CCNA Chfi Os Network Questions

Scheduled Tasks let malware register a trigger that launches its payload at logon, boot or on a timer, surviving reboots and often masquerading as legitimate maintenance. This satisfies the persistence requirement by re-establishing execution without user interaction.

log2timeline aggregates timestamped artefacts from filesystems, registry hives, browser histories and logs into a single chronological bodyfile, directly satisfying the stem's timeline-analysis requirement. Its super-timeline output lets investigators correlate events across disparate sources, which is precisely the capability the question demands.

log2timeline parses diverse log and artefact sources into a unified chronological bodyfile, letting the analyst correlate the repeated SSH authentication failures from 10.0.0.5 against other system events. This satisfies the requirement to analyse event timeline ordering, not merely read entries.

Unified logging is the core of macOS system and application data collection, introduced in macOS Sierra (10.12). It stores structured logs in a binary format under /private/var/db/diagnostics/ and can be queried using the log command to filter by process, time, and predicate. Unlike other options, it offers a centralized, tamper-evident record of system behavior, making it the strongest choice for forensic investigation.

The nc command with -e /bin/sh pipes a shell to the remote host, and the cron schedule runs it every five minutes. This establishes a recurring reverse shell, giving the attacker persistent interactive access to the compromised Linux system.

Event ID 7045 is a System log event generated by the Service Control Manager (SCM) when a new service is installed or registered on a Windows host. It records the service name, executable path, service type, and start type, and is the definitive artifact that identifies service installation, even if the service binary is later removed. This event appears in the System log and can be correlated with Process Creation event 4688 to trace which process launched the installation command.

Wireshark is a full-featured network protocol analyzer that captures live traffic from network interfaces and also reads saved pcap/pcapng files. Its interactive GUI lets investigators drill down through every protocol layer, reassemble TCP streams, decode hundreds of application protocols, follow HTTP/email/file transfers, and apply display filters or statistical summaries to isolate evidence. Wireshark's deep packet inspection, packet-bytes view, and exportable payload capabilities make it the standard go-to tool for network forensics.

The prefetch file was created at system time 03:15:22, but the system clock is +5 minutes fast, so the actual UTC time is 03:10:22. This option correctly adjusts for clock skew and is the most accurate interpretation.

The correct response is to capture the referenced script and the cron entry itself using forensically sound methods—ideally via a live acquisition that records metadata such as file timestamps, owner, permissions, and the full path, while computing hashes (e.g., SHA-256) to verify integrity. The cron entry should be preserved from the applicable location (e.g., /var/spool/cron/crontabs/user, /etc/cron.d/, or /etc/crontab) with its modification time logged. This maintains chain of custody and enables later analysis in a controlled environment without altering the original system state.

SSH authorized keys are a persistence mechanism because they enable an attacker to retain remote access without needing to re-exploit the system each time; by placing a public key in a user's ~/.ssh/authorized_keys file, the attacker can authenticate over SSH indefinitely, even if the user's password is changed. While they do not autonomously execute commands like cron or init scripts, the ongoing availability of a credentialed login channel is a recognized persistence technique in intrusion activity and should be examined in a forensic investigation.

Data exfiltration is the correct interpretation because an attacker who has gained access will often locate and stage sensitive files, compress and encrypt them to avoid detection, and then transmit that archive to an external server they control. The combination of large outbound traffic, off-hours timing, and an unknown destination IP is a classic indicator of the exfiltration phase of an intrusion. This aligns with the MITRE ATT&CK technique T1048 (Exfiltration Over Alternative Protocol) and warrants immediate correlation with process execution and endpoint logs to identify the staging artifacts.

Prefetch files are created by Windows for each executable launched from a non-readonly path (with Application Prefetching enabled) to speed up subsequent loads. They store the executable's file path, a hash of the path, the number of times it was run, the last run timestamp, and the list of files and devices accessed during the first few seconds of execution. These artifacts allow forensic analysts to determine whether a specific application was executed, when it was executed, and how frequently.

Event ID 4625 is the Windows Security log event that specifically records a failed logon attempt. It is generated whenever an authentication fails, carrying details such as the target account name, source IP address, logon type, and a status/error code like 0xC000006A (bad password). Since the question centers on this exact event identifier, the security analyst correctly identifies the event as a failed logon.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is the correct answer because it is a machine-wide authority under the HKLM root, which is visible to and processed for every user who logs onto the system. Programs specified in its String or ExpandString values are executed automatically with the user's privileges at each logon. This persistence location is commonly targeted by malware, and forensic analysts check it to identify software that runs for all users.

PowerShell launched via a scheduled task or service executes under logon type 4 (batch) or 5 (service), not interactive logon type 2. Consequently, the Security log will not contain a corresponding 4624 interactive logon event, even though prefetch records the powershell.exe execution with a valid last run time. This exactly matches the observed discrepancy, making non-interactive execution the correct forensic explanation.

Event ID 7045 is the Windows System log event emitted by the Service Control Manager whenever a new service is installed or registered on the system. It contains the service name, image path, service type, start type, and the account under which the service runs. This is the definitive event for detecting service installations, although on modern Windows versions event 4697 provides similar service-creation auditing in the Security log.

Plaso, also known as log2timeline, is the command-line tool specifically engineered for timeline analysis. It recursively parses numerous artifact types—such as file system metadata, registry hives, and application logs—to create comprehensive 'super timelines' with unified timestamps. Plaso aggregates and normalizes timestamps into a single, queryable event database (often SQLite or Elasticsearch), making it the de facto standard for advanced timeline construction in forensic investigations.

Export Objects > HTTP is the correct method: Wireshark parses the HTTP conversations in the capture, reassembles the response bodies, handles chunked transfer-encoding and content-encoding, and then presents each recovered object as an individual file ready to be saved. This directly recovers binaries, documents, images, or any other file that was transferred over HTTP, providing the actual artifact for forensic analysis and hash comparison.

Files containing obfuscated code, such as base64-encoded strings wrapped in eval(), gzinflate(), or str_rot13(), are a strong indicator of a web shell because legitimate web applications rarely need to obscure their logic. Obfuscation is deliberately used to hide malicious payloads from static signature-based scanners and to complicate manual inspection. The presence of such encoding in an unexpected file under a web-accessible directory—especially in upload folders—strongly suggests an attacker is trying to evade detection and maintain remote access.

Event 7045 is the correct event because it is the Service Control Manager (SCM) event logged in the System event log whenever a new service is installed on the system. This event captures critical persistence indicators, including the service name, image file path, service type, and start type, making it a primary focus for forensic analysts investigating malware that establishes persistence by registering itself as a service. Unlike the Security log events in the other options, 7045 directly maps to the act of creating a service and appears during both legitimate software installs and malicious service creation.

Each user profile has a NTUSER.DAT file that is loaded into the registry's HKEY_CURRENT_USER hive upon user logon. It stores registry keys and values specific to that user, such as desktop settings, environment variables, application preferences, and many forensic artifacts like recently used files, typed URLs, and application-specific data. This is exactly the per-user configuration store.

This is a classic TCP SYN (half-open) scan, in which a scanner sends a SYN packet to each port and determines that a port is open if it receives a SYN-ACK response, while a RST indicates closed or filtered. Because the scanner immediately responds with an RST (or simply ignores the SYN-ACK) rather than completing the three-way handshake with an ACK, no full TCP connection is established, making this a quick and stealthy method for mapping open services. The pcap will show many SYN → SYN-ACK → RST sequences, with the scanner never sending the final ACK that would complete a legitimate connection.

This is the correct interpretation: an .lnk file that points to a remote share or contains a UNC path (e.g., \\attacker-server\payload\.scr) is a recognized lateral movement technique. Attackers use LNK shortcuts as bootstrap payloads delivered through PsExec, scheduled tasks, or WMI, where the shortcut is written to a target host and triggers remote execution of a malicious script or binary. The shortcut's TargetPath and Arguments fields are the forensic keys to identifying this behavior.

~/.ssh/authorized_keys is a per-user file that stores the public keys (one key per line) that are permitted to log in as that user via SSH. When an attacker compromises a Linux server, a common persistence technique is to append their own public key to /root/.ssh/authorized_keys or another user's authorized_keys file, enabling silent passwordless access at any time. Checking this file for unrecognized keys — and correlating key hashes or comments with known legitimate admins — is direct evidence of key-based backdoor access, making it the correct file to examine in this scenario.

The /proc/[pid]/exe entry is a symlink to the exact on-disk binary that process 12345 is currently executing. If that link resolves to a deleted or hidden location, such as '/path/to/evil (deleted)', it indicates the process is running malware that was opened and unlinked to evade detection. This is a strong and direct indicator that PID 12345 is executing the malicious code.

The ~/.ssh/authorized_keys file for each user is the authoritative list of public keys allowed to log in as that account via SSH. Attackers commonly append a single base64-encoded line containing their public key, often with command= or from= restrictions to evade detection, enabling silent passwordless access independent of any password change. Comparing every entry against known administrative keys—while verifying file ownership, permissions, and the account's shell—is the direct method to locate such an implanted credential.

A brute-force password attack is characterized by a high volume of Event ID 4625 (failed logon) entries, often from multiple source IPs or workstations, as the attacker cycles through password dictionaries or guesses. The systematic nature of these failures—repeated attempts against one or more accounts—is the definitive signature, which aligns with the observed 'multiple failed logons from different sources' in the security log.

In normal operation, DNS TXT records are used for verifiable text like SPF policies or domain ownership tokens and are rarely larger than a few hundred bytes; an attacker exfiltrating data will pad or encode payloads into TXT answers, causing response sizes to exceed typical benign traffic. Since a standard UDP DNS response without EDNS0 is limited to 512 bytes, responses that push against or exceed that limit (and require TCP fallback) are a solid anomaly. These oversized TXT responses, combined with a queried domain that also receives many random subdomain queries, are a hallmark of DNS tunneling.

Property list files on macOS are structured XML or binary files that store per-app preferences, recent item lists, window states, and other persistent configuration data. In forensic examinations, they are critical for attributing user activity because they often contain timestamps and device-specific identifiers, and can be decoded with `plutil` or `strings`. They serve as the macOS counterpart to the Windows Registry for configuration and usage artifacts.

Webshell activity spawns unexpected processes under the web server's user context, driving sustained CPU consumption from httpd, w3wp, or similar. This resource anomaly reflects attacker commands executing through the shell, distinguishing it from normal request-driven load spikes.

Registry Run keys are a classic autostart persistence mechanism: HKCU and HKLM under Software\Microsoft\Windows\CurrentVersion\Run contain command lines that the shell launches immediately after user logon. Malware writes an executable path or PowerShell command into that value to re-establish itself on every reboot or logon attempt. Because the value is executed automatically with the user's or SYSTEM's context, it provides reliable persistence. This is why a process writing to Run keys is strongly indicative of persistence rather than a harmless activity.

When HISTSIZE is set to 0, bash immediately stops appending commands to the in-memory history list, and because the history file is only updated from that list on shell exit or explicit `history -w`, the result is an empty or nonexistent .bash_history. Similarly, configuring HISTFILE to point to /dev/null causes every write to go to a discard device, so no command history survives. Investigators should check the owning user's ~/.bashrc, ~/.bash_profile, and environment for these settings, as they are commonly used in privacy-conscious or automated environments.

log2timeline parses timestamps from disparate artefacts and normalises them into a single super-timeline, letting examiners correlate activity across file system, registry and log sources. This satisfies the requirement to parse and correlate timestamps from various artefacts.

Apple Unified Logging is the centralized, high-volume logging architecture built into macOS Sierra and later, aggregating kernel, framework, and app messages into a compact binary format on disk (e.g., in /var/db/diagnostics/). The log show command is the primary interface to filter and extract these entries, accepting predicates for process, subsystem, and time range. This makes it the correct answer because log show exclusively queries the unified logging system, not property lists, filesystem event journals, or Core Storage metadata.

A large volume of ICMP echo requests (ping) from a single source to a single destination, especially with varying payload sizes, is a classic signature of an ICMP flood DoS attack. The sheer volume of packets consumes the target's bandwidth and processing resources, and the varied payload sizes are often used to defeat filters that block only fixed-size pings. This pattern is distinct from reconnaissance or protocol-specific abuse because it intentionally overwhelms the victim with raw ICMP traffic.

Unified logging is the current logging architecture in macOS, introduced in Sierra, and aggregates system and user messages into a high-performance, structured, binary trace database stored under /var/db/diagnostics. It supports advanced querying via the `log` command, captures multiple log levels and activities, and is the authoritative source for modern forensic analysis of system and application behavior.

Cron job is correct because /etc/cron.d/ contains cron schedule files that the cron daemon parses and executes at predefined time intervals using the standard 'minute hour day month weekday' syntax. These jobs run as the specified user and can be set to execute arbitrary commands, making them a common mechanism attackers use for scheduled persistence. The file's presence in /etc/cron.d/ with a valid time specification directly indicates a cron job rather than any other startup or logging mechanism.

NTUSER.DAT is the per-user registry hive loaded as HKEY_CURRENT_USER at logon. It contains explorer shell bag state, UserAssist execution counts and last-run timestamps, RecentDocs MRU, and many user-profile settings. For Windows 10 analysis, this hive is the primary registry file for reconstructing a user's activity and program execution.

NTUSER.DAT is the registry hive loaded into HKCU when a user logs on, and it contains that user's personal settings, application preferences, environment variables, desktop appearance, and recent documents. It is stored in the user's profile directory (e.g., C:\Users\Username\NTUSER.DAT) and is a key artifact for forensic analysis of user activity and configuration. The question's 'user' is best answered by NTUSER.DAT because HKCU itself is not a file, but NTUSER.DAT is the physical hive that backs it.

HKLM\SYSTEM\CurrentControlSet\Services satisfies the persistence requirement because Windows loads service entries here at boot via the Service Control Manager, before user logon. Malware registers a malicious driver or service to achieve SYSTEM-level autostart, making this a core location for forensic examination of startup persistence.

LNK files (Windows shortcuts) are automatically created when a user accesses a file or folder, particularly in locations like the Recent folder (%AppData%\Microsoft\Windows\Recent), desktop, or Start Menu. These shortcut files embed the target path, creation timestamp, last written timestamp, and even the volume serial number of the drive, making them excellent evidence of recently opened documents. Forensic tools can parse LNK metadata to reconstruct user file access activity, even if the original file has been deleted.

The presence of all three handshake packets—SYN, SYN-ACK, and ACK—in the capture, with the ACK carrying a valid sequence number that acknowledges the server's SYN-ACK, confirms that the TCP connection reached the ESTABLISHED state. This is further corroborated by data segments following the handshake, where the payload-bearing packets use the negotiated sequence and acknowledgment numbers to advance the byte stream. In forensic packet analysis, a completed handshake with subsequent payload indicates a successful connection.

Plaso log2timeline ingests data from filesystem metadata, application logs, and artifact parsers, then normalizes and correlates timestamped events into a single timeline. This unified super-timeline allows an analyst to visualize and sequence activity across email, web, and file transactions. Consequently, it enables efficient analysis of event sequences rather than per-source inspection.

/var/log/syslog is the primary, centralized system log on Debian-based distributions like Ubuntu, written by the rsyslog daemon. It aggregates high-level kernel messages, service start and stop events, hardware errors, cron activity, and other system-level notifications from software that uses the syslog(3) API. This file is essential for troubleshooting and forensic timeline reconstruction because it captures a broad chronological record of system behavior, though it deliberately excludes authentication events.

This pattern is the classic signature of a TCP SYN scan, a common port scanning technique. The attacker sends a SYN packet to each port on a target; if the port is open, the target responds with a SYN-ACK, while closed ports trigger an RST or no reply. Observing multiple SYN packets to different ports without complete handshakes indicates systematic probing to enumerate which services are listening, exactly what a port scan reconnaissance does.

Plaso (formerly log2timeline) is an open-source Python framework purpose-built for super timeline generation. It parses dozens of artifact types—file system metadata (MACB timestamps), log files, registry hives, browser history, and more—and outputs unified timelines in formats like SQLite, CSV, or Elasticsearch. It is the tool most directly associated with 'outputs a timeline of file system events' because it aggregates evidence from multiple sources into a single chronological narrative.

A SYN flood is a transport-layer denial-of-service attack that exploits the TCP three-way handshake by sending a massive number of SYN packets with spoofed or non-responsive source IP addresses. The server allocates a transmission control block (TCB) and memory for each half-open connection, then replies with SYN-ACK packets that are never answered, causing the listen backlog to fill and preventing legitimate clients from completing handshakes. This matches the capture of many SYN packets and represents a direct, stateful DoS mechanism.

Event ID 4625 is generated on the domain controller or local machine whenever a logon attempt fails, regardless of whether the failure was due to a bad password, a nonexistent account, or a locked-out account. The event contains critical forensic details such as the account name, the source network address, logon type, and the specific sub-status code (e.g., 0xC000006A for bad password). Analysts rely on 4625 spikes to detect password spraying or brute-force attacks, and correlating this ID with successful logons (4624) for the same account shortly afterward can reveal successful credential compromise after repeated failures.

Jump Lists record recently and frequently accessed files and applications per user, including entries created when programs launch. They therefore evidence program execution on Windows, satisfying the requirement for a valid execution artifact alongside Prefetch and similar records.

An attacker is attempting to brute-force the user's password is correct because a rapid series of Event ID 4625 entries from the same source IP against the same username is the classic signature of a brute-force or password-spraying attack. Each 4625 event includes metadata such as Logon Type (e.g., 3 for network or 10 for RDP), Sub Status codes (e.g., 0xC000006A for a bad password), and the source network address. The repeated failures followed by no corresponding 4624 success indicate the attacker has not yet guessed valid credentials, reinforcing the brute-force conclusion.

This is the primary authentication log on Debian-based Linux distributions, recording events from the auth and authpriv syslog facilities. It captures successful and failed logins, sudo usage, SSH public-key and password authentication, user account changes, cron jobs run with authentication, and PAM module activity. As the central repository for authentication-related messages, forensic examiners look here first for evidence of unauthorized access or identity-related events.

~/.bash_history is the correct artifact because it is the per-user history file that bash appends with every command entered interactively. When a shell exits cleanly, the session's commands are written here, making it a direct record of user activity. Investigators commonly use it to reconstruct an attacker's command sequence, though it can be disabled or truncated.

/etc/shadow is the authoritative shadow password database that contains each user's hashed password and related aging metadata. It is typically readable only by root and the shadow group (mode 640 root:shadow) precisely because it holds credential verifiers. Fields include login name, password hash (often with $id$salt$hash format), last change, minimum/maximum age, warning, inactivity, and expiration. Thus the answer to the question is /etc/shadow.

A webshell is a server-side script (e.g., PHP or ASP) that accepts HTTP parameters such as 'cmd' and passes them to system functions like shell_exec(), allowing remote attackers to run arbitrary operating system commands. The pcap's 'cmd' parameter accompanied by a directory listing is the classic fingerprint of a webshell: the attacker issues ls/dir and the response contains the filesystem enumeration. This combination of HTTP request structure with observable command output directly matches webshell behavior.

UserAssist is a per-user registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count that records GUI applications launched through Windows Explorer. Each value contains the ROT13-obfuscated path of an executable, with an embedded binary payload representing the number of times it was executed and the last execution timestamp encoded as a FILETIME. Forensic analysts decrypt the ROT13 and parse the binary data to prove a specific program was run, how often, and when, which is exactly what this correct answer describes.

log2timeline, now part of the Plaso project, is specifically engineered to acquire and analyze timestamps from a wide array of artifact sources—file system metadata, Windows Registry, event logs, browser history, and third-party application logs—into a unified SQLite timeline database. Its dedicated tools such as pinfo and psort filter, sort, and output event timelines, making it the canonical purpose-built solution for timestamp correlation in digital forensics. Unlike generic analysis platforms or packet analyzers, its entire architecture is centered on timeline generation and analysis.

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR is the definitive system-wide registry hive for USB mass storage devices. Each subkey corresponds to a unique device instance, following the pattern Disk&Ven_[vendor]&Prod_[product]&Rev_[revision], with a serial-number subkey that can identify the exact device. It also contains the ParentIdPrefix value, which can be correlated with other artifacts such as Setupapi.dev.log and MountPoints2 to establish connection timelines. This key is a primary source for listing all USB storage devices ever plugged into the system.

Prefetch files are generated by the Windows Prefetcher on each application launch to accelerate future startups by preloading referenced pages and DLLs. Each .pf file in C:\Windows\Prefetch contains the full executable path, a run count (stored at a specific offset in the header), the last execution timestamp, and a list of files accessed at startup. This makes Prefetch files the primary native artifact for determining the execution history, run count, and last run time of a specific application. They are especially powerful because they exist by default on desktop Windows installations, but forensic examiners should account for cases where Prefetch is disabled (e.g., on SSDs with certain configurations or via Group Policy).

Because webshells must be accessible by the web server, they are nearly always planted in a web-accessible directory, such as wwwroot or a subfolder. Attackers routinely hide the malicious intent by encoding the payload—for instance with base64, hex, or gzinflate—so the file appears as an opaque script without readable function names. Legitimate web application code is rarely obfuscated in this manner, so the combination of placement in a web directory and encoded content is a strong, direct indicator of a webshell.

Packet capture analysis is the definitive method because it records the raw DNS datagrams, preserving every byte of the query name and answer section. An analyst using Wireshark, tcpdump, or NetworkMiner can inspect individual DNS QNAME labels for high entropy, long subdomains, or unusual RR types, then decode the embedded data. This also provides the original evidence needed for forensic reconstruction rather than relying on summary logs.

~/.bash_history is the per-user history file for the Bash shell, normally loaded in an interactive session and appended to when the shell exits or when history -a is invoked. It directly contains the command lines typed by that user, making it the correct primary source for this investigation. Note that its presence can be disabled or limited by HISTFILE, HISTSIZE, and HISTFILESIZE, and commands may be missing if history was truncated or multiple shells were used.

A full packet capture preserves the raw network frames, including the application-layer payload of every session. By reassembling the TCP streams, the analyst can reconstruct the exact data segments transmitted, such as uploaded files, commands, or stolen records. This makes PCAP the only log source that gives complete, packet-level proof of outbound data content, subject to encryption.

NTUSER.DAT is the per-user registry hive that Windows loads into HKEY_CURRENT_USER when a user logs on. It contains user-specific configuration such as desktop settings, environment variables, application preferences, and network drive mappings, stored in the user's profile directory. This makes it the only hive among the options that directly holds individual user settings.

UserAssist is a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist in NTUSER.DAT that logs each per-user program execution, recording a Run Counter and Last Execution Time. The subkeys are GUIDs representing specific application categories, and the values are ROT13 encoded in many Windows versions, which can be easily decoded by forensic tools. Because it is stored per-user in the user hive, it directly ties an executed binary to a specific user account, making it the primary artifact for investigating recently executed programs.

A LaunchDaemon is defined by a plist placed in either /Library/LaunchDaemons/ (system-wide) or /System/Library/LaunchDaemons/ (Apple-sanctioned system services). These plists contain keys such as ProgramArguments, RunAtLoad, and KeepAlive, and launchd loads them during boot to execute services with root privileges, independent of any user session. A suspicious plist in the Library is therefore most consistent with a LaunchDaemon, especially if it resides in the LaunchDaemons subdirectory and lacks a user-specific component.

Investigating the server for signs of compromise is the appropriate first response to repeated connections, as it determines whether the external IP's activity has successfully exploited a vulnerability. This includes checking for unauthorized processes, anomalous registry entries, new user accounts, scheduled tasks, modified binaries, and indicators of compromise (IOCs) such as unusual outbound connections or file hashes. Establishing a baseline and correlating firewall logs with endpoint logs enables the analyst to identify the attack vector, scope, and appropriate remediation steps.

PECmd (Prefetch Explorer Command-Line) is a free and widely accepted tool by Eric Zimmerman that parses Windows Prefetch (.pf) files. It extracts the executable's last run time, run count, and the list of referenced files and DLLs, exporting the results to CSV, HTML, or JSON for further triage. Because it stabilizes and standardizes prefetch decoding, it is the recommended option when an examiner needs to prove which binaries executed on a system.

Webshells often invoke server-side commands through PHP functions like system(), exec(), or shell_exec() with attacker-supplied input. When these commands produce errors or partial output that is not sanitized, the web server's error log may capture snippets of OS commands such as id, whoami, ls -la, or cat /etc/passwd. A properly functioning application should never intentionally write raw system command output to error logs, so their presence is a strong sign of webshell activity.

This key is the per-machine Run key and is one of the classic autostart locations processed when a user logs on. Each value under it is a command-line string whose data is the full path or command used to start a program, and the system executes all such entries automatically at logon. Because entries here apply to every interactive user and require no special privileges to write in some use cases, this is a common persistence mechanism and the correct registry location to inspect for automatic startup programs.

This is the authoritative artifact for USB mass storage device forensics. Each time a USB drive or external storage device is attached, Windows enumerates it under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR, creating a subkey whose name contains the device instance ID, vendor, product, revision, and often the unique serial number. The LastWrite time of these subkeys reflects when the device was installed/configured, enabling an examiner to reconstruct a timeline of device connections and identify the specific physical drive by its serial number.

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR is the Windows Plug and Play device enumeration tree for USB mass storage devices, recording every device instance that has ever been connected to the system. Each subkey is named with the device's vendor, product, and unique serial number, and it persists even after the device is unplugged, making it a critical artifact for proving a specific USB drive was attached. Forensic examiners use this key to identify not only the make/model but also the serial number and, when correlated with SetupAPI logs, the first/last connection times.

Plaso, also known as log2timeline, is the correct tool because it is purpose-built for constructing super timelines from diverse forensic artifacts, including file system metadata, event logs, and application logs. It ingests disk images or directories, parses time-stamped evidence using modular parsers, and outputs a unified, correlated timeline in SQLite or bodyfile format. Unlike single-purpose tools, Plaso correlates timestamps from multiple sources, enabling robust reconstruction of file system activity such as creation, modification, and access events.

SolarWinds NetFlow Traffic Analyzer is a purpose-built network flow collector that receives NetFlow, IPFIX, sFlow, and J-Flow data directly from routers and switches, exporting the records into a SQL database for long-term forensic retention. It computes bandwidth utilization per interface, identifies top talkers and protocols (using Cisco NBAR), and performs baseline anomaly detection to flag suspicious traffic patterns. Because it ingests flow metadata instead of individual packets, it can scale to large enterprise environments and answer forensic questions about which endpoints communicated, for how long, and at what volume — exactly the capability the question requires.

An outbound TCP connection from a compromised web server to a single external IP on a non-standard high port such as 4444 is a classic reverse-shell indicator. Because the server initiates the connection, it can evade typical inbound firewall restrictions, allowing an attacker to receive a shell session through a listener on the command-and-control host. The repeated nature of the connections suggests beaconing for instructions, a hallmark of C2 communication.

The HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR key is the definitive registry artifact for identifying USB mass storage devices that have been connected to a Windows system. Under this key, the Plug and Play manager creates a subtree in which each vendor/product pair (e.g., Disk&Ven_Kingston&Prod_DataTraveler&Rev_1.00) appears, and beneath that, a unique device instance key named with the device's reported serial number. Forensic examiners can extract the device instance's LastWrite time and the FriendlyName value to confirm both the exact drive and its approximate last connection time. Because the system records this information even after the device is removed, it is the correct key to examine in registry-based USB forensic investigations.