GIAC Certified Forensic Analyst (GCFA) — Questions 76–150

Process hollowing unmaps or overwrites the original image and injects replacement code, so the primary image region loses its legitimate file backing and threads often start in unbacked memory. Observing both an unbacked primary image and a thread starting outside known modules forms a coherent, high-confidence pattern. Pipe handles, token privilege changes, and working set size are unrelated to the hollowing technique.

The malfind plugin is designed to detect hidden or injected code in memory by identifying memory regions that are both writable and executable and that lack a corresponding file on disk. It also reports the start address of threads within those regions. This makes it the correct choice for finding threads that start outside of legitimate modules, which is a common indicator of process injection or fileless malware.

Setupapi.dev.log and the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log both record USB device installation and connection events with timestamps and device identifiers. These artifacts can provide evidence of a USB device even if the USBSTOR registry key has been cleared, making them essential for corroboration.

The $LogFile is essential for maintaining NTFS consistency. It records all metadata changes before they are committed, allowing the system to recover from crashes by rolling back or completing interrupted operations. While the $LogFile is circular and does not store user data, its entries can often reveal the order of operations, helping an investigator reconstruct the sequence of events leading up to a system compromise.

The KPCR is a structure containing critical processor-specific information, including the current thread and CPU state. It is vital for forensic analysts because it serves as the anchor for finding the current thread of execution on each core. Understanding the KPCR helps analysts reconstruct the execution context, which is essential for identifying which threads were running at the moment of capture, especially during complex multi-threaded attacks.

USB mass storage devices are enumerated under CurrentControlSet\Enum\USBSTOR in the SYSTEM hive, and each device instance includes a Properties subkey with timestamps for first and last connection. Examining that key therefore provides the device identity and the connection timing needed to establish when the device was last attached to the system.

In NTFS, the MFT is treated as a file, and its metadata is stored within its own entry. Record 0 is reserved specifically for the MFT. This recursive structure is fundamental to the NTFS architecture, allowing the system to locate the MFT at boot time and parse the rest of the file system efficiently during startup processes.

The 'TypedPaths' key is a goldmine for investigators as it stores the absolute paths that a user has manually entered into the Windows Explorer address bar. This artifact is highly reliable for proving user intent to access specific directories, including hidden folders or external media paths. By documenting where the user navigated, an analyst can build a compelling case regarding unauthorized file exploration that occurred outside of normal GUI clicking behavior.

Super-timelines aggregate data from diverse sources including file systems, event logs, registry hives, and application-specific artifacts into a single chronological view. Manual timestamp collection is limited to file system metadata, which often fails to capture the 'why' behind an event. By aggregating disparate data, analysts can correlate file changes with system events, providing a much richer, holistic context that is necessary to solve complex, multi-stage security incidents.

NTFS timestamps are recorded in UTC, so a timeline built from them should be normalized to UTC to avoid ambiguity and to allow correlation with other UTC-based sources such as event logs. Documenting the system's time zone configuration provides context for user-facing times but does not change the underlying UTC values. Arbitrary adjustment of timestamps undermines the integrity of the timeline.

A small difference of a few seconds between $STANDARD_INFORMATION and $FILE_NAME creation timestamps is normal and occurs because the two sets of timestamps are written at slightly different times during file creation. It is not necessarily an indicator of timestomping or other manipulation.

Timestomping tools often alter $STANDARD_INFORMATION timestamps without updating $FILE_NAME timestamps, especially when the file is not renamed. This creates a discrepancy where $STANDARD_INFORMATION shows a later modification time than $FILE_NAME. Since the file was not renamed, the $FILE_NAME timestamps likely reflect the original modification time, indicating tampering.

$LogFile and $UsnJrnl both record metadata operations. $LogFile is a write-ahead log that captures transactions before they are committed to the $MFT, making it valuable after an unexpected shutdown. $UsnJrnl provides a persistent change journal that records file and directory modifications. Together they can reconstruct recent activity that may not be present in the $MFT.

Unallocated MFT entries preserve the $STANDARD_INFORMATION and $FILE_NAME attributes of deleted files until those entries are reused. By parsing the $MFT, including slack and unallocated records, an analyst can recover the four MACB timestamps for files that no longer exist in the active file system, which is essential for a complete forensic timeline.

A process named kworker listening on a network port is anomalous because legitimate kworker threads are kernel threads and do not open sockets. This strongly suggests a malicious process masquerading as a kernel thread. The analyst should investigate the executable path and parent process to confirm and identify the malware.

The 'Accepted publickey' line with an RSA SHA256 fingerprint shows sshd validated the client's key, and the subsequent pam_unix session-open confirms a login session. The absence of prior 'Failed password' entries from that IP rules out a brute-force narrative. Key-based access is the correct interpretation, subject to verifying the key's ownership and the trustworthiness of the source address.

Shellbags are stored in the NTUSER.DAT registry hive. They provide an invaluable record of which folders a user has opened and the specific view settings applied to those folders. This artifact is critical for forensic investigations because it proves user presence in specific directories, which can be used to link a user account to the staging of malicious files or the browsing of sensitive data during an incident.

The $MFT, including unallocated entries, provides timestamps for files that existed or were deleted. The $UsnJrnl:$J logs file system changes with timestamps, capturing creation and deletion events. Together, they offer a robust foundation for a file system timeline, allowing analysts to correlate timestamps and change records.

Scheduled tasks are defined as XML files in the Task Scheduler store under C:\Windows\System32\Tasks, and each file includes the task's Triggers and Actions. A logon trigger with an action launching a suspicious binary is exactly the persistence configuration described, so inspecting that XML file directly reveals both the executable and the trigger that causes it to run at logon.

When a file is moved or renamed within an NTFS volume, the $FILE_NAME attribute timestamps are updated to the time of the operation, while $STANDARD_INFORMATION timestamps may remain unchanged. This produces a pattern where $FILE_NAME times are newer than $STANDARD_INFORMATION times. While timestomping can also create discrepancies, it typically makes $STANDARD_INFORMATION appear older, and without additional indicators the move or rename explanation is better supported by the specific pattern observed.

The $FILE_NAME attribute in the MFT record contains the file's name and a reference to its parent directory's MFT entry. By parsing this attribute and then locating the parent MFT entry, an analyst can reconstruct the full path. Other artifacts like $Bitmap or $UsnJrnl may provide supporting information but do not directly contain the full path.

RecentDocs provides a list of recently accessed files and folders, which is valuable for understanding user activity and potential data exfiltration. It does not include hashes, execution times, or last access timestamps, so the correct interpretation is that it indicates browsing activity and accessed documents.

Security event log entries with Event ID 4624 and Logon Type 2 or 10 provide definitive records of interactive and RemoteInteractive logons, including the account name, timestamp, and logon type. Other artifacts like shell bags, SRUM, or Prefetch may show user activity but lack the direct logon session details required to answer who was logged on and when.

Base64 encoded PowerShell commands are a common tactic to bypass signature-based detection. The analyst must extract the encoded string, decode it using standard utilities like CyberChef or PowerShell itself, and then perform static analysis on the resulting script. This process is vital to understand the attacker's intent, such as identifying hidden C2 downloaders, persistence scripts, or data collection commands that were otherwise obscured from basic text-based log searches.

On Linux, parent process and socket state are strong discriminators of legitimacy. A real sshd is started by systemd, which makes PID 1 its parent, and it binds port 22. A process carrying the sshd name but parented by bash and holding no listening socket could not be performing the SSH service role, so the most supportable conclusion is that a binary was renamed to mimic sshd.

Windows services are configured in the registry under HKLM\SYSTEM\CurrentControlSet\Services. Each service has its own subkey containing values like ImagePath, which specifies the executable to run, and Start, which determines the start type. Investigating this key allows you to identify malicious services and their executables.

Shell items, specifically LNK files and Jump Lists, maintain metadata about user file interactions. When a user opens a file, the OS creates these artifacts, which persist even if the target file is removed. This makes them essential for identifying user intent and proving that a malicious file was not only present but was actively accessed by the user, providing critical evidence for attribution.

Event ID 4688 is generated by the Windows auditing subsystem at the instant a process is created, capturing the new process image path and, when command-line auditing is enabled, the full command line. Unlike ShimCache or Amcache, which can be populated by file presence or scanning, 4688 only appears when execution occurs, so it independently proves the suspect binary was launched.

LotL techniques leverage legitimate, pre-installed administrative tools to perform malicious actions. Because these binaries are signed and expected to be present in the environment, traditional endpoint protection often ignores them. Attackers use these tools for discovery, lateral movement, and execution, effectively hiding their activity in the noise of normal system administration tasks, which makes them highly effective for stealthy operations within a compromised network.

The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum is the authoritative location for USB mass storage device connection history. It records the vendor, product, and revision of each device, along with a serial number when available. Other USB-related keys either include non-storage devices or lack the detailed storage-specific information needed to identify connected USB drives.

The 'USBSTOR' registry key in the SYSTEM hive is the definitive artifact for tracking USB device history. It records the vendor, model, and unique serial number of every USB device ever connected. This is critical for forensic investigations involving data exfiltration, as it allows the investigator to prove that a specific physical device was present, regardless of whether the user deleted the device drivers or emptied the recycle bin.

Fileless malware operates by injecting code into memory and often uses scripts like PowerShell to load payloads reflectively without writing executables to disk. Finding injected code in a legitimate process's memory via memory forensics, combined with a PowerShell script block log showing an encoded reflective loader, provides strong evidence of an active fileless attack. The other artifacts—prefetch, service creation with a binary, and ShimCache—all indicate disk-based execution, which is inconsistent with a fileless attack.

The $LogFile is a circular buffer that records metadata transactions to ensure file system consistency. Redo operations replay actions to restore state after a crash, while undo operations revert changes. For a forensic analyst, these logs are vital because they capture the 'before' and 'after' state of MFT entries, providing a granular history of file system modifications that occur faster than standard logging frequencies.

windows.pslist enumerates processes from the active process list, while windows.psscan scans memory for process structures, which can uncover terminated or hidden processes. Using both provides a more comprehensive view of processes that were running or had recently terminated. The other plugins either rely on the same active list or serve different purposes.

The malfind plugin is the standard tool for identifying injected code by scanning for memory segments with Execute/Read/Write permissions that are not backed by a file on disk. This is a critical step in volatile memory analysis because malware often uses process hollowing to hide its execution flow within legitimate system processes. Comparing VAD protections helps confirm the anomaly, which is a hallmark of sophisticated persistent threats evading standard file-based detection.

This specific sequence indicates a network logon successfully authenticating an administrative user, frequently observed during lateral movement via SMB or PsExec. Understanding this pattern allows analysts to differentiate authorized administrative maintenance from credential-based attacks, mapping directly to attacker tactics in enterprise environments.

Legitimate LSASS on Windows is launched by winlogon.exe from C:\Windows\System32\lsass.exe, and the captured parent-child relationship and image path both match that baseline. Because neither attribute deviates from expected behavior, the artifacts support a normal-host classification. Analysts should still corroborate with signature and handle inspection, but these particular memory artifacts do not indicate compromise.

The $ATTRIBUTE_LIST attribute is used when an MFT record is too small to hold all of a file's attributes. By storing a list of references to other MFT records, NTFS allows a single file to span multiple records. This is a crucial concept for analysts because it means that critical evidence, such as timestamps or data runs, might be hidden in secondary MFT records outside the primary entry.

windows.psscan uses pool tag scanning to locate EPROCESS structures in memory, which can uncover processes that have been unlinked from the active process list by rootkits or other hiding techniques. By comparing its output with windows.pslist, an analyst can identify discrepancies indicating hidden processes. The other plugins either rely on the active list or serve different purposes, such as command-line retrieval or network connection enumeration.

Logon Type 3 identifies a network logon, and the NTLM authentication package means the session did not use Kerberos. That alone is not proof of compromise, but it is a meaningful indicator that must be baselined against the account's normal source hosts, logon patterns, and downstream privilege events before any conclusion about credential theft or lateral movement is drawn.

To detect hidden processes, analysts compare the output of windows.pslist, which walks the active process list, with windows.psscan, which scans physical memory for process objects using pool tag scanning. Discrepancies where psscan finds processes not in pslist indicate hidden processes, often due to rootkit activity. The other plugins do not provide this comparison and are used for different forensic purposes.

When attackers use custom encoding to hide web shells, signature-based WAF detections are ineffective. The most robust method is to perform a differential analysis of the web application's codebase against a known-good baseline, such as the original source control repository. By automatically highlighting differences, you can identify injected code blocks that don't match authorized files, regardless of how they are encoded or obfuscated by the attacker during the injection process.

Capturing physical memory and recording active network connections are both essential for preserving volatile evidence. Memory contains running processes, encryption keys, and injected code, while netstat reveals current network activity that may indicate command-and-control or lateral movement. These steps should be performed before any action that alters the system state, such as shutdown or disconnection.

Kernel hooks are a common rootkit tactic used to intercept system calls and hide malicious files, network connections, or processes. By performing integrity checks on the System Service Descriptor Table (SSDT) or the Interrupt Descriptor Table (IDT), an analyst can identify function pointers that point outside the expected range of the kernel's memory space, which is a clear indicator of malicious redirection and rootkit activity.

Security Event ID 4624 with Logon Type 2 records interactive logons at the console. By examining the most recent such event, an analyst can determine when a user last logged on interactively. System Event ID 6005 relates to service startup, Application Event ID 1000 to application crashes, and Security Event ID 4634 to logoffs, none of which answer the question.

In ext4 file systems, the inode change time (ctime) updates whenever the inode metadata is modified, even if the file content (mtime) or access time (atime) remains untouched. Recognizing that metadata-only operations like permission changes or ownership transfers update ctime independently is critical for distinguishing between content tampering and permission hardening.

The VAD tree is a kernel structure used by the memory manager to keep track of the virtual memory ranges allocated to a process. It is essential for forensic analysts because it defines the memory map of a process, including which areas are executable, read-only, or writable. This structure is critical for identifying memory-resident threats that attempt to hide their presence by manipulating memory permissions to execute malicious code.

The Shimcache, or AppCompatCache, tracks file metadata to ensure application compatibility. Crucially, it tracks file paths and last modified times but does not natively record the exact execution timestamp of an application. It is primarily used to identify files that were present on the system and potentially executed, serving as a critical indicator of software presence during an investigation into lateral movement or malware persistence on a Windows endpoint.

EDR policies must be carefully tuned to prevent false positives that can lead to system instability, such as inadvertently blocking critical business processes or causing performance degradation. In production, an 'alert-only' mode is often implemented first to gather data and validate the impact. Without proper testing and tuning, a overly aggressive EDR configuration can disrupt legitimate operations, causing more damage to business productivity than the threats the EDR is intended to mitigate.

SSDT hooking involves redirecting system service calls by modifying the SSDT, which normally points to functions within ntoskrnl.exe. Two key indicators are SSDT entries pointing outside ntoskrnl.exe and the SSDT being writable when it should be read-only. Other artifacts like missing driver files or IDT variations are not specific to SSDT hooking, and a modified kernel hash indicates patching rather than hooking.

windows.netscan can surface network structures that outlive their owning process, so missing process entries alongside established connections often reflect terminated processes rather than hidden malware. Correlating process IDs, timestamps, and other artifacts is the proper next step. Claiming rootkit activity, image corruption, or a confirmed attack from this observation alone is premature and unsupported.

Pass-the-Hash exploits the way NTLM stores password hashes in memory. By limiting the scope of where privileged accounts can authenticate and restricting the use of legacy protocols like NTLM in favor of Kerberos, organizations can significantly shrink the attack surface. Implementing Credential Guard provides an additional layer of hardware-based isolation that prevents the extraction of these hashes from memory, effectively neutralising the primary mechanism that attackers rely on for lateral movement within a domain.

The 'Microsoft-Windows-WMI-Activity/Operational' log is the primary source for tracking WMI interactions. WMI is frequently abused for lateral movement because it allows for stealthy, authenticated command execution. By reviewing these specific operational logs, analysts can correlate WMI provider activity with process creation events, confirming whether a remote actor utilized WMI to launch malicious processes on the target system without needing an interactive shell session.

PsExec usage on a target system leaves two key artifacts: the installation of the PSEXESVC service, recorded in the System event log as Event ID 7045, and the execution of PSEXESVC.exe, which generates a Prefetch file. These directly indicate PsExec activity. Other artifacts like network logons or Amcache entries are less specific and may be caused by other activities.

Successful EDR deployment requires both technical configuration and operational integration. Ensuring comprehensive coverage across all endpoints prevents blind spots where attackers can hide, while defining automated response playbooks allows the IR team to scale their efforts during high-velocity incidents. These tasks are foundational to reducing mean time to respond, as they ensure high-fidelity telemetry is available and actionable, allowing for rapid containment of threats before they escalate across the enterprise network.

Verifying the digital signature of the executable is the most direct way to confirm whether svchost.exe is the legitimate Microsoft binary. A valid signature from Microsoft indicates the file is authentic and unmodified, while an invalid or missing signature suggests masquerading. Other artifacts like Prefetch, $MFT, and SRUM provide contextual information but do not verify integrity and origin.

Prefetch files store an internal last run timestamp in their header, which is updated each time the program executes. Forensic tools like PECmd extract this timestamp, making it the most direct evidence of last execution. File system timestamps such as $STANDARD_INFORMATION Modified can correlate but are not as precise for execution time.

The $LogFile is a circular buffer that records metadata operations before they are finalized. When a system crashes or loses power, the NTFS driver uses the $LogFile upon reboot to replay or undo incomplete transactions, ensuring volume consistency. For investigators, it provides a window into the state of the filesystem immediately before the crash, potentially recovering records of files modified just before the power failure.

UserAssist is stored within the NTUSER.DAT hive of the specific user account. Its value lies in the rotational cipher (ROT13) used for the data, which, once decrypted, reveals a list of GUI-based programs executed by the user. This artifact is invaluable for linking specific user activity to the execution of malicious tools, providing proof that the user was behind the keyboard during the incident, as opposed to an automated system service.

The $LogFile is a circular buffer that records metadata transactions for the file system. It is invaluable for forensic analysts because it captures recent changes to the file system, including those that might not yet be committed to the MFT. By parsing the $LogFile, investigators can recover evidence of file creations, deletions, or renames that occurred shortly before an incident, providing a granular view of recent activity that might otherwise be lost.

Targeting the Domain Admins group is the 'holy grail' for an attacker because it provides full control over the entire Active Directory domain. With these privileges, an attacker can disable security controls, create new accounts, exfiltrate sensitive data, and install persistent backdoors across all systems joined to the domain. This level of access effectively grants the attacker the ability to operate undetected and exert complete influence over the organization's enterprise infrastructure.

Isolating the process behavior through network connection correlation allows the analyst to map the C2 traffic to a specific binary. Identifying the parent process and local socket ownership is essential to distinguish between legitimate background tasks and automated beaconing activity. This helps narrow the scope of the investigation by confirming the persistence mechanism and the specific threat actor communication pattern associated with the compromised host.

The windows.modules plugin is designed to enumerate loaded kernel modules from a Windows memory image, providing a list of drivers and their base addresses. This is essential for comparing against a known-good baseline to identify unauthorized or malicious kernel modules. The other plugins target process lists, DLLs within processes, or handles, none of which directly provide a system-wide kernel module enumeration.

The $MFTMirr file contains a backup of the first few records of the Master File Table. This is vital for filesystem recovery if the primary MFT record gets corrupted. For forensic analysts, the $MFTMirr provides a fail-safe that confirms the structure of the MFT and can sometimes contain remnants of file metadata that are useful when the primary MFT record has been damaged or maliciously altered.

In cloud environments, the most precise way to contain an identity-based attack is to apply an inline policy to the compromised role that explicitly denies all actions, or to revoke the active session tokens. By narrowing the scope of permissions or invalidating current credentials, responders can prevent the attacker from performing further unauthorized API calls while allowing legitimate, non-impacted services to continue functioning correctly within the environment.

To identify the operating system version and service pack from a memory image, you need a plugin that reads kernel version data. windows.info extracts this directly from the kernel structures in memory, providing the build number and service pack level. The other plugins focus on registry hives, process listing, and command lines, none of which directly report the OS version in a concise manner.