Windows Host Analysis

A Windows host is any computer running the Microsoft Windows operating system. When you analyse a Windows host for security purposes, you are essentially becoming a digital detective. You are looking at the clues the computer leaves behind about everything that has happened on it. These clues are called artefacts. An artefact is a piece of digital evidence, like a log file, a registry key, or a saved file preference. The Windows operating system is designed to be helpful to the user. Every time you open a program, plug in a USB drive, or log in, Windows writes something down for future use. This helps the computer run faster and helps you pick up where you left off. However, for a security analyst, these automatic recordings are a goldmine. They show a historical record of user and system activity, which is exactly what you need when you suspect a security breach.

Let us start with the most important set of artefacts: Windows Event Logs. These are centralised, structured files where Windows records events. An 'event' is any significant occurrence in the system, such as a user logging in, a service starting, or an application crashing. Each event has a unique Event ID number, which is like a code telling you exactly what happened. For example, Event ID 4624 means a successful logon. Event ID 4625 means a failed logon attempt. These Event Logs are split into categories. The most common are the Security log (which tracks logon and logoff events, and permission changes), the System log (which tracks driver failures and system crashes), and the Application log (which tracks errors from installed programs). The logs are stored as files with a .evtx extension on modern Windows versions. To view them, you use the built-in tool called Event Viewer. An analyst will filter these logs to look for patterns, like hundreds of failed logon attempts (Event ID 4625) in a short period. That pattern is a classic sign of a password-guessing attack.

The second critical set of artefacts lives in the Windows Registry. The Registry is a huge, hierarchical database that stores configuration settings for Windows and for many programs. It is like the computer's brain. It remembers what wallpaper you chose, what programs start automatically when you boot up, and what file types are associated with which applications. For security analysis, specific Registry key locations are vital. One is the 'Run' key. Programs listed here start automatically when any user logs in. Attackers love to add their malicious programs to this key so that their malware runs every time the computer restarts. An analyst checks this key to find suspicious startup programs. Another important area is the 'UserAssist' key, which tracks the programs a user has recently run. This can show you exactly what executable files a user launched, even if they tried to hide their tracks.

Thirdly, we have Prefetch files. These are files Windows creates to speed up the loading of programs you use frequently. Every time you open a program, Windows creates a .pf file containing information about what files the program accessed during startup. The name of the Prefetch file includes the name of the program and a hash of the program's path. An attacker might rename a malicious file to 'svchost.exe' to blend in, but the Prefetch file will show the actual path from which that svchost.exe was run. If the path is C:\\Users\\Hacker\\Downloads\\svchost.exe, that is highly suspicious. Prefetch files are excellent for finding evidence of malware execution, especially if the attacker has tried to delete the original program.

Fourthly, we have the Windows Task Scheduler. This tool lets users and programs schedule tasks to run at specific times or when specific events happen. Attackers use it to schedule malware to run at a specific time, often outside of business hours to avoid detection. They can also use it to maintain 'persistence', which means ensuring their malware survives a computer restart. An analyst will examine the list of scheduled tasks to find any that look out of place, such as a task named 'WindowsUpdate' that points to a script in a user's Temp folder.

Finally, there are MFT (Master File Table) records and $UsnJrnl (Update Sequence Number Journal). These are low-level filesystem artefacts. The MFT is like a database of every single file and folder on an NTFS drive. It records the name, size, timestamps (created, modified, accessed), and the location on the disk for each file. The $UsnJrnl logs every change made to files on the volume. These artefacts can reveal when a file was created, deleted, or renamed, even if the user emptied the Recycle Bin. This is how you detect an attacker who deleted their tools or tried to cover their tracks by renaming malicious files.

Why do these artefacts exist? They were not designed for security. Event Logs exist to help administrators troubleshoot problems. The Registry exists to organise settings. Prefetch exists to make loading programs faster. However, security analysts repurpose these tools to reconstruct events after a breach. This is called post-incident forensics. Understanding these Windows artefacts replaces the older, less effective method of manually checking every file on the computer. It is a targeted, efficient way to find evidence.

You are a junior security analyst at a mid-sized company. You get an alert from your company's security information and event management (SIEM) system. The alert says a user account belonging to 'Sarah from Marketing' was locked out because of too many failed passwords at 3:00 AM on a Sunday. Sarah is on holiday and was not working. You must investigate. This is a classic scenario where Windows Host Analysis is essential.

You start by remoting into Sarah's Windows workstation. Your manager tells you to collect artefacts. You do not just open random files. You have a plan. Your first step is to examine the Windows Security Event Log. You open Event Viewer on the machine. You navigate to Windows Logs and then Security. You apply a filter for Event ID 4625 (failed logon attempts). The log shows 500 failed logon attempts between 2:55 AM and 3:00 AM. Each attempt used a different password for the username 'SMarketing'. This confirms a brute-force password attack. However, you also see one Event ID 4624 (successful logon) at 3:01 AM using the correct password. The source network address is 192.168.1.88, which you do not recognise as a company IP. An attacker has successfully logged in.

Now you need to find out what the attacker did after getting in. You look at the Windows Registry, specifically the 'Run' key at HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. You find a new entry called 'SafeSoftware' pointing to a file named 'svchost.exe' in C:\\Users\\SMarketing\\AppData\\Local\\Temp. This is a classic persistence technique. The attacker has planted a backdoor that will run every time Sarah logs in. You also check the Prefetch files. You sort the C:\\Windows\\Prefetch folder by date modified. You see a prefetch file for 'SVCHOST.EXE-32874.pf' that was just created at 3:02 AM. The original executable path inside that prefetch file likely points to the Temp folder, confirming the malicious executable ran.

Your next question is: what did the attacker access? You check the UserAssist key in the Registry, which logs GUI-based program launches. You see entries for 'cmd.exe', 'powershell.exe', and 'whoami.exe'. The attacker ran a command shell. You then check the Task Scheduler. You find a scheduled task named 'OneDriveSync' that is set to run every 10 minutes. Its action launches a PowerShell command that connects to an IP address. This is a command and control (C2) beacon, sending data back to the attacker's server.

Finally, you need to see if any files were stolen. You use a forensic tool to parse the $UsnJrnl on the C: drive. You find records showing that a file named 'Customer_List.xlsx' was copied from a SharePoint sync folder to a file named 'backup.zip' less than an hour after the breach. The file was then deleted, but the record of its creation remains. You have now reconstructed the entire attack timeline: brute force login, persistence via Registry, execution of malware via Prefetch, lateral movement via command line, and data exfiltration via scheduled task. Your report, built entirely from Windows artefacts, allows the incident response team to contain the threat and start legal proceedings. - Key actions you took: Filter the Security Log by Event ID 4625 and 4624. - Key actions you took: Check the Registry Run keys for suspicious startup programs. - Key actions you taken: Examine Prefetch files for evidence of malicious program execution. - Key actions you taken: Review the Task Scheduler for unauthorised scheduled tasks. - Key actions you taken: Analyse the $UsnJrnl to detect deleted or renamed files.