Investigating Windows Endpoints

Investigating Windows Endpoints

Windows records execution, persistence, and access in dozens of artifacts the attacker rarely cleans completely. The event logs are only the surface -- the registry, prefetch, amcache, and the file-system journals corroborate or contradict them. The investigation is cross-referencing independent artifacts into one timeline that no single cleared log can defeat.

When to Use

• Triaging a compromised or suspicious Windows host, live or from an image
• Working through a KAPE, Velociraptor, or EDR triage collection
• Reconstructing what executed on a Windows machine and in what order
• Parsing EVTX / Sysmon / PowerShell logs to reconstruct attacker activity
• Hunting persistence and lateral-movement traces across the endpoint
• Detecting timestomping, log clears, and other on-host anti-forensics

When NOT to Use

• The host is Linux -- use analyzing-linux-persistence
• You need the overall IR process and multi-host coordination -- use responding-to-incidents; come here when one Windows host is the focus
• You have a RAM capture to work -- use analyzing-memory-images; come here for the on-disk artifacts
• The compromise is in cloud identity, not on the endpoint -- use investigating-m365-entra
• Proactive fleet-wide hunting with no specific host -- use hunting-threats
• You are the attacker on the host, not the responder -- use escalating-windows-privileges

Triage Collection First

Do not analyze the live disk in place. Collect a triage set, hash it, and work on the copy. For most incidents a targeted triage collection answers the question faster than a full image; image only the hosts that matter.

Dead vs. live acquisition. A powered-off host or a mounted disk image is a dead acquisition -- consistent, but you lose running processes, network state, and unflushed logs. A live host lets you capture volatile state (memory, netstat -anob, Get-NetTCPConnection, tasklist /svc) but every action mutates the disk; record what you touch. Capture memory first if the host is live and "are they still here" is open, then hand it to analyzing-memory-images.

:: KAPE targeted triage -- the fastest way to a defensible artifact set
kape.exe --tsource C: --target !SANS_Triage --tdest E:\out\host01 --vhdx host01
:: Broader coverage: registry hives, event logs, $MFT/$J, browser, prefetch
kape.exe --tsource C: --target KapeTriage,RegistryHives,EventLogs,FileSystem ^
  --tdest E:\out\host01

:: Then run the parsers (Modules) over what you collected
kape.exe --msource E:\out\host01 --mdest E:\out\host01\parsed ^
  --module !EZParser

Velociraptor (Windows.KapeFiles.Targets) collects the same set at fleet scale over an agent. Whatever the tool, verify hashes before and after every copy.

Key artifact directories to make sure your collection contains:

C:\Windows\System32\winevt\Logs\          Event logs (.evtx)
C:\Windows\System32\config\               Registry hives: SYSTEM, SOFTWARE, SAM, SECURITY
C:\Users\<u>\NTUSER.DAT                    Per-user registry hive
C:\Users\<u>\AppData\Local\Microsoft\Windows\UsrClass.dat   Shellbags, COM
C:\Windows\Prefetch\                       *.pf execution evidence
C:\Windows\appcompat\Programs\Amcache.hve  Amcache
C:\Windows\System32\sru\SRUDB.dat          SRUM
C:\Windows\System32\Tasks\                 Scheduled task XML
C:\$MFT  C:\$Extend\$UsnJrnl  C:\$LogFile  Filesystem journals
C:\$Recycle.Bin\                           Deleted-file $I records

Evidence of Execution

Multiple independent artifacts record that a binary ran. Cross-reference them -- agreement raises confidence, disagreement is itself a finding.

:: Prefetch -- run count, first/last run, files/dirs the binary touched.
:: Absent on most Servers; disabled on SSD-only systems -- note that, don't assume.
PECmd.exe -d C:\Windows\Prefetch --csv E:\out\parsed -q

:: Amcache -- SHA-1 of executed/present binaries, compile times, driver load
AmcacheParser.exe -f C:\Windows\appcompat\Programs\Amcache.hve ^
  --csv E:\out\parsed -i

:: Shimcache / AppCompatCache (SYSTEM hive) -- path + last-modified; presence
:: means the file was seen, NOT necessarily executed. Order is roughly LRU.
AppCompatCacheParser.exe -f C:\Windows\System32\config\SYSTEM --csv E:\out\parsed

:: SRUM -- per-process bytes sent/received and CPU over 30-60 days.
:: Ties an executable to network volume even when netflow is gone.
SrumECmd.exe -f C:\Windows\System32\sru\SRUDB.dat ^
  -r C:\Windows\System32\config\SOFTWARE --csv E:\out\parsed

From the user (NTUSER.DAT / UsrClass.dat) hives, parse GUI-execution and file-access evidence with RECmd:

:: UserAssist (GUI program launches, run count, focus time),
:: BAM/DAM (background/desktop activity moderator: last-run per exe per SID),
:: RecentDocs, and RunMRU in one pass with the bundled batch file
RECmd.exe -d C:\Users --bn BatchExamples\UserActivity.reb --csv E:\out\parsed

• Jump Lists (...\Recent\AutomaticDestinations\*.automaticDestinations-ms) and LNK files (...\Recent\*.lnk) record opened files/apps with target path, volume serial, and MAC times -- parse with JLECmd and LECmd.
• RecentDocs and shellbags (below) show what folders and files were opened.

The Event-Log Workhorses

Parse EVTX first with a triage engine (Chainsaw / Hayabusa, below), then pivot into specific channels. The IDs that carry the most weight:

Security (Security.evtx):

• 4624 logon success -- decode Logon Type: 2 interactive, 3 network (SMB, shares, PtH), 10 RemoteInteractive (RDP), 9 NewCredentials (runas /netonly, often Overpass-the-Hash). Pivot on LogonId to correlate a session's activity.
• 4625 logon failure -- password spraying and brute force by source IP.
• 4672 special privileges assigned -- admin-equivalent logon; pair with 4624 to flag privileged sessions.
• 4648 explicit-credential logon -- runas and lateral movement.
• 4688 process creation -- with command-line auditing enabled, the full command line and parent process. The single most valuable Security event.
• 4720/4722/4738 account created/enabled/changed; 4728/4732/4756 member added to a global/local/universal privileged group (Domain Admins, local Administrators) -- attacker account and group manipulation.
• 4698/4699/4702 scheduled task created/deleted/updated.
• 7045 (System log) new service installed; 7036 service state change -- the PsExec and lateral-tooling signature.
• 1102 the audit log was cleared -- an anti-forensic act and itself an indicator; correlate the gap it leaves.

Sysmon (Microsoft-Windows-Sysmon/Operational), if deployed, is the richest source:

• 1 process create (with hashes, command line, parent) -- 3 network connection -- 7 image/DLL load (unsigned DLLs, sideloading) -- 8 CreateRemoteThread (injection) -- 10 process access (LSASS handle = credential dumping) -- 11 file create -- 12/13/14 registry create/set/rename (autoruns) -- 15 file-stream create (Zone.Identifier, ADS) -- 22 DNS query -- 23/26 file delete.

PowerShell:

• 4104 script-block logging (Microsoft-Windows-PowerShell/Operational) -- deobfuscated script content; hunt for -enc, FromBase64String, DownloadString, IEX, AMSI-bypass strings. 4103 module/pipeline logging. 400/800 in Windows PowerShell.evtx (engine start, version -- a v2 downgrade is evasion).

RDP / TerminalServices:

• Security 4778/4779 session reconnect/disconnect (RDP or Fast User Switching, not a fresh logon -- that is 4624). 1149 in TerminalServices-RemoteConnectionManager (auth succeeded -- user + source IP). 21/22/25 in TerminalServices-LocalSessionManager (logon, shell start, reconnect).

WMI (Microsoft-Windows-WMI-Activity/Operational): 5857 provider loaded, 5858 operation error, 5859-5861 permanent event-subscription registration -- WMI persistence.

Task Scheduler (Microsoft-Windows-TaskScheduler/Operational): 106 task registered, 140 updated, 141 deleted, 200/201 action executed/completed -- corroborates Security 4698.

Persistence Hunting

Sweep every autostart, not the handful your tool checks by default. This is the defensive mirror of establishing-persistence -- read that skill for how each mechanism is planted, then hunt for the traces here.

• Run keys -- ...\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce, per SOFTWARE and each NTUSER.DAT; also ...\Policies\Explorer\Run.
• Services -- SYSTEM hive ...\Services; correlate installs with 7045.
• Scheduled tasks -- C:\Windows\System32\Tasks\ XML (parse the Actions and Triggers); correlate 4698 / TaskScheduler 106.
• WMI event subscriptions -- __EventFilter, __EventConsumer, __FilterToConsumerBinding in the OBJECTS.DATA repository; Get-WMIObject -Namespace root\subscription -Class __EventConsumer.
• Startup folders -- ...\Start Menu\Programs\Startup\ (per-user and All Users).
• Winlogon -- Shell, Userinit, Notify under ...\Winlogon; anything appended after explorer.exe / userinit.exe.
• IFEO -- Image File Execution Options\<exe>\Debugger (and GlobalFlag + Silent Process Exit) hijacking a legit binary.
• COM hijacks -- user-hive Software\Classes\CLSID\...\InprocServer32 shadowing a HKLM CLSID.
• LSA / SSP -- ...\Lsa\Security Packages and Notification Packages; ...\Lsa\OSConfig.
• BITS jobs -- bitsadmin /list /allusers /verbose or parse ...\Microsoft\Network\Downloader\qmgr*.dat for download-and-execute jobs.

:: Autoruns from Sysinternals, offline against a mounted image, VirusTotal + verify
autorunsc.exe -accepteula -a * -h -s -c -o autoruns.csv "\\?\E:\mount"
:: RECmd has batch files that dump every autostart location from the hives
RECmd.exe -d E:\out\host01 --bn BatchExamples\RegistryASEPs.reb --csv E:\out\parsed

Lateral-Movement Traces

Movement leaves paired artifacts on source and destination. Correlate by time, account, and source IP.

• Network logons -- destination Security 4624 Type 3 (SMB/admin shares, PtH) and Type 10 (RDP); 4648 on the source. A Type 3 with NTLM to a domain-joined host where Kerberos was expected is a pass-the-hash signature. A Type 9 (NewCredentials) points to Overpass-the-Hash / runas /netonly.
• PsExec / service-based exec -- 7045 service install (random or PSEXESVC-style name) plus 7036 start on the destination; 5145 if detailed file-share auditing logged the \ADMIN$\<svc>.exe write. RemCom and similar clones follow the same 7045+7036 pattern.
• WMI / WinRM exec -- WMI-Activity 5857-5861, wmiprvse.exe spawning a child in Sysmon 1; WinRM over 5985/5986 (HTTP/HTTPS), with Microsoft-Windows-WinRM/Operational and 4624 Type 3.
• Admin-share access -- C$, ADMIN$, IPC$ in 5140/5145; correlate with the tool written to ADMIN$.
• SMB / file staging -- 5140/5145 and $MFT entries for tools dropped to the destination.