Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Suspicious execution on an endpoint

The most common alert and the one where an hour of careful work most often prevents a week of incident. Most of these are not incidents, and the goal is to establish which.

Trigger. An EDR alert, an unexplained process, or a user reporting something odd.

The first 60 minutes1 of 5 expire
030 min60
  1. 01

    Preserve before you interrogate

    by 10 minexpires

    If you are going to isolate, do it now. If you are going to image memory, do that before anything that touches the host. Interactive investigation changes the artifacts you are about to read.

  2. 02

    Establish whether it ran, and how many times

    by 25 min

    Prefetch for execution and a run count. UserAssist for which USER launched it. Amcache for the hash if the binary has since gone.