Skip to content
Get packs

Prefetch Execution History Analysis

Reads Windows Prefetch files to show which programs ran, when, and how often.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent knows how to read Windows Prefetch files, small cache files Windows creates to speed up program launches but which also record evidence that a program ran. The agent guides an investigator through copying these files from a forensic disk image, hashing them for integrity, and parsing them with tools such as PECmd or Python, then reports run counts, last-run timestamps, and referenced files and DLLs. It also searches for names of common attack or remote-access tools to help build a timeline of execution during an incident.

Great for

  • Digital forensics and incident response analysts examining a Windows disk image
  • Security teams confirming whether a suspicious binary actually executed
  • Investigators correlating program execution with other forensic artifacts

Skip it if

  • Live systems or cases where the forensic copy has not been preserved, since the agent works from files and does not verify chain of custody on its own
  • Windows Server systems, where Prefetch is disabled by default and the files may be absent
  • Windows 10 and later files in compressed MAM format, which the bundled Python code cannot fully decode and which need PECmd instead

Try asking

  • “Parse the Prefetch folder from this disk image and list every program with its run count and last run time”
  • “Confirm whether mimikatz or PsExec ever ran on this workstation and when”
  • “Build an execution timeline from these .pf files and export it to CSV”
  • “Hash the Prefetch files and summarise any remote-access tools that appear”
Step-by-step guide: how to use Prefetch Execution History AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-prefetch-files-for-execution-history.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-prefetch-files-for-execution-history.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-prefetch-files-for-execution-history.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a read-only copy of the evidence and record the SHA-256 hashes before analysis, as the workflow shows.
  • Treat a Prefetch entry as evidence of execution only; cross-check with event logs, Amcache, or ShimCache before drawing conclusions.
  • Windows 10 and later files are compressed; use PECmd for full parsing rather than the bundled Python header reader.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.