DECAF much like COFFEE is useless..

I have a script similar to Coffee that is more indepth (geared towards malware) and is a simple batch file. DECAF does not prevent the log generation that includes most of the same commands that COFFEE invokes. It appears that DECAF blocks the COFFEE executable and that’s it. As you know the COFFEE executable is merely a pretty front-end for those afraid of the command line and scripts out commands that can be run from the prompt but adds in a pretty more presentable analysis (read: html)

The commands each profile of Coffee Runs:
"Volatile Data"
ipconfig, nbtstat, net, pslist, whoami, quser, psloggedon, netstat, sclist, showgrps, systeminfo

"Incident Response"
at, autoruns, getmac, handle, hostname, ipconfig, msinfo32, nbtstat, net, netdom, netstat, openfiles, pslist, psloggedon, psservice, pstat, psuptime, quser, route, sc, sclist showgrps, srvcheck, tasklist, whoami

All are readily available free from SysInternals, MS Resource Kits, and the internet.... MS is so gracious enough to include the switch operators for each command though!

And... it's gone.

DECAF Neutralized