Detections
- ID: DT032
- Created: 31st May 2024
- Updated: 31st May 2024
- Contributor: The ITM Team
Windows Thumbcache
Thumbnail Cache, a feature introduced in Windows operating systems starting with Windows Vista, enhances the user experience by caching thumbnail images of files. This functionality, when enabled, speeds up and makes loading these images more efficient in various views, such as File Explorer, by generating preview images or thumbnails for various multimedia files.
This artifact can provide evidence of the presence of files even if they have been deleted.
Sections
| ID | Name | Description |
|---|---|---|
| AF015 | File Deletion | A subject deletes a file or files to prevent them from being available for later analysis or to disrupt the availability of a system. This could include log files, files downloaded by the subject, files created by the subject, or system files. |
| IF002.008 | Exfiltration via USB to Mobile Device | The subject uses a USB cable, and any relevant software if required, to transfer files or data from one system to a mobile device. This device is then taken outside of the organization's control, where the subject can later access the contents. |