Skip to content
Get packs

Windows Amcache Forensics

Lets the agent parse Windows Amcache.hve files to reconstruct program execution and install history for incident response.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Amcache.hve is a Windows registry file that records programs, drivers, and devices that have been on a computer. With this skill installed, the agent can guide an investigator through collecting that file, parsing it with Eric Zimmerman's AmcacheParser, flagging suspicious entries (unsigned files, executables in temp or download folders, odd compile dates), checking file hashes against threat intelligence sources, and building a timeline. It also includes a Python helper script that reads the hive with the regipy library and looks for suspicious paths and tool names.

Great for

  • Incident responders and DFIR analysts reviewing a Windows system after a suspected intrusion
  • Forensic examiners who need to document which programs or drivers existed on a machine
  • Security students learning Windows artifact analysis

Skip it if

  • Proving a program actually ran: the SKILL.md itself says Amcache shows file presence and registration, so it should be combined with ShimCache and Prefetch evidence
  • Live production systems without authorization or proper evidence handling, since the hive is locked and collection must follow forensic practice

Try asking

  • “Parse this Amcache.hve from our triage collection and list unsigned executables run from AppData or Temp”
  • “Correlate the SHA-1 hashes in this Amcache output against VirusTotal and NSRL and summarise unknowns”
  • “Build a timeline of program installs and driver loads from Amcache for the March 15 incident window”
Step-by-step guide: how to use Windows Amcache ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-windows-amcache-artifacts.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-windows-amcache-artifacts.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-windows-amcache-artifacts.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always collect Amcache.hve together with its .LOG1 and .LOG2 files so the parser can recover uncommitted data.
  • Treat Amcache results as supporting evidence and cross-check with Prefetch and ShimCache before drawing conclusions.
  • Review the hash-lookup steps before running them, since they send file hashes to external services such as VirusTotal and CIRCL.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.