Windows Forensic — Audit Log Cleared
picoCTF เป็นเกม ด้าน computer security ที่จัดโดย มหาวิทยาลัย Carnegie Mellon หรือ CMU ที่มุ่งเป้าไปที่นักเรียนมัธยมและ มหาวิทยาลัยให้มาแสดงทักษะความสามารถ
Description
- They installed software using an installer they downloaded online
- They ran the installed software but it seemed to do nothing
- Now every time they bootup and login to their computer, a black command prompt screen quickly opens and closes and their computer shuts down instantly.
The analysis of Windows Event Logs should follow the digital forensic methodology recommended by the National Institute of Standards and Technology (NIST SP 800-86), which includes the stages of collection, examination, analysis, and reporting.
Collection of digital evidence
Evidence Type: Windows Event Log
Windows_Logs_original.evtx > Windows_Logs_analysis.evtx
- Event Viewer
- PowerShell
Examination of forensic artifacts
| Log Type | Description |
|---|---|
| Security | Authentication events |
- 1102 Audit Log Cleared
- 1033 Windows Installer
- 4657 Registry Value Modified
- 1074 System Shutdown
Attackers or malicious software may clear logs in order to:
-
hide malicious activities
-
remove traces of system compromise
-
prevent investigators from reconstructing the attack timeline
Therefore, this event is often associated with anti-forensic behavior.
- hide commands
- store configuration data
- conceal indicators of compromise
The presence of Event ID 4657 suggests that the installed program modified the Windows Registry, which may indicate that malware created a persistence mechanism.
Relationship to the Incident Scenario
The employee reported:
1️⃣ They installed software downloaded from the internet
2️⃣ The software appeared to do nothing
3️⃣ A command prompt briefly appears during login
4️⃣ The computer shuts down immediately
The forensic evidence supports this narrative.
Evidence Correlation Timeline
Analysis and timeline reconstruction
Time Event ID Event03:55:14 1102 Audit log cleared03:55:57 1033 Software installed03:56:19 4657 Registry modified
Reporting and documentation of findings
Investigation Conclusion
The analysis of Windows Event Logs revealed a sequence of suspicious events.
Key findings include:
-
Installation of potentially malicious software
-
Registry modification suggesting persistence mechanism
-
Programmatic system shutdown initiated by shutdown.exe
These events indicate a likely malware infection affecting the system.
Further investigation should include:
-
malware analysis
-
registry artifact examination
-
disk forensic analysis
.png "Windows Forensic — Audit Log Cleared")
Ref:
PicoCTF
Digital forensic analysis conducted according to:
-
NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response
อ่านเพิ่มเติม:
- picoCTF
- log file Analysis
- การตรวจสอบเหตุการณ์การเปิดและปิดระบบบนระบบปฎิบัติการวินโดว์
- Identifying uninstalled software using Event Logs with Osforensics
- How to Determine the Last Shutdown Time and Date in Windows
- How To Check If Someone Else Is Using Your Computer
- Windows Activate Event log
- Wi-Fi History Forensic Investigation
- Windows Event Viewer
* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ
#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud
.png)
