I am in the process of creating an IRP that responds to system hacks.

I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access via SSH port 22. From there I have modified file extensions, accessed personal folders etc - on the victim machine.

As part of my IRP, is there any other useful area to look to prove an attack has taken place and files were accessed?? My IRP investigates (so far);

  • Windows Event Viewer (Application Logs, System Logs, Security logs)
  • OpenSSH log files

Any other alternatives would be very much appreciated.

  • Unless your logs are exported to another system, they are useless. They can be deleted or edited by the attacker.
    – ThoriumBR
    Commented Jan 16, 2020 at 19:06
  • Yeah I’m aware of that, that’s why I’m asking for alternatives.
    – C.Mann
    Commented Jan 16, 2020 at 19:08
  • First of all, export the logs to another system. Check if the local logs and the remote logs are in sync. If they don't, you have an attack and can know exact what the attacker tried to hide.
    – ThoriumBR
    Commented Jan 16, 2020 at 19:10

1 Answer 1


Memory + Hoarder artifacts

Most guides want you to examine processes, network connections, and Event Logs. I don't recommend this.

Others, such as this great guide -- https://unminioncurioso.blogspot.com/2019/03/dfir-first-steps-with-volatility.html -- go into detail about timelines and certain registry hives, such as Amcache, that provide a unique view into what happened.

Perform an analysis using one of these as guest VMs after transferring your artifacts over:

  • Thanks. Is memory or hoarder artefacts considered as live or dead forensics? I’ve finished my computing degree but I’m trying to get my foot in the door in Forensics. So I’m aiming to demonstrate that I’m looking at the evidence collected via “dead forensics”.
    – C.Mann
    Commented Jan 19, 2020 at 18:26
  • Dead usually means the system isn't on, so live
    – atdre
    Commented Jan 20, 2020 at 4:22
  • Ah ok that’s no good for me as I’m trying to demonstrate dead forensics. Thanks anyway
    – C.Mann
    Commented Jan 20, 2020 at 11:18
  • I'll come up with an answer for you, don't worry little guy!
    – atdre
    Commented Jan 20, 2020 at 17:58
  • Cheers badman!!
    – C.Mann
    Commented Jan 20, 2020 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .