CCNA OS and Network Forensics Questions

The 'last' command parses the binary wtmp log (/var/log/wtmp) to display session records, including user, terminal, source IP, and login/logout timestamps. This directly captures successful local and SSH logins, making it the standard artifact for identifying recent successful authentication events. Concatenating the output with the 'last' command's default format provides a timeline of who accessed the system.

In Linux, UID 0 is reserved for root and any process or user with UID 0 bypasses all permission checks. A passwd entry with UID 0 means that logging into that account immediately grants full root control, regardless of the username appearing in the entry. This is a well-known backdoor technique, making it the most critical indicator in the passwd file.

Process w3wp.exe making outbound connections to an unknown IP is a strong indicator because w3wp.exe is the IIS worker process that normally only receives inbound HTTP requests and responds to them; it should not initiate outbound connections to arbitrary external addresses. When a web shell is uploaded and invoked, the attacker can use it to run commands, exfiltrate data, or create a reverse shell via the compromised worker process, causing the trusted w3wp.exe process to beacon to an external IP. Such unexpected outbound traffic from a known server-side process is frequently missed by simple HTTP log review, making it a high-value network-based IOC that pairs with file-based web shell detection.

Event ID 4648 records a logon attempt using explicit credentials, such as when a user runs a process with `runas` or supplies alternate domain credentials for a network connection. This satisfies the stem’s constraint of “explicit credential usage” because the event logs the target account and the source process, distinguishing it from interactive logon events like 4624.

Unified logging is a macOS subsystem that captures structured, timestamped diagnostic messages from the kernel, processes, and user applications into binary .tracev3 stores under /var/db/diagnostics and /var/db/uuidtext. Investigators query it with log show or log stream to reconstruct file access, process execution, network activity, and system errors. It is a core native artifact on modern Macs and one of the two valid items in this question.

The Run registry keys, specifically HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, define programs that Windows automatically executes each time a user logs on. Each value name is arbitrary, but the value data is a command line (e.g., C:\Windows\Temp\payload.exe). Malware frequently uses these keys for persistence because they are easy to write, require no elevated privilege for HKCU, and survive a reboot; they are also a primary focus of Autoruns/Windows Defender detections.

Event ID 4625 is the Windows Security log event for a failed logon attempt. When dozens or hundreds of these events occur from the same source IP or user account within a short window, it strongly indicates a brute-force password guessing attack. Analysts should correlate Sub Status codes (e.g., 0xC000006A for bad password) and Logon Type (e.g., 2 interactive, 3 network) to confirm automated guessing. The rapid repetition of failures with varying passwords is the classic signature of this attack.

The log pattern shows multiple 'Failed password' events for SSH from the same source IP within a short window, which is the classic indicator of an automated brute-force attack. Attackers cycle through username/password combinations hoping for a match, generating a high volume of authentication failures. This does not require any vulnerability in SSH itself; it merely targets weak credentials.

/var/log/auth.log records PAM and sudo authentication events on Debian-based systems, capturing successful logins, failed password attempts, and privilege escalation via sudo. This directly satisfies the stem's requirement for a primary authentication source covering logins, sudo usage, and failures, unlike general system or kernel logs.

Anomalies in the /proc filesystem are a strong rootkit indicator because /proc is a virtual filesystem that reflects kernel data structures, including the live process list and network sockets. Kernel-level rootkits often hook the /proc handler routines or hide their own PIDs and associated entries, so comparing output of ps and netstat against /proc directly can reveal hidden processes or mismatched connection tables. For example, a rootkit may unlink its process from the task list while left visible in /proc's pid directory, or vice versa, and an examiner should inspect /proc/<pid>/cmdline and /proc/net/tcp for subtle inconsistencies.

An attacker who gains root access can append a public key to /root/.ssh/authorized_keys, enabling passwordless SSH logins as root indefinitely. This is a low-effort, high-impact persistence mechanism because the legitimate key file already exists and may not trigger immediate alarms. Even if the web shell is patched, the SSH key provides a clean, encrypted backdoor that bypasses normal authentication. Removing it requires auditing the authorized_keys file for unexpected entries.

log2timeline (now evolved into Plaso) is the definitive open-source tool for digital forensics timeline analysis. It recursively parses a disk image or collection of files, using numerous parsers to extract timestamps from file system metadata, operating system logs, application traces, browser history, registry keys, and many other artifact types. All parsed timestamps are normalized into a unified SQLite database, enabling the investigator to generate a 'super timeline' that correlates events across multiple sources for temporal reconstruction. This comprehensive multi-source approach is exactly what timeline analysis demands, making it the correct answer.

Each 4625 event explicitly records an authentication failure with logon type, source IP, and username, so a sudden spike from many different source addresses targeting the same accounts is the hallmark of a distributed password-guessing attack. The attacker submits candidate passwords over RDP, SMB, or VPN until one succeeds, which is exactly why the failed-logon count spikes before eventual access. The varied external IPs and volume distinguish this from credential misuse or ticket-forging attacks.

Event ID 4625 is the Windows security event for failed authentication, and Logon Type 10 (RemoteInteractive) is assigned specifically when the attempt occurs via a remote interactive protocol such as RDP. A 4625 event with Logon Type 10 therefore precisely indicates a failed remote interactive logon, commonly seen in RDP brute-force attacks. The combination of the failure code (4625) and the remote interactive logon type (10) leaves no ambiguity about the attempt's outcome and origin.

The unified log is queried with the log command (e.g., log show --last 1h --predicate 'process == "Finder"' --info --debug). It reads the structured, privacy-redacted binary store under /var/db/diagnostics, applying predicates to return timestamps, process metadata, and persistence flags. In forensic triage you typically run log collect to aggregate entries while preserving causality and before volatile data is lost.

Repeated requests containing randomized User-Agent strings strongly indicate the client is deliberately changing that header on every request. User-Agent randomization is a standard anti-detection technique because unmodified command-line tools with absent or malformed User-Agents are easily filtered by security appliances, while frequent switching between browser-like values makes traffic appear to come from diverse legitimate clients. In proxy logs, varied User-Agents from the same source IP defeat naive signature matching, but the high rotation rate itself remains a suspicious behavioral pattern.

Property list files encode application preferences as key-value pairs, storing both system-wide settings in /Library/Preferences and per-user settings in ~/Library/Preferences. This satisfies the stem's requirement to determine configured settings and recently accessed files, since plists also record recent items, window states and document history.