GCFA Analyzing Volatile and Windows Event Artifacts — 15 Questions

Question 1

During a live response memory analysis, you identify a process running from the 'C:\Windows\Temp' directory that has an established network connection. Which artifact should be prioritized to determine the specific parent process that spawned this suspicious executable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The _EPROCESS structure. Analyzing the Process Environment Block (PEB) and associated parent process ID (PPID) in memory is critical for tracking process lineage. Attackers frequently utilize temporary directories for staging payloads. Identifying the parent process allows the analyst to determine the initial infection vector, such as a malicious macro in a document or a web server vulnerability exploitation, providing the necessary context to scope the incident beyond the single rogue process.

Answer

The Shimcache hive

Answer

The MFT $LogFile

Answer

The Amcache.hve file

Question 2

When analyzing Windows Event Logs for signs of credential dumping using LSASS access, which TWO Event IDs should an analyst primarily prioritize?

Accepted Answer

Event ID 4663. Event ID 4663 and 4656 are essential for monitoring access to sensitive objects. LSASS.exe is a protected process, and unauthorized attempts to open a handle to it are classic signatures of tools like Mimikatz. By correlating these event IDs with the Access Mask, analysts can distinguish between standard system operations and malicious attempts to read LSASS memory to extract credentials for lateral movement.

Answer

Event ID 4624

Answer

Event ID 4768

Answer

Event ID 4672

Question 3

Which volatile artifact is best suited to determine if a specific user account was actively logged into the system at the time a memory image was captured?

Accepted Answer

The Session Manager structures. The 'Logged-in user' information is often cached in memory structures related to the Winlogon process or session structures. Identifying active user sessions is a fundamental step in forensic triage, as it allows investigators to attribute specific process activity or network connections to a particular user, thereby distinguishing legitimate administrative tasks from unauthorized user activity occurring during an ongoing incident.

Answer

The system's Pagefile

Answer

The Shimcache artifact

Answer

The MFT $UsnJrnl

Question 4

Which Windows Event Log artifact is most reliable for determining the exact time a user account password was changed?

Accepted Answer

Event ID 4724. Event ID 4724 tracks password change requests. Security auditing is a cornerstone of forensic investigations because it provides a chronological audit trail of administrative actions. Understanding when credentials were altered is crucial for determining if an attacker gained unauthorized access and whether they attempted to establish persistence or facilitate lateral movement by modifying user accounts within the domain or local system environment.

Answer

Event ID 4624

Answer

Event ID 4732

Answer

Event ID 1102

Question 5

When investigating an incident involving RDP (Remote Desktop Protocol), which THREE artifacts should an analyst check to establish a timeline of remote access?

Accepted Answer

Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational. Correlating RDP usage requires cross-referencing multiple artifacts. The TerminalServices-RemoteConnectionManager logs confirm incoming connection attempts, the TerminalServices-LocalSessionManager logs track session status, and the 'RDP Bitmap Cache' or 'User Profile' hive can show evidence of what was seen or accessed. These artifacts together create a comprehensive picture of unauthorized remote access, essential for scoping the breach and determining what data the attacker successfully interacted with during the RDP session.

Answer

The Shimcache hive

Answer

Amcache.hve

Question 6

An analyst finds an entry in the 'SRUM' (System Resource Usage Monitor) for a process that communicated with a known malicious IP address. What is the main forensic advantage of using SRUM over standard network logs?

Accepted Answer

SRUM records network usage on a per-process basis. SRUM is a powerful artifact because it tracks historical resource usage, including network data usage per process, even after the process has terminated. Unlike real-time network logs that can be cleared or missed, SRUM provides a durable, long-term record of which processes sent data to which destinations. This allows investigators to identify malicious network activity that occurred in the past, even if the system has since been rebooted or the malicious process stopped.

Answer

SRUM is stored only in volatile RAM

Answer

SRUM can be used to decrypt SSL traffic

Answer

SRUM captures the actual process binary file

Question 7

An incident responder acquires a volatile memory dump from a compromised Windows 10 endpoint using WinPmem. During triage, the analyst needs to locate active network connections associated with a suspicious process PID 2412. Which Volatility plugin provides the most direct analysis of active network sockets tied to specific process structures in Windows 10 memory?

Accepted Answer

netscan. The netscan plugin parses network socket structures from the pool allocations of the network stack, making it effective for modern Windows operating systems. Identifying active connections linked to specific process IDs helps analysts map out adversary command and control channels during live memory triage.

Answer

connections

Answer

netstat

Answer

connscan

Question 8

Which TWO of the following Windows Event IDs are most commonly used to detect the clearing of event logs, a common technique employed by attackers to hide their tracks during the anti-forensics phase of an engagement?

Accepted Answer

Event ID 1102. Event IDs 1102 and 104 are the primary indicators for log deletion. Monitoring these is a fundamental requirement for forensic readiness. Attackers often clear logs to remove evidence of execution, lateral movement, or persistence mechanisms. Detecting these events allows responders to identify the time window of an incident and potentially correlate the deletion with other suspicious activities or account privilege escalations that occurred just prior to the clearing.

Answer

Event ID 4624

Answer

Event ID 4688

Answer

Event ID 4697

Question 9

An analyst discovers a suspicious process in memory that has no file on disk but shows 'Mapped' memory protections. What technique is likely being used, and which forensic artifact is best suited to validate the origin of this memory segment?

Accepted Answer

Reflective DLL injection; examining the VAD tree and process memory.. The technique is reflective DLL injection or code hollowing. Because the process is not file-backed, it indicates that code was injected directly into memory. Reviewing VAD nodes and checking for 'Mapped' memory segments that correspond to loaded modules or suspicious memory regions is key. This is vital for uncovering fileless malware that bypasses traditional signature-based antivirus solutions by never touching the disk for its primary malicious payload execution.

Answer

DLL sideloading; inspecting the AppInit_DLLs registry key.

Answer

Process hollowing; inspecting the Shimcache for execution history.

Answer

Living-off-the-land; reviewing PowerShell Script Block logging.

Question 10

Which of the following describes the purpose of the 'Shimcache' (also known as AppCompatCache) artifact in a Windows forensic investigation?

Accepted Answer

To identify if a file was ever executed on the system.. The Shimcache is used to identify which files have been executed or interacted with on a system, primarily for application compatibility. It is essential for forensic analysts to build a timeline of malicious binary execution. Because the cache is stored in the registry and updated only at system shutdown or reboot, it provides a persistent record of binary execution history that is invaluable for identifying the initial point of entry for an attacker.

Answer

To store the last known good configuration for system drivers.

Answer

To monitor network connections initiated by system processes.

Answer

To maintain user account password hashes for offline auditing.

Question 11

When analyzing volatile memory, which structure contains the 'PEB' (Process Environment Block), and why is it significant to a forensic investigator?

Accepted Answer

The PEB structure; it contains the process's command line and loaded module list.. The PEB resides in the user-mode address space of a process and contains critical information such as loaded modules, environment variables, and command-line arguments. For an investigator, the PEB is a goldmine for identifying the malicious command line used to launch an attack or discovering hidden modules that do not appear in standard linked-list process enumeration. It is a vital structure for uncovering process-level metadata that adversaries often manipulate to hide their activities.

Answer

The EPROCESS structure; it is critical for tracking thread scheduling.

Answer

The Thread Environment Block (TEB); it tracks the status of CPU registers.

Answer

The VAD tree; it manages the virtual memory allocation for the process.

Question 12

An analyst is investigating a suspected credential dumping attack targeting LSASS. Which THREE of the following artifacts or log entries are most likely to provide evidence of this activity?

Accepted Answer

Event ID 4663 (Attempt to access an object). Credential dumping typically involves accessing LSASS memory. Evidence is often found in Event ID 4663 (object access), Event ID 4656 (handle requests), and memory anomalies. These events, combined with file creation timestamps for dumping tools like Mimikatz, provide a comprehensive picture of the attack. Understanding these artifacts is critical for detecting the moment an attacker elevates their privileges or attempts to harvest domain-wide credentials for further movement and persistence in the environment.

Answer

Event ID 4624 (Logon event)

Answer

Event ID 1102 (Log cleared)

Question 13

An analyst is reviewing the Windows Registry to determine the 'Last Access' time of a specific file. Which registry hive is most likely to contain information regarding the file's last modified or accessed time when interacting with the 'ShellBags' artifact?

Accepted Answer

USRCLASS.DAT hive. ShellBags are stored in the USRCLASS.DAT hive of the user profile. They are designed to remember folder view settings, but they also preserve evidence of directory navigation. For an analyst, ShellBags are crucial because they can prove a user accessed a specific directory, even if that directory has since been deleted. This provides essential context for identifying the directories an attacker browsed during their time on the compromised system, effectively expanding the forensic timeline.

Answer

SYSTEM hive

Answer

SOFTWARE hive

Answer

SAM hive

Question 14

An analyst is reviewing a Windows 10 memory image for evidence of a process that was terminated just before capture. The analyst needs to recover artifacts of the terminated process that may no longer appear in the active process list. Which TWO Volatility 3 plugins should the analyst use to find terminated or unlinked process objects and their associated network endpoints? (Choose two.)

Accepted Answer

windows.psscan. To recover a terminated process, you must scan memory rather than rely on the active list. psscan finds unlinked EPROCESS objects by pool tag, and netscan finds connection objects and maps them to owning PIDs, including those no longer active. Together they can resurrect the process and its network activity. Active-list plugins like pslist, cmdline, and malfind cannot see a process that was already unlinked.

Answer

windows.pslist

Answer

windows.cmdline

Answer

windows.malfind

Question 15

An analyst is examining a Windows 10 system and finds that the Security event log contains an event ID 4688 for a process creation, but the 'Creator Process Name' field is blank. Which of the following best explains this observation?

Accepted Answer

The system is running a version of Windows that does not populate the Creator Process Name field in event 4688 by default.. The Creator Process Name field in event 4688 was introduced in Windows 8 and Server 2012. In earlier versions, such as Windows 7, the field does not exist. Even in later versions, the field is only populated if the 'Audit Process Creation' policy is enabled and the system is configured to include the creator process name. Therefore, a blank field suggests that the operating system version or audit policy does not support or enable the population of that field.

Answer

The 'Include command line in process creation events' policy is disabled, so the Creator Process Name is not recorded.

Answer

The process was created by a parent process running under a different user account, and the system failed to resolve the parent's name.

Answer

The process was created by a parent process that has already terminated, and the parent's information was not captured.