How to use the Windows Amcache Forensics agent skill

What the skill makes the agent do

Amcache.hve is a Windows registry file that records programs, drivers and devices that have been on a computer. With the skill installed, the agent can walk an investigator through collecting the hive and its LOG1 and LOG2 files, parsing it with Eric Zimmerman's AmcacheParser, and reviewing the output in Timeline Explorer.

The agent can also help flag suspicious entries such as unsigned files, executables in temp or download folders and odd compile dates, check SHA-1 hashes against threat intelligence sources, and build a timeline. A Python helper script, scripts/agent.py, reads the hive with the regipy library and looks for suspicious paths and tool names.

Install the skill

You can install the skill in one of two ways. Download the ZIP from the skill's page on this site and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder to share it with a team. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

The package contains SKILL.md, scripts/agent.py and references/api-reference.md. Keep the folder structure intact so the agent can find the reference file.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into your project's .claude/skills/
• Claude apps: Settings → Capabilities → Skills, then upload

Install what the skill needs

The skill does not replace the forensic tools. You need to supply them. The skill lists these requirements: Python 3 with the regipy library (for scripts/agent.py), Eric Zimmerman's AmcacheParser and Timeline Explorer (Windows tools you download separately), the .NET 6+ runtime, and access to a forensic image or triage copy of Amcache.hve and its LOG1/LOG2 files.

The regipy library is installed with pip, as shown in the reference file.

• Optional: a VirusTotal account and API key for hash lookups (vt-cli)
• Optional: Registry Explorer for manual hive inspection
• Optional: an NSRL SHA-1 whitelist for filtering known-good files

Trigger the skill with natural requests

You do not need special syntax. Describe the task in plain language and mention Amcache or the hive file. The agent should load the skill when your request matches its description, which covers Amcache forensics, program execution evidence and application compatibility cache investigations.

Give the agent the context it needs: the incident window, where the evidence copy is stored and whether you are working from a mounted image or a triage collection.

• "Parse this Amcache.hve from our triage collection and list programs installed in the last 48 hours."
• "Help me find unsigned executables in the Amcache output that ran from AppData or Downloads."
• "Check the SHA-1 hashes from Amcache against VirusTotal and CIRCL hashlookup."
• "Build an Amcache timeline for the incident window and document which drivers were loaded."

Work through a typical investigation

The skill follows a workflow. First, acquire Amcache.hve with its transaction logs, because AmcacheParser replays uncommitted transactions from the LOG files to recover more complete data. Second, run AmcacheParser to produce CSV files. Third, review file entries in Timeline Explorer for unsigned files and suspicious paths. Fourth, correlate SHA-1 hashes with threat intelligence. Fifth, review program entries and driver binaries.

The output includes AssociatedFileEntries, ProgramEntries, DeviceContainers, DevicePnps and DriverBinaries CSV files, among others.

• Acquire: copy Amcache.hve, Amcache.hve.LOG1 and Amcache.hve.LOG2 from a mounted image
• Parse: AmcacheParser.exe -f with --csv to an output folder
• Review: Timeline Explorer on Amcache_AssociatedFileEntries.csv
• Correlate: extract SHA-1 values and check them against threat intelligence

Safety notes: scripts and network access

This skill runs scripts and uses the network. The helper script reads the hive locally with regipy, but the threat intelligence steps send file hashes to external services such as VirusTotal and CIRCL hashlookup. Hashes leave your environment when you run those lookups, so check your evidence-handling policy first and do not submit sensitive case material without approval.

Read scripts/agent.py before running it and confirm it matches your expectations. Run it against copies of evidence, never the original.

• Use only on authorized systems and with proper evidence handling
• Work from copies; the live hive is locked by the system
• Review any network lookup before running it on a sensitive case

Tips for better results

Amcache shows file presence and registration, not proof that a program ran. The skill itself says to combine it with ShimCache (AppCompatCache) and Prefetch evidence for conclusive findings. Tell the agent which of these artifacts you also have.

Be specific about the time window and the paths you care about. A narrow incident window and a list of expected software make the unsigned and unusual-path filters far more useful.

• Always collect the LOG1 and LOG2 files with the hive
• Use an NSRL whitelist to remove known-good entries
• Cross-check any finding with a second artifact before reporting it