I am in the process of creating an IRP that responds to system hacks.
I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access via SSH port 22. From there I have modified file extensions, accessed personal folders etc - on the victim machine.
As part of my IRP, is there any other useful area to look to prove an attack has taken place and files were accessed?? My IRP investigates (so far);
- Windows Event Viewer (Application Logs, System Logs, Security logs)
- OpenSSH log files
Any other alternatives would be very much appreciated.