List of Windows Artifacts for Triage Analysis

29 Nov 2021 The_Croods 1 min

Share

Forensic Triage Past Present Furture

Triage helps For every forensic analysis, we need to answer the following questions for successful incident remediation and recovery, failed to identify key data points such as initial access and level of compromise will result in repeated security indents.

Artifact	Location
Event Logs	C:\Windows\System32\winevt\Logs
Registry	C:\Windows\System32\Config
$MFT	C:\$MFT
$UsnJrnl	c:\$Extend\$J
Amcache	C:\Windows\appcompat\Programs\Amcache.hve
User Assist	NTuser.Dat\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
ShimCache	SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache\AppCompatCache
StartUP	C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
JumpLists	C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations
ShellBags	Windows XP NTUSER.DAT\Software\Microsoft\Windows\Shell NTUSER.DAT\Software\Microsoft\Windows\ShellNoRoam NTUSER.DAT\Software\Microsoft\Windows\StreamMRU Windows 7 later NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU NTUSER.DAT\Software\Microsoft\Windows\Shell\Bags USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags
LNK Files	Windows XP C:\Documents and Settings\<username>\Recent Windows 7 Later C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent
Scheduled Tasks	C:\Windows\tasks C:\Windows\System32\tasks
powershell console history	C:\Users\<usrname>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine ConsoleHost_history.txt
Wmi	C:\WINDOWS\system32\wbem\Repository

Open source Forensic Triage Tools

Cylr

https://github.com/orlikoski/CyLR

Kape

https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape

Kansa

https://github.com/davehull/Kansa

IR triage

https://github.com/AJMartel/IRTriage

velociraptor

https://github.com/Velocidex/velociraptor

Share