deleted. Flushing shimcache could be considered suspicious because it is rarely performed during normal system operations and is often used by attackers to hide their tracks. By wiping this artifact, threat actors attempt to prevent incident responders from identifying which tools or malware were executed on the compromised system. This behavior is typically associated with anti-forensic techniques used by advanced persistent threats, malware, or red team operators.
Microsoft Sentinel (KQL)
