BAM vs UserAssist: Two Per-User Execution Artifacts
BAM and UserAssist both tie program execution to a user. Compare their locations, timestamps, run counts, coverage of GUI and background launches and retention.
Posts tagged: #user-attribution
BAM SID to Username: Attributing Execution to a User
How BAM ties programs to accounts: reading the SID, resolving it via ProfileList, SAM or the domain, well-known SIDs like SYSTEM and DWM, and traps to avoid.