What is DFIR triage? (glossary)
DFIR triage is the rapid first-pass examination of a suspected-compromised host to determine, within minutes to a few hours, whether the system shows evidence of compromise. It uses a small set of high-yield artefacts collected and parsed quickly, in contrast to full-disk imaging followed by deep analysis.
The shape of a good triage:
- Collect a fixed artefact set fast.
- Parse with established CSV-producing tools.
- Filter each artefact with the canonical triage filter for that artefact (e.g. Amcache's "unsigned PE in user-writable path").
- Hash-pivot anything suspicious against VirusTotal and internal threat intel.
- Time-bound the incident window with the surviving suspicious indicators.
Whole-host triage takes minutes to hours, not days.
The standard Windows triage artefact set#
| Artefact | What it answers |
|---|---|
| Amcache | Was this PE binary present? With what hash and when? |
| Prefetch | Did this PE binary execute, and when? |
| Security event log (4624 / 4625 / 4648 / 4688) | Who logged on, who failed, with what credentials? What processes started, with what command line? |
| Sysmon (if deployed) | Real-time process / file / network / image-load telemetry. |
| SYSTEM hive | ShimCache (loader-touched binaries), services. |
| NTUSER.DAT (per user) | UserAssist, RunMRU, RecentDocs. |
| SOFTWARE hive | Auto-runs, installed software. |
| Browser history | Initial-access vector for phishing / drive-by. |
| Recent MFT | File-system creates around incident window. |
KAPE's !SANS_Triage compound target collects this set in one
invocation. Velociraptor's Windows.Forensics.Triage does the
same remotely.
Why Amcache is the triage workhorse#
Three properties make Amcache the natural first stop:
- One file, all PE presence.
Amcache.hvecovers every PE binary the appraiser saw — in one place. - Hashes for VirusTotal. Direct SHA-1 lookups; many detections take seconds.
- Survives deletion. Even if the attacker wiped their tools, Amcache holds the evidence.
The "unsigned PE in user-writable path" filter on the Unassociated entries produces a small list per host — typically under 50 rows on a typical infected workstation — and most rows either match a known TI hash or are quickly explained.
For the full Amcache-driven triage playbook, see Hunting commodity malware with Amcache.
Related terms#
- Amcache.hve — the triage workhorse.
- Prefetch — the execution-evidence artefact paired with Amcache.
- ShimCache — the kernel-loader cache.
- SRUM — the resource-usage long-window artefact.
Related posts
- Hunting commodity malware with Amcache
A practical Amcache-first triage playbook for commodity malware on Windows endpoints — the filters that surface attacker tooling, the pivots that confirm execution, and the cross-host queries that scope the incident.
- Volatility and Amcache: extracting the hive from memory images
A practical guide to recovering Amcache from a Windows memory image using Volatility — when memory-side recovery is the only option, which plugins to use, and how to hand off to AmcacheParser.
- RegRipper amcache plugin: what it does and when to use it
A practical guide to RegRipper's amcache plugin — what it parses, how its text output differs from AmcacheParser's CSV, and when to reach for it instead of (or alongside) the Zimmerman tool.
- What is SRUM (SRUDB.dat)? (glossary)
SRUM is the Windows System Resource Usage Monitor — an ESE database recording per-application CPU, network, and I/O usage in hour buckets over 30-60 days.