#investigationpath — Public Fediverse posts

Investigation Scenario 🔎

While reviewing Amcache.hve, you notice C:\Users\Public\Libraries\SyncHost.exe executed once, but no corresponding Prefetch file exists despite Prefetch being enabled. The file is not present at that location.

What do you look for to investigate whether an incident occurred?

Bonus Exercise: List several of the potential explanations for this behavior

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation.

No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command?

To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

A Windows 11 workstation’s Microsoft-Windows-TaskScheduler/Operational log contains Event ID 106, indicating a new scheduled task named "OneDrive Update Service" was registered at 5:45 PM local time. The user insists they were away from the computer when this happened.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You’ve found ~/.config/systemd/user/dbus-update.service enabled for a user account on an Ubuntu system. The service executes ~/.local/bin/dbus-update, an ELF binary that isn’t owned by any installed package.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

An LLM has reviewed domain authentication logs and suggested that an account is likely compromised, based on several successful authentication clusters that occurred frequently over the past week.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

While hunting, you identify an outlier host with a Windows Prefetch file named RUNDLL32.EXE-3F2A9B1C[.]pf The file shows a run count significantly higher than the baseline observed across the environment, with multiple recorded execution timestamps occurring overnight.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You've discovered a Sysmon log (EID 13) showing reg.exe writing a value into the HKCU\Software\firm\soft\Name registry key.

What do you look for to investigate whether an incident occurred and the extent of its impact?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You notice Event ID 7040 in the System log. The startup type of the Remote Registry service changed from Disabled to Manual for 14 minutes, then back to Disabled. No corresponding service-install events exist.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

An employee's Android phone recently made multiple connections to an IP address associated with prior malicious activity.

The /data/system/packages.xml file shows a recently installed APK named com[.]secure.update, signed with an unknown cert.

What do you look for to investigate whether an incident occurred and assess its impact?

Bonus Points: Mention which evidence sources you'd leverage to answer your questions

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

A host on your network downloaded a file with this SHA256 hash: 9297af5f66486d11540f15b44d4b6beec6ff89dbc4dcdee898db9a7daaa76085

What do you look for to investigate whether the malware infected the host? You can only make two queries -- make them count.

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You've discovered a user workstation with the Chrome Remote Desktop plugin installed. There's no business reason for the user to have this plugin, and they don't recall installing it.

What do you look for to investigate whether an incident occurred and the extent of its impact?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

While creating new user accounts in Active Directory, you find that several legitimate user accounts with no apparent connection are part of an undocumented group named "test".

What do you look for to investigate whether an incident occurred? Focus on the efficiency of your investigative actions here.

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

A high-level company exec received an email that someone logged into their social media account from a country they were not in. The exec noted that they use the same password in several places.

What do you look for to investigate whether an incident occurred on the corporate network?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You believe a Linux server was used as a jump box to pivot into another network segment, but the network traffic would not have crossed a sensor boundary for logging.

What evidence do you look for to prove the belief?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You run IT for a public high school. A teacher observed a student using AI to generate ideas for accessing the school grading system and reported it.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

A user reports their hard drive is full, but they don't know why. While investigating, you find a series of large, password-protected RAR files that the user knows nothing about.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You've discovered a host with multiple instances of Chrome running the --hidden option.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

Browser history for an HR user shows repeated visits to chat.openai[.]com, followed by creation of C:\Users\chris\AppData\Local\Temp\cleanup[.]ps1. The file is not available, and the hash shows no matches in OSINT resources.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

A host on your network executed the command “netsh wlan show profile” for the first time.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

Your SIEM flags an OAuth consent grant to “Adobe Secure Share” from a user's M365 account at 07:13 AM. The audit log shows consent to files.readwrite.all.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You receive a SIEM alert about this file:

C:\Users\bose\Downloads\report.doc

The file copied itself to %TEMP% and the original copy was deleted.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You find Event ID 7045 showing a new service installed: WinUpdateCheck, pointing to C:\ProgramData\wucheck.exe. You report to the SOC lead that this system is infected and needs to be contained.

They ask you to justify that request.

What evidence do you present to elevate this from “suspicious service creation” to confirmed malicious activity? Lead with your strongest likely evidence sources and conclusions.

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

A user reports OneDrive crashing on startup. You see OneDrive.exe launched as expected, but then you spot conhost.exe spawned within 2 seconds, followed by mshta.exe -- no obvious error dialogs.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

Several of your key developers had Notepad++ installed during the time period when the project was believed to have been compromised.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You received an alert that the creation date of a file was changed to a prior year.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

You know an attacker accessed several customer support workstations in the past month based on discovery of a consistent persistence mechanism. You suspect wider access, but auth logs only go back 24h.

How can you determine where else the attacker went?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

While reviewing group membership on a Windows domain, you discover that the account of a former IT employee is still active. They left the company nearly a year ago.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

While reviewing asset scanning reports, you’ve discovered a Mint Linux system that does not appear on any change request.

What do you look for to investigate the origin of the system and whether malicious activity occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

While reviewing web logs on a Linux Apache server, you discover inbound requests for PHP pages. However, the server is not reported to host PHP content.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Investigation Scenario 🔎

A Windows system executed dsa.msc for the first time.

What do you look for to investigate whether an incident occurred AND its scope?

#InvestigationPath #DFIR #SOC