CCNA OS and Network Forensics Questions

The Run key is a Windows AutoStart Extensibility Point (ASEP) located in both HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, causing the referenced executable to launch each time a user logs on. An unusual entry here, often a command line pointing to a portable executable in a temp directory, is a classic persistence mechanism used by malware. Because the Run key is queried at logon and is a single value, it is one of the simplest and most frequently abused persistences in Windows, and its presence is a strong indicator of compromise when the entry is not associated with a legitimate installed program.

This option correctly identifies the event. Event ID 4644 is triggered when a process attempts to log on by explicitly supplying account credentials, commonly via RunAs, scheduled tasks, or mapped drives. Combined with logon type 3 (network logon), it indicates that the backupadmin account was explicitly used to authenticate to FS01 over the network, rather than through the interactive console.

Prefetch is best known to forensic examiners for its run-count and timestamp metadata: every .pf file includes a 'Run Count' value and at least one 'Last Run Time' timestamp in its header. The run count indicates how many times the corresponding executable has been launched, while the last run time gives the most recent start date and time in UTC. This is the correct characteristic of Prefetch and is what analysts rely on to establish program execution frequency and recency during an investigation. The file's name itself, such as NOTEPAD.EXE-3A5F1E2D.pf, ties the metadata to a specific program.

The five-minute cron interval re-executes a remote payload via curl piped to bash, so the implant reinstalls itself after reboots or kills. This satisfies the attacker's need to retain access, making it a persistence mechanism rather than one-off execution.

Cron-based persistence occurs when an attacker adds a job to a user's crontab, /etc/cron.d/, or an /etc/cron.* directory so that the system executes a reverse shell, beacon, or re-implant command at regular intervals. The job runs with the crontab owner's privileges, survives reboots, and can be hidden with output redirection; a finding of a suspicious timer entry is strong evidence of this persistence technique.

Unified logging is the modern, centralized logging architecture on macOS, introduced in macOS 10.12, which aggregates all system and user-level log messages into a high-performance, structured data store accessible via the `log` command and Console app. It captures high-level forensic events such as logon/logoff, application launches, and background daemon activity, along with rich metadata like timestamps, process IDs, and privacy-annotated content. This makes Unified logging the authoritative artifact for investigating high-level system events because it provides a unified, queryable, and tamper-resistant timeline of system activity.

Bash history is the strongest indicator of the attacker's hands-on-keyboard activity after an initial foothold is established, recording the exact commands typed into an interactive shell such as ssh. Because it contains a chronological command sequence, it can reveal what binaries were downloaded, permissions changed, persistence mechanisms planted, and data exfiltrated. Although a sophisticated attacker may clear or disable history, its presence in this scenario makes it the definitive artifact for reconstructing post-exploitation actions.

tcpdump is a command-line packet capture tool that uses the libpcap library to intercept and display network packets transiting a specific interface. It supports powerful Berkeley Packet Filter (BPF) syntax for targeted capture and can write raw packets to a pcap file, preserving the exact frame traversal timing and payloads crucial for reconstructing network events. Its headless, scriptable nature makes it the de facto standard for remote or unattended network forensics collection.

%LOCALAPPDATA%\Google\Chrome\User Data\Default\History is the precise path to Chrome's SQLite database that stores browsing history. This file contains multiple key tables, including 'urls' and 'visits', which record the full URL, visit time, page title, and transition type (e.g., typed, link, or reload). Because Chrome locks the file while running, a forensic examiner should make a forensic copy via a live acquisition tool or volume shadow copy before analysis, then examine it with SQLite forensics tools to recover the user's browsing activity.

Multiple rapid Event ID 4625 entries in the Windows Security log are a hallmark indicator of a brute-force password attack. Each 4625 represents a failed logon attempt, and when an attacker submits numerous password guesses for the same account or from the same source IP in a short time, the log reveals a high volume of these failures. Analysts can correlate timestamps, source addresses, and target usernames to distinguish this systematic guessing from legitimate but occasional mistyped passwords.

Svchost.exe is a critical Windows service host process that must reside in C:\Windows\System32 (or SysWOW64 on 64-bit systems for 32-bit services). A legitimate svchost.exe never runs from a user profile directory, such as C:\Users\<username>\AppData\Roaming, because that would violate Windows binary protection and signature requirements. The unexpected path alone is a strong indicator of malware, as attackers often name rogue executables svchost.exe to blend in with legitimate processes while locating them in writable, non-standard folders.

ICMP tunneling can be used to exfiltrate data by embedding it in the payload of ICMP echo requests or replies. Legitimate ICMP packets typically have small, predictable payloads (e.g., 32 bytes of data). Large or non-standard payloads containing encoded data are a hallmark of ICMP covert channels. This allows attackers to bypass firewalls that permit ICMP but do not inspect payloads deeply.

Event ID 7045 is logged by the Service Control Manager when a new service is installed on the system. In a compromise investigation, this event is a primary indicator because attackers frequently install persistent services, such as backdoors or kernel drivers, using tools like `sc` or PowerShell. The event payload includes the service name, binary path, service type, and start mode, enabling an investigator to trace the exact executable that was added. That is why 7045 is the correct answer for identifying a newly installed service during forensic examination.

Unified logging is the correct source because macOS's centralized logging system, introduced in macOS 10.12, captures all system, process, kernel, and user-level log messages through the os_log API. The `log` command (e.g., `log show`, `log collect`, `log stream`) provides forensic access to these persisted logs, including the compressed .tracev3 files in `/var/db/diagnostics`. This data, complete with precise timestamps and metadata, is exactly what an examiner needs for analyzing system events on a modern Mac.

/proc/[pid]/cmdline is the correct source because it exposes the process's original argv array, exactly as passed to execve, with each argument separated by a null byte. This file is typically read with a tool like 'tr' or by replacing null bytes with spaces to reconstruct the full command line, including the executable path, options, and arguments. However, note that for kernel threads or zombie processes the file may appear empty.

iptables is the user-space front-end for the Linux kernel's netfilter firewall framework, and it directly manipulates packet filtering rules in the INPUT, FORWARD, and OUTPUT chains. An administrator can immediately block a brute-forcing host by adding a rule such as `iptables -A INPUT -s <offending-IP> -j DROP`, which causes all subsequent packets from that source to be discarded without reaching the authentication service. This makes iptables the correct tool for actively mitigating an active attack seen in /var/log/auth entries, and rules can be persisted with `iptables-save` and restored on boot.

Event ID 7045 is generated by the Service Control Manager (SCM) in the System log whenever a service is newly installed on a Windows machine, making it a reliable indicator of service installation. The event displays the service name, image path, service type, start type, and service account — details that help an analyst identify persistence mechanisms or malicious services. For example, a service pointing to a DLL in a user-writable Temp folder would be highly suspicious.

Password spraying is a low-and-slow attack in which an adversary chooses a handful of common passwords and tries them individually across many user accounts from a single source IP. In Windows Security logs this manifests as multiple Event ID 4625 failed-logon events with different account names but the same source workstation/IP and a common failure code such as 0xC000006D, often within a short window. Because each account is hit only once or twice, the total event volume stays low, evading threshold-based brute-force detection while still matching the observed pattern of many usernames from the same source.

Firewall logs are a cornerstone of network forensics because they contain timestamped records of each connection attempt, including source and destination IP addresses, ports, protocol, and the action taken (allow, deny, or drop). These logs enable investigators to reconstruct attack paths, spot port scans, and identify successful or blocked outbound communications. They provide metadata about network transactions, even though they do not capture payloads.

This is a classic Living-off-the-Land (LOLBin) technique: rundll32.exe, a signed Windows binary, can be abused to execute JavaScript via its exported functions, allowing malware to run under a legitimate process name. The .lnk file acts as a persistence mechanism, typically placed in the Startup folder or run key, and launches the JavaScript payload at logon to download and execute additional malware. This matches MITRE ATT&CK T1218.011, using a trusted binary to evade detection and achieve persistence.

Event ID 4625 records failed logon attempts, and repeated occurrences against one account from a single remote IP within a short window indicate an attacker systematically guessing credentials. This satisfies the stem's brute-force pattern, distinguishing it from isolated mistyped passwords or lockout events (4740), which Microsoft Entra ID or local policy would log separately.

NetFlow analysis is a network forensic technique that parses flow records—aggregated summaries of communication sessions containing source/destination IP addresses, ports, protocol, timestamps, and byte counts—exported by routers or switches. These records allow investigators to reconstruct traffic patterns and detect anomalies (e.g., exfiltration, beaconing) without inspecting packet payloads. Its strength lies in scalability and historical visibility, making it the correct technique for analyzing flow.

Event ID 7045 indicates that a new service was installed on the Windows system. When an attacker exploits a web shell, they often escalate privileges or establish persistence by installing a malicious service that executes a payload at system startup. Therefore, a 7045 event appearing alongside web shell traffic is a strong indicator of post-exploitation activity, making it the most relevant option.

The USBSTOR subkey in HKLM\SYSTEM\CurrentControlSet\Enum is populated when Windows enumerates a USB mass-storage device, such as a flash drive, external HDD, or card reader. It creates a subkey named like Disk&Ven_<vid>&Prod_<pid>&Rev_<rev>, and the key's LastWrite time can be used as forensic timeline evidence of the device's most recent connection to the system. This is why this key points directly to a USB storage device.

In ext4 (and other Unix-like file systems), file names are not stored in the inode. Instead, directory entries map names to inode numbers. When a file is deleted, the directory entry is removed, but the inode may retain metadata until it is reused. Thus, debugfs lsdel can list deleted inodes but cannot recover original file names from the inode alone. This is why file names are missing from the output.

A TCP SYN scan, also known as a stealth scan or half-open scan, works by sending an SYN packet to a port and observing the response: if SYN-ACK is received, the port is open, and the scanner immediately sends an RST to tear down the connection. This avoids completing the three-way handshake, so the target service never sees a full connection and may not write it to application logs. The captured sequence — SYN, SYN-ACK, RST — exactly matches this behavior. This is why it is correctly identified as a TCP SYN scan, as the RST after SYN-ACK is the signature of an active port-scanning tool like Nmap.

The Sleuth Kit's mactime tool parses the body file format produced by fls and other TSK tools to generate chronological timelines from disk images. It specifically correlates MACB times (modification, access, change, birth) for filesystem objects, enabling investigators to reconstruct file activity across a timeline. As a focused command-line utility within a broader forensic toolkit, mactime is a primary and canonical tool for timeline analysis, which is why this option is correct.

Run keys under HKCU and HKLM execute specified programs at user logon or system start, giving malware automatic re-execution across reboots. This satisfies the persistence requirement by surviving restarts without further user action, unlike one-off execution or volatile artefacts.

The diagnostics directory is the on-disk repository for unified logging, introduced in macOS Sierra, where entries are stored in compressed binary tracev3 files. These files capture detailed event-level data with nanosecond timestamps, message metadata, and privacy-scoped redaction, making them a rich source for forensic timelines. Investigators typically query this store with the 'log' command, not with text editors.

The 'http' filter is correct because it selects every packet in which Wireshark's HTTP dissector successfully identifies HTTP protocol data, encompassing requests, responses, status lines, headers, and bodies. Unlike port-based filters, it is application-layer aware and verifies the presence of HTTP semantics, not just a well-known port number. This makes it the precise, protocol-specific filter an SOC analyst should use to capture the complete picture of HTTP traffic on the wire.

Most Recently Used (MRU) lists in the registry are exactly the artifact designed for tracking recently opened files. For example, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU stores PIDLs of files selected through common dialog boxes, while application-specific keys like HKCU\Software\Microsoft\Notepad and HKCU\Software\Microsoft\WordPad record the last file paths opened by those applications. These registry values are maintained by the operating system and applications specifically to store this historical MRU data, making them the canonical answer.

NetFlow logs are network-level metadata records generated by Cisco and other network devices that summarize traffic flows between hosts. Each flow record contains the source and destination IP addresses, ports, protocol, timestamps, total bytes and packets, and sometimes TCP flags — but critically no payload content. This makes NetFlow valuable for high-level pattern analysis such as detecting command-and-control beacons, anomalous data-transfer volumes, or internal lateral movement, while remaining relatively lightweight to store. As a core source of network telemetry, NetFlow is a mainstream network forensics artifact.

USBSTOR enumerates storage-class USB devices, recording vendor, product and serial number for each device ever attached. This key sits under the SYSTEM hive's CurrentControlSet, making it the definitive artefact for proving historical USB mass-storage connections on Windows 10.

A .plist (property list) file is Apple's structured serialization format for key-value pairs, arrays, and typed data, encoded as either XML or binary (with the 'bplist00' header). It is used pervasively for configuration—such as Info.plist for app metadata, preferences in ~/Library/Preferences, and app-specific data containers. The extension directly identifies this format, and forensic examiners routinely parse plists to extract settings, timestamps, and user activity, which is why this option is correct.

The registry key HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR is one of the most reliable artifacts for identifying USB storage devices. Under this key, each subkey corresponds to a specific device class and serial number, such as 'Disk&Ven_Kingston&Prod_DataTraveler&Rev_1.00' followed by the unique instance ID. It persists on the system even after the device is unplugged, enabling examiners to prove that a particular USB flash drive or external hard drive was connected at some point. This makes it a cornerstone of USB device forensic analysis.

The correct indicator set is process-name spoofing combined with network beaconing: the malware uses the legitimate name svchost.exe but executes from the Temp folder, which no built-in Windows service does because the Service Control Manager loads service binaries using the full ImagePath—normally C:\Windows\System32\svchost.exe. The attacker then creates periodic outbound connections at fixed or jittered intervals to a small set of external IPs, typically carrying small, encrypted payloads, to receive commands or exfiltrate data—a classic C2 beacon signature. Defenders observe a single host producing repeatable timing patterns with low data volume per connection, which is nearly pathognomonic for malware.

Prefetch is designed as a performance mechanism, but forensically it acts as an application execution artifact: each .pf file contains a 'last run time' header field and a run count, while the file's creation timestamp indicates when the executable was first executed. This combination lets an analyst reconstruct first and last run times (and frequency) for programs like browsers, document viewers, and executables of interest, even if the system timezone offset must be accounted for during parsing. Because Prefetch files are created automatically for commonly run executables and are plain binary files, tools such as PECmd or Prefetch Parser can extract these timestamp values reliably.

~/.bash_history records commands typed in interactive Bash sessions, revealing executed tooling, downloaded payloads and reconnaissance. This satisfies the stem's command execution and persistence constraint, since it directly evidences what the operator ran on the suspected C2 host.

Jumplists are stored as .automaticDestinations-ms and .customDestinations-ms files in the user's Recent folder, implemented as COM Structured Storage (OLE compound file) databases. Each destination contains a stream whose embedded LNK blobs hold metadata about opened files, directories, and tasks, along with timestamps, file paths, and application IDs. Thus they are the best answer for a database of file/application metadata.

HKLM\SAM is the loaded registry view of the Security Accounts Manager database, and it contains the local user account hashes under HKLM\SAM\SAM\Domains\Account\Users. Each user key is named by the account's relative identifier (RID), and the V value contains the LM/NTLM hash verifiers used by Windows to authenticate local accounts. This is how the operating system exposes the credential store in the registry, making SAM the correct forensic target.

SiLK (System for Internet-Level Knowledge) is a suite of flow analysis tools designed to collect, store, and query NetFlow/IPFIX flow records. It ingests exported flow data from routers and switches, then uses tools like rwfilter and rwstats to perform high-speed, field-based filtering and statistical aggregation without touching raw packet payloads. This makes it the correct choice for analyzing NetFlow data.

Jump Lists are forensic artifacts stored in %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations and CustomDestinations. They maintain MRU (most recently used) lists of files and applications associated with particular AppUserModelIDs, capturing timestamps of when files were opened or saved. This makes them a direct source for determining recently accessed documents and corresponding applications on a per-user basis.

.bash_history is the default per-user history file in the home directory of a user running the GNU Bash shell; it records commands interactively typed at the shell's prompt, appended in plain text, and can be read with the 'history' builtin. Each line is one command, and the order generally reflects the order of execution, though Bash does not by default store a timestamp unless HISTTIMEFORMAT is configured. For a forensic investigation this file is the most direct source of a user's command activity, but a sophisticated user can clear or edit the file, and commands running non-interactively or in subshells may not be captured.

HKCU\...\CurrentVersion\Run entries are per-user autostart locations. Windows reads them at logon and launches the referenced command, so the PowerShell payload executes each time that user signs in, giving the attacker persistent code execution without administrative rights.

The /etc/shadow file stores the actual hashed password for each local user, along with password-aging metadata such as the date of last change, minimum and maximum age, warning period, and account expiration. Access is restricted to root and the shadow group, so its 0640 (or 0000) permissions prevent ordinary users from harvesting hashes for offline brute-force attacks. In a forensic acquisition, this file is a primary source for credential recovery—tools like unshadow combine passwd and shadow to feed hash-cracking utilities like John the Ripper or hashcat.

The Shell Link binary format has no dedicated field for the creating user's username or SID. LNK files identify the machine via the MachineID string and the target volume via a serial number, but attribution to a specific account must be reconstructed through indirect evidence like the NTFS USN journal, Prefetch, or shellbags, not read directly from the .lnk file.

This HKLM Run key is a critical persistence location: at every user logon, the Winlogon process reads it and launches each listed executable for all accounts, requiring administrative privileges to modify. Values are command lines (e.g., 'C:\malware.exe') that run early in the logon sequence, before the desktop is fully interactive. Because it has system-wide scope, it is a top target for malware persistence and a primary check during a forensic investigation for auto-start mechanisms.

The correct finding: a burst of 4625 events followed by a 4624 event is the canonical signature of brute-force or password-spraying. Brute-force creates many failed attempts per target account with different passwords, while spraying uses one password across many accounts; both generate numerous 4625 audit records. When one guess finally matches, a 4624 success appears, confirming the attack succeeded.

A brute-force attack against SSH is the classic finding in auth.log, where sshd writes every authentication attempt via messages like 'Failed password for <user> from <IP> port <port> ssh2'. A sustained pattern of many such failures in a short window—especially with changing usernames or source IPs—indicates automated password guessing. This aligns with the observed log entries, and PAM may also log 'authentication failure' before sshd closes the connection. Because auth.log directly records this sequence, the investigator can correlate failed attempts and possibly successful follow-up logins to assess compromise.

A brute-force password guessing attack is characterized by a high volume of Event ID 4625 (failed logon) records in a short window, often for the same target user account, and frequently originating from multiple source IP addresses or repeated attempts with varying passwords. The Failure Reason on these events typically shows 'Unknown user name or bad password' (status code 0xC000006D) or 'the specified account's password has expired' when lockout policies exist. This pattern is the classic signature of an automated tool cycling through passwords, making it the correct interpretation of a surge in 4625 events.

NTUSER.DAT.LOG1 is a transactional log file that records pending modifications to the NTUSER.DAT registry hive before they are committed to the main hive file. Windows uses these logs, along with .LOG2 and .REGISTRYMACHINE files, to replay incomplete writes and recover registry integrity after a crash or power failure. Forensically, the .LOG1 file can contain data that was never fully written to NTUSER.DAT, capturing recent changes that might not be present in the main hive. This is why the correct interpretation is that it logs changes for recovery, not a simple backup.

Web shells are typically script files placed in web-accessible directories, and their presence is often revealed by changes to file integrity—new files appearing or existing files altered with PHP/ASP/JSP content. A file integrity monitoring system would flag these modifications, and during forensic analysis, file hashes and timestamps can correlate with the attack timeline. This is a strong indicator because legitimate content management processes rarely modify executable scripts in web root directories without corresponding change-control records.

/var/log/apache2/access.log is the canonical location for Apache web server request logging, typically using the combined log format to capture source IP, timestamp, HTTP method, URI, response status, user agent, and request bytes. A file upload manifests as a POST request to a specific endpoint, often with a large request size, and the access log provides the definitive timeline and source information needed for intrusion analysis. This log is the first stop for correlating suspicious upload activity with a specific client and session.

Prefetch files are created in C:\Windows\Prefetch when an application executes on Windows, serving as a performance optimization. Each .pf file contains the executable path, run count, last run timestamp, and a list of loaded modules (DLLs), making it a primary artifact for directly recording program execution. This is the strongest evidence for determining which applications were launched, including historically executed programs, though it may be disabled on SSDs or under certain configurations.

This filter requires both conditions to be true: SYN=1 and ACK=0, which precisely identifies the initial SYN segment sent by the host initiating a TCP connection. During the three-way handshake, a SYN-ACK response has SYN=1 but also ACK=1, so it is excluded by the ACK=0 requirement. This is the standard, readable Wireshark filter for finding connection attempts, and it reliably distinguishes the connection initiator from the responder.

Plaso (formerly log2timeline) is the de facto standard for creating comprehensive 'super timelines' in digital forensics. It recursively parses file system metadata, system logs, browser history, registry hives, and numerous application artifacts, normalizing timestamps to UTC and exporting them into a unified SQLite or CSV timeline. This aggregated, holistic view of system activity is what makes Plaso the benchmark tool for timeline analysis.

LNK files are Windows shortcut binaries that persist in user profile directories such as Recent Items when a file is opened or a program is launched. They store the target's absolute path, working directory, and shell item ID list, which can include volume serial numbers and NTFS file reference numbers. A forensic examiner can correlate the link's LastWrite time and embedded timestamps to prove the specific user accessed the target on that system. Thus, LNK files serve as strong indicators of file access and program execution.

DNS tunneling is a covert channel in which an attacker embeds data payloads into DNS query labels and response records (commonly TXT) and exchanges that data with a domain the attacker controls. Unlike a simple resolution failure, these queries form a bidirectional communication stream that bypasses typical egress filters because UDP port 53 is almost always allowed to leave the network. In the captured traffic, this pattern appears as a high volume of unique subdomains or unusually large TXT responses, making it the correct diagnosis over the other choices.

The request to a PHP file carrying a 'cmd' parameter is the hallmark of a webshell: the script accepts the parameter and passes it to a server-side command execution function such as system(), exec(), or passthru(). This gives the attacker a remote command prompt on the web server, so the observed traffic is direct evidence of webshell access rather than any of the other attack classes.

This is the canonical per-user Autorun key: when the user logs in, Winlogon/Explorer enumerates values under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and launches each command line, making it the exact location an investigator should inspect for a user-specific startup program. The HKCU hive is loaded from the user's NTUSER.DAT, so findings here are tied to a single profile. Because the question asks about a Windows 10 user logon startup, this key is the correct answer.

The attacker changes the UID field to 0 because Linux kernels treat UID 0 as the root superuser and give it unrestricted access to all files, processes, and system calls. When the compromised user logs in, the session adopts that UID and inherits full root capabilities without needing su or sudo. This is a classic privilege‑escalation persistence: the account effectively becomes an alternate root entry.

A script located in /etc/cron.daily is a clear indicator of a cron-based persistence mechanism, since this directory is executed daily by cron (or anacron) on most Linux distributions. The contents of the script are run with the privileges of the user who owns it, often root, making it a powerful backdoor for maintaining access. Forensic examiners should inspect the script for malicious commands, check its permissions, and correlate the file creation timestamp with the initial compromise window.

Event ID 7045 is the correct answer. It is a System log event emitted by the Service Control Manager whenever a new service is installed on the machine. The event details include the service name, executable path, service type (e.g., kernel driver or own process), start type, and the service account. This event is generated at the time of installation, making it the definitive indicator of a new service being added.

Prefetch files record an execution count in their header, incremented each time the associated application runs. This directly satisfies the stem's requirement for execution frequency, letting the analyst establish how often a suspect binary or tool was launched on the Windows system under investigation.

The /etc/passwd file is the traditional system account database in Linux, containing one colon-delimited entry per user account. Each line includes the username, a password placeholder (usually x), user ID, group ID, GECOS description, home directory, and default login shell. This file is the authoritative source for identifying which accounts exist on a system during forensic analysis. Password hashes themselves are stored separately in /etc/shadow, not here.

log2timeline parses disparate artefacts — event logs, file system metadata, registry hives — into a single bodyfile, which Plaso then sorts into a super timeline. This satisfies the requirement to correlate multiple log sources chronologically.

A web shell is a server-side script that executes commands on the host, and attackers commonly upload it with an executable extension such as .php, .aspx, .jsp, or .cgi into a web-accessible directory. Uncovering an unexpected script file in the web root—especially one with recent creation time or placed in a writable uploads folder—is a direct file-system artifact of a web shell infection. This is the strongest and most specific indicator among the choices, as it represents the actual payload left behind by the attacker.

Cron jobs are defined in /etc/cron.d, /etc/crontab, or a user's crontab and are executed by the cron daemon according to a schedule specified with time fields (minute, hour, day of month, month, day of week). A file in /etc/cron.d is a standard location for system cron jobs, and the syntax often includes the user account to run the job as well as the command. This matches the scenario where a file found during a Linux forensic investigation is executed on a schedule, making cron the correct classification. The five-field time specification is a unique characteristic that distinguishes cron from systemd services or init scripts.

4625 is the security event ID for a failed logon attempt, logged when a user presents incorrect credentials or the logon otherwise fails. This event is a core part of Windows authentication auditing, enabling analysts to spot brute-force attacks and lockout thresholds. It is correct for this question because it is one of the two primary logon event IDs, complementing 4624 for successful logon to cover the full authentication picture.

Scheduled Tasks are a built-in persistence mechanism managed by the Task Scheduler service (svchost.exe running Schedule) and exposed via schtasks.exe or the XML-based task folders under %SystemRoot%\System32\Tasks. An attacker can create a task with a trigger such as logon, system startup, idle, or a specific event, and specify an action that executes a malicious binary, often with SYSTEM privileges if configured. Unlike jump lists or prefetch files, scheduled tasks are first-class operating system facilities for executing code at defined times, making them a common and persistent malware foothold.

Chrome's jumplist files record recently accessed items surfaced through the taskbar jump list, including downloaded files and recent pages. Their presence evidences user activity tied to Chrome, providing forensic artefacts of accessed content rather than cache or credential data.

Event ID 4624 is logged for successful logons, and Logon Type 2 indicates an interactive logon at the console. This directly answers the question of when a user last logged on interactively. The event includes the date and time, user account, and other details. It is the primary artifact for interactive logon history in Windows Security logs.

Repeated 'Failed password for root' entries from one source, immediately followed by 'Accepted password for root', indicate sustained password guessing that eventually succeeded. The single IP and root-targeted pattern distinguish brute force from a legitimate login or configuration error.

Wireshark performs full packet capture at the NIC and saves complete frames, including TCP payloads. Its 'Follow HTTP Stream' feature reassembles individual TCP segments in sequence order and applies HTTP decoding, presenting the entire POST body — e.g., a form field, file content, or encrypted data — in plaintext or raw hex. This is the only option listed that provides direct, forensic-grade evidence of what was transmitted in the exfiltration POST. (Note that capturing must occur on the affected segment; if HTTPS, TLS decryption requires keys.)

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR is the definitive Windows Plug and Play key for USB storage devices, where each subkey is named with the device instance ID (e.g., Disk&Ven_Kingston&Prod_DataTraveler&Rev_1.00) and a unique serial number. These subkeys persist even after the device is removed, and their LastWriteTime can estimate when the device was last connected, while the FriendlyName and ParentIdPrefix values enrich the picture. Being under the SYSTEM hive, it is machine-wide rather than user-specific, making it the first place investigators query to build a timeline of external storage devices that touched a system.