investigating-windows-endpoints

Investigating Windows Endpoints

Windows records execution, persistence, and access in dozens of artifacts the attacker rarely cleans completely. The event logs are only the surface -- the registry, prefetch, amcache, and the file-system journals corroborate or contradict them. The investigation is cross-referencing independent artifacts into one timeline that no single cleared log can defeat.

When to Use

• Triaging a compromised or suspicious Windows host, live or from an image
• Working through a KAPE, Velociraptor, or EDR triage collection
• Reconstructing what executed on a Windows machine and in what order
• Parsing EVTX / Sysmon / PowerShell logs to reconstruct attacker activity
• Hunting persistence and lateral-movement traces across the endpoint
• Detecting timestomping, log clears, and other on-host anti-forensics

When NOT to Use

• The host is Linux -- use analyzing-linux-persistence
• You need the overall IR process and multi-host coordination -- use responding-to-incidents; come here when one Windows host is the focus
• You have a RAM capture to work -- use analyzing-memory-images; come here for the on-disk artifacts
• The compromise is in cloud identity, not on the endpoint -- use investigating-m365-entra
• Proactive fleet-wide hunting with no specific host -- use hunting-threats
• You are the attacker on the host, not the responder -- use escalating-windows-privileges

Triage Collection First

Do not analyze the live disk in place. Collect a triage set, hash it, and work on the copy. For most incidents a targeted triage collection answers the question faster than a full image; image only the hosts that matter.

Dead vs. live acquisition. A powered-off host or a mounted disk image is a dead acquisition -- consistent, but you lose running processes, network state, and unflushed logs. A live host lets you capture volatile state (memory, netstat -anob, Get-NetTCPConnection, tasklist /svc) but every action mutates the disk; record what you touch. Capture memory first if the host is live and "are they still here" is open, then hand it to analyzing-memory-images.