Update Windows.Timeline.Prefetch

2026-04-29

InfoGuard Labs

Windows.Timeline.Prefetch

http://github.com/Velocidex/velociraptor/blob/master/artifacts/definitions/Windows/Timeline/Prefetch.yaml

Updated the Prefetch timeline artifact to expose `ExecutablePath` and use the full executable path in evidence messages instead of only the binary name.

Notes#

The update adds ExecutablePath to the output and switches the generated timeline message to use the full executable path, which gives more context when triaging execution evidence.

Links#

http://github.com/Velocidex/velociraptor/blob/master/artifacts/definitions/Windows/Timeline/Prefetch.yamlss
https://github.com/Velocidex/velociraptor/pull/4811

Notes

Links