fox-it
Create Windows 11 Program Compatibility Assistant plugin
Partial support was added in https://github.com/fox-it/dissect.target/pull/120 remaining artefacts mentioned in https://github.com/fox-it/dissect.target/issues/119 are still to be implemented.
Original post: Program Compatibility Assistant is supposedly a new artefact introduced in Windows 11 pro 2h22. Contains evidence of execution of binaries. Really nice to have as an additional plugin for investigators and IOC checks.
More research could done on our end to figure out the nitty gritty. But an initial implementation would be a nice to have
source: https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/
Include the registry path HKEY_USERS\[...]\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
