Insert Flag being used as proof of execution on Windows 10

[kwilson7770]

The SANS instructor Chad Tilbury for the On Demand FOR508 course mentioned that the AppCompatCacheParser misleadingly labels the Insert Flag as proof of execution in the "Executed" column. He goes on to explain that it is an unreliable method of determining execution on modern systems (Windows 10+) despite being used for this purpose in the past.

My suggestion is to rename this column to Insert Flag to allow the the analyst to make the determination of execution.

[EricZimmerman]

That's part of understanding the artifact and training. It can be used for evidence of execution and insert flag takes away from that imo