Tools · Forensics tools · 25 / 25
Sysmon: follow one ProcessGuid across the log
The case becomes a single chain when Event IDs 1, 11, 22, and 3 share a ProcessGuid. Other IDs, including 7, 8, and 10, are how you notice a second process. Security tools generate those too.
Build the chain before you add color
Take the ProcessGuid from Event ID 1 and collect every later event that carries it, in UtcTime order. For pid 4812’s GUID the chain is short. At 09:17:04 Brooklyn the shell starts under explorer.exe, with the encoded copy command. At 09:17:05 Event ID 11 creates the Temp workbook. At 09:17:06 Event ID 22 resolves the lab host, and Event ID 3 opens TCP 443. At 09:19:58 Event ID 5 records termination. That is the spine. Everything you say in the Sysmon section of the report should hang off this list or be clearly labeled as a different GUID.
Write the spine as a table in the case note with ID, Brooklyn time, and one field. The CSV stays the evidence. The table is the index. If a time disagrees with Autopsy by a second, keep both. Clocks on a busy host and a parser’s rounding are ordinary. A disagreement of hours is the timezone problem from the first Autopsy lesson, and you fix the conversion rather than the story.
09:17:04 ID 1 powershell.exe from explorer.exe 09:17:05 ID 11 TargetFilename ...\Temp\p4.xlsx 09:17:06 ID 22 drop.lab.example -> 203.0.113.44 09:17:06 ID 3 tcp 203.0.113.44:443 initiated 09:19:58 ID 5 process terminated
IDs 7, 8, and 10 involve another image
Event ID 7 is an image load: a module mapped into a process, with a hash and a signature field when the config recorded them. You use it when you need to know whether the stock shell loaded a module from Temp. A System32 module with a valid signature is the ordinary load. A Temp path is the row to tag.
Event ID 8 is a remote thread created in a target process, and Event ID 10 is a process opening another process, with a GrantedAccess value and a call trace. Endpoint agents and debuggers generate both on machines that run them. The reading method is the same: SourceImage, TargetImage, user, and time. A source in the agent’s install path, matching the inventory you used in the Volatility lesson, is the agent. A source of the powershell GUID opening an unrelated process is a row you add to the chain and ask a reviewer to look at. You record the access mask as printed. You do not need a procedure for creating a remote thread in order to file the event.
What this chain does not contain
There is no Event ID 8 or 10 on this GUID in the export. There is no Run-key Event ID 13. There is no delete. malfind was quiet. The binary hash is the known shell. The accurate picture is a short-lived stock shell, started from Explorer, that copied a workbook and opened one connection. That picture can still be serious for Northline, because the file is payroll and the destination was not a host they recognize. Seriousness lives in the data and the peer, and it does not require you to promote the event into a different class of technique you did not observe.
If a later GUID deletes the file or a scheduled task appears under a different process, that is a second chain. Give it its own ProcessGuid and its own spine. Merging two GUIDs because they happened the same morning will make a parent relationship you cannot point at in the log.
The cross-tool page
You can now write the front of the case in one page. Disk: two paths, one SHA-256, Brooklyn times, Edge downloads silent, link file at 09:16. Memory: exited powershell object, command line, TIME_WAIT to the same peer, no private executable region, file object still named. Sysmon: the spine above, config known, network logging was on. YARA: the staged name is in the command-line extract and in your own notes. CyberChef: the encoded argument is the copy, and the config key reveals the host field.
The open questions stay on that page. You do not have the TLS payload. You do not have the remote server’s log. You do not have a statement of intent. Recommend those sources if counsel wants them, and stop. The tools did the job they can do on the materials already in the lab.
Worked case: the spine is the finding
You paste the five-line spine into the report and attach the event record IDs. Under it, one paragraph cites the matching workbook hash, the NSRL match on powershell.exe, the decoded copy command, and the DNS name. A second paragraph lists the negatives: no Run value, no delete event, no Event ID 8 or 10 for this GUID, malfind empty, Edge download store silent. A third paragraph states the gap: payload and server-side receipt are outside the lab materials.
You title the section with the case number and the ProcessGuid, not with a nickname for a technique. The second examiner can filter the CSV on {1b2c-4812} and see the same five events. That repeatability is the standard you have been writing toward since the image hash.
Diagram
One ProcessGuid, in order, with the gap labeled
- Start
Event ID 1. User, parent, hash, command line. This is the GUID for the rest of the filter.
- File
Event ID 11. TargetFilename, then the disk hash. Registry and delete IDs join here if they exist.
- Peer
Event ID 22, then Event ID 3, if the times fall in that order. Quote the tuple. Leave the payload out.
- Stop
Event ID 5 ends the lifetime. Other GUIDs stay in their own chains. Write the questions the logs do not answer.
{1b2c-4812} 1 create -> 11 Temp\p4.xlsx -> 22 name -> 3 :443 -> 5 exit Open: payload, server receipt, intent
Check yourself
1. The powershell ProcessGuid has Event IDs 1, 11, 22, 3, and 5. The endpoint agent has many Event ID 10 rows against other processes, and inventory says that agent is deployed. How should the report treat the agent’s Event ID 10 rows?