Host-Based Analysis
Domain 3, Host-Based Analysis, is about 20%. It tests reading endpoint evidence - Windows event logs, Sysmon, Linux authentication logs, process trees, file artifacts - and reaching a conclusion without destroying evidence.
Windows evidence
- Security log: 4624 successful logon, 4625 failed logon, 4648 explicit credentials, 4672 special privileges, 4688 process creation, 4720 account created, 4732 local group member added, 4740 lockout, 4698 scheduled task created. Service installation is System log 7045.
- Sysmon: 1 process create (command line and hashes), 3 network connect, 7 image loaded, 8 CreateRemoteThread, 10 process access, 11 file create, 13 registry value set, 22 DNS query.
- Persistence: Run and RunOnce keys, services, scheduled tasks, WMI event subscriptions, startup folder, DLL search-order hijacking.
- Injection behaviors: process hollowing, DLL injection, remote thread creation; parent-child anomalies such as winword.exe spawning powershell.exe.
- LOLBins: certutil, mshta, rundll32, regsvr32, wmic, powershell -enc.
Linux evidence
/var/log/auth.log (Debian) or /var/log/secure (RHEL) for authentication; auditd for syscall auditing; /etc/passwd for UID 0 accounts; sudoers, cron, systemd units and LD_PRELOAD for persistence. ~/.bash_history is user-editable and incomplete, so corroborate it.
Worked example
Sysmon event 1 shows WINWORD.EXE as parent of powershell.exe -nop -w hidden -enc SQBFAF..., then event 3 to 185.x.x.x:443. A scheduled task (4698) appears two minutes later.
Reasoning: Office applications do not normally spawn PowerShell. The encoded command hides intent, the network event gives an external destination, and the scheduled task provides persistence. Isolate the host but leave it powered, capture memory, export the logs, hash suspicious files, then hunt the same command line and destination on other endpoints.
Traps
- Relying on bash_history as proof.
- Confusing 4624 with 4625, or 4688 with Sysmon 1 (4688 lacks command line unless auditing is configured).
- Shutting down or reimaging before volatile capture. RFC 3227 order: registers and cache, RAM, swap, network state, running processes, disk, backups.
- Assuming an antivirus detection defines scope.