I85PREP
⌘ K
CCOA study materials
CCOA study resources

CCOA (ISACA): Endpoint and Host-Based Investigation

CCOA · Work through your exam, one topic at a time.

All guide sections

Endpoint and Host-Based Investigation

This domain tests reconstruction of host activity from Windows event logs, Sysmon, EDR telemetry, and filesystem artifacts, and knowing which source answers which question.

Windows event and Sysmon anchors

  • 4688 process creation (command line only if "Include command line in process creation events" audit policy is enabled).
  • 4624 logon success: type 2 interactive, 3 network, 5 service, 7 unlock, 10 RDP, 11 cached. 4625 failure, 4648 explicit credentials, 4672 special privileges assigned, 4720 account created, 4732 group membership added, 4768/4769 Kerberos TGT/TGS, 7045 service installed.
  • Sysmon: 1 process create (with parent and hashes), 3 network connect, 7 image load, 8 CreateRemoteThread, 10 ProcessAccess (LSASS reads), 11 file create, 12/13/14 registry, 22 DNS query, 23 file delete.
  • PowerShell 4104 script block logging is what lets you decode -enc payloads; 4103 is module logging.

Filesystem and execution artifacts

  • Prefetch (limited history, often disabled on servers), Amcache, ShimCache, BAM/DAM, SRUM for per-process network usage.
  • $MFT and $UsnJrnl for creation timestamps and evidence of deleted files.
  • Linux: auth.log, auditd rules, cron/systemd timers for persistence, /proc and ss -antp for live state. Shell history is corroboration, not proof.

Worked example

Sysmon 1 shows WINWORD.EXE spawning cmd.exe, which spawns powershell.exe -nop -w hidden -enc <base64>. Sysmon 3 then shows the PowerShell process connecting to 45.9.x.x:443, and Sysmon 11 shows a file written to C:\Users\Public\svchost.exe. Reasoning: Office spawning a shell is a classic execution chain; the hidden window and encoded command are intentional obfuscation, so pull event 4104 to decode the script. The file named svchost.exe outside System32 is a path anomaly, and a later Sysmon 1 for that path with a parent of explorer.exe would indicate user-launched execution. Each hop in the chain must be evidenced by its own event.

Traps that cost marks

  • Confusing 4624 type 3 (network) with type 2 (interactive) and misreading a remote logon as console access.
  • Assuming 4688 contains a command line when the audit policy was never enabled.
  • Treating missing Prefetch as proof of non-execution rather than as an artifact limitation.
  • Mixing local time in the log with UTC in the SIEM, shifting your timeline by hours.