Forensic Analysis - Endpoint Artifacts, Network Evidence, and Timelines
Domain 2 - Forensic Analysis
This domain tests whether you can turn raw artifacts into a defensible narrative: which host and network records to pull, what each one can and cannot prove, and how to assemble them into a timeline.
Endpoint artifacts worth memorizing
Windows Security log: 4624/4625 logon success and failure, 4688 process creation, 4720 account created, 7045 service installed, 1102 audit log cleared. Sysmon: 1 process create, 3 network connect, 7 image load, 8 CreateRemoteThread, 11 file create, 22 DNS query. File-system and execution evidence: $MFT, $UsnJrnl, Prefetch, Amcache, ShimCache, Run keys, scheduled tasks, WMI subscriptions, and web shells. Linux: /var/log/auth.log, auditd, cron, systemd units, and /proc for live state - treat .bash_history as a hint, never as proof.
Network artifacts
NetFlow/IPFIX gives session metadata only - 5-tuple, byte and packet counts, timestamps, TCP flags - and never payload. To prove what left the network you need full packet capture, proxy logs, or file hashes. Zeek logs (conn, dns, http, ssl) and Wireshark/tshark display filters convert a capture into a timeline; Umbrella DNS logs expose DGA and tunneling patterns; FTD and ASA events show what the perimeter actually allowed.
Building the timeline
Normalize every source to UTC, sort, and locate the earliest malicious artifact - patient zero. Correlate across sources: a Sysmon network-connect at T, a firewall allow at T+1s, and a DNS answer at T-2s describe one event, not three.
Malware triage
Static first: hashes, imports, strings, embedded URLs. Then detonate in a sandbox (Cisco Secure Malware Analytics, formerly Threat Grid) and extract IOCs - hashes, domains, IPs, mutexes, registry keys - mapping behaviour to MITRE ATT&CK techniques so detection can be written as TTPs, not just indicators.
Worked example
Flows show a host sending a 1,100-byte DNS query to a random-looking subdomain of one parent domain every 60 seconds (±2 s), with consistent request/response sizes. Reasoning: periodicity plus high-entropy labels suggests DNS tunnelling or a beacon rather than browsing. Confirm in the capture by decoding the query, measuring label entropy, and checking whether TXT or NULL records carry data; then pivot to the endpoint to identify the parent process.
Traps
Trying to recover file contents from NetFlow; assuming an encrypted 443 session is benign because you cannot read it - use JA3, SNI, certificate, and packet-size/timing instead; mixing timezones across sources; chasing the first IOC and never checking for a second implant.