Hunting for Attacker’s Tactics and Techniques With Prefetch Files

This report explains how Windows Prefetch artifacts can be leveraged in DFIR to validate execution and uncover adversary tactics, techniques, and procedures by examining metadata such as run counts, timestamps, volume info, and especially the “Files Referenced” list. Using real-world examples mapped to MITRE ATT&CK (e.g., CHM via hh.exe T1223, CMSTP T1191, Regsvr32 T1117, Application Shimming via sdbinst T1138, PsExec/Windows Admin Shares T1077, and file deletion via SDelete T1107), it shows how Prefetch parsing (e.g., with PECmd) can reveal the specific scripts, databases, and payloads executed, supporting investigations across initial access, execution, persistence, lateral movement, and cleanup.