📎 AI Summary:
In this thread, an aspiring security investigator shares that they are preparing a response plan for a compromised Windows 10 system and is seeking advice on additional logs and sources to analyze beyond Event Viewer. Another user responds with a comprehensive list of potential sources of evidence, including network logs, process information, registry keys, browser history, and specialized logs like Sysmon and PowerShell. They also recommend consulting the MITRE ATT&CK framework and reading relevant security literature to enhance investigation effectiveness. The overall tone is informative and supportive, aiming to broaden the original poster’s forensic approach.
C

Cmann

New Member
Joined
Jan 26, 2020
Messages
14
Thread Author #1
Hi I am an aspiring computer security investigator, I am currently creating a security respondent plan for a hacked Windows 10 machine. I’m using forensic autopsy software for testing purposes.

I have no idea what the hack is yet, I’ve just been told to think of possible scenarios of where to look. Currently I’m knowledgeable on Event Viewer but I need to be more flexible with my approach, if you have any recommendations that would be brilliant
 

Solution
Neemobeer
There are quite a few and also dependent on what logging in the environment.
Some are...
  • DNS logs
  • DHCP logs
  • Running Processes
  • Schedule Tasks
  • Firewall logs and rules(local)
  • Prefetch cache
  • Event logs
  • Files and hashes
  • Services
  • IIS or other web server logs
  • syslog
  • Powershell logging (if enabled)
  • Current network connections ( usually need a memory dump and analysis)
  • MRU lists for different applications
  • Browser cache and history
  • Autorun keys and startup directories
  • UserInit reg
  • Sysmon logs (has to be installed and enabled)
  • Installed Applications

Handy list to look at
MITRE ATT&CK®
Link Removed

Good books to read
Link Removed

Link Removed
Sort by date Sort by votes
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Joined
Jul 4, 2015
Messages
8,995
#2
There are quite a few and also dependent on what logging in the environment.
Some are...
  • DNS logs
  • DHCP logs
  • Running Processes
  • Schedule Tasks
  • Firewall logs and rules(local)
  • Prefetch cache
  • Event logs
  • Files and hashes
  • Services
  • IIS or other web server logs
  • syslog
  • Powershell logging (if enabled)
  • Current network connections ( usually need a memory dump and analysis)
  • MRU lists for different applications
  • Browser cache and history
  • Autorun keys and startup directories
  • UserInit reg
  • Sysmon logs (has to be installed and enabled)
  • Installed Applications

Handy list to look at
MITRE ATT&CK®
Link Removed

Good books to read
Link Removed

Link Removed
 

Last edited:
Upvote 1 Downvote
Solution
You must log in or register to reply here.