...and the question is

If you’ve followed me for any amount of time, particularly recently, you’ll know that I’ve put some effort forth in correcting the assumption that individual artifacts, particularly ShimCache and AmCache, provide “evidence of execution”. The is a massive oversimplification of the nature and value of each of these artifacts, in addition to just being an extremely poor analytic process; that …