Module 9 — Evidence, Event Logs, and Artifacts
Module 9 — Evidence, Event Logs, and Artifacts
Summary
Security engineering on Windows is layered evidence: live logs for triage, registry/services/tasks for persistence, filesystem artifacts for timelines. This module maps what to collect, where it lives, and what your lab actually has enabled.
Path: Lab baseline · Next: LSASS & identity
0. Purpose
When someone asks "prove what happened," you need more than Task Manager. Master 15 artifact classes (curated via agentctl research + Microsoft docs) and know which are on vs off on your fleet.
1. ELI5
Windows keeps diaries in different notebooks:
- Security diary — who logged in, who failed, who ran what (if auditing is on)
- Defender diary — what malware or ASR rules fired
- PowerShell diary — what scripts ran (if logging is on)
- Filesystem diary — Prefetch, Amcache, MFT — what touched disk even when logs are gone
Good investigators read multiple notebooks because attackers erase one, not all.
2. The 15 artifact layers (security engineer map)
| # | Artifact | Primary location | Why it matters |
|---|---|---|---|
| 1 | Security EVTX | %SystemRoot%\System32\winevt\Logs\Security.evtx |
Auth, privilege, process audit (4624/4625/4688/4672) |
| 2 | Sysmon Operational | Microsoft-Windows-Sysmon/Operational |
Rich process/network/file/registry/DNS telemetry |
| 3 | PowerShell logs | PowerShell/Operational + script block policy |
Decoded script content (4104) |
| 4 | Defender Operational | Windows Defender/Operational |
1116/1117 detections, 1121/1122 ASR, 5007 config |
| 5 | Registry hives | SYSTEM, SOFTWARE, NTUSER.DAT, SAM |
Persistence, services, policy |
| 6 | AmCache | C:\Windows\AppCompat\Programs\Amcache.hve |
Execution/install metadata |
| 7 | Prefetch | C:\Windows\Prefetch\ |
Run counts (may be off on Win11) |
| 8 | ShimCache | Registry AppCompatCache |
Recent executable paths |
| 9 | WMI | Repository + WMI-Activity/Operational |
Subscriptions, remote WMI |
| 10 | Services | Registry + SCM + System EVTX | Unexpected binaries as services |
| 11 | Scheduled tasks | C:\Windows\System32\Tasks\ + Task Scheduler log |
Deferred execution |
| 12 | MFT + USN | NTFS volume | File create/modify/rename/delete timeline |
| 13 | SRUM | C:\Windows\System32\sru\ |
Per-app network/CPU over time |
| 14 | BITS | BITS job store | Staged downloads |
| 15 | Shell artifacts | LNK, Jump Lists, ShellBags | User file access patterns |
3. EVTX — channels that matter
On lab .114 today (baseline)
| Log | Status | Action for mature lab |
|---|---|---|
| Security | 21k+ records | Enable advanced audit policies; forward to SIEM |
| Defender/Operational | 313 records | Primary AV — already useful |
| PowerShell/Operational | 293 records | Enable Script Block Logging (4104) via GPO |
| CodeIntegrity/Operational | 102 records | Watch driver/block events |
| Sysmon | Installed — SysmonDrv 385201; see 23-lab-tools-inventory |
|
| TaskScheduler/Operational | Enabled | Persistence hunts |
Security log — high-value Event IDs
| ID | Meaning | Hunt for |
|---|---|---|
| 4624 | Successful logon | Odd LogonType, source IP, new accounts |
| 4625 | Failed logon | Spray, brute force |
| 4648 | Explicit credentials | RunAs, net use, lateral movement |
| 4672 | Special privileges assigned | New admin/high-priv session |
| 4688 | Process creation | Requires audit policy — command line if configured |
| 4697 | Service installed | Persistence |
| 4698 | Scheduled task created | Persistence |
| 4768 | Kerberos TGT | DC-side account logon |
| 4776 | NTLM validation | DC-side |
Defender Operational — high-value Event IDs
| ID | Meaning |
|---|---|
| 1116 | Malware detected |
| 1117 | Action taken (quarantine/remove) |
| 1121 | ASR rule blocked |
| 1122 | ASR rule audit (would have blocked) |
| 5007 | Configuration changed |
PowerShell — enable for lab
# Requires admin — Group Policy preferred for persistence
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' `
-Name EnableScriptBlockLogging -Value 1
# Event 4104 in Microsoft-Windows-PowerShell/Operational
4. Filesystem artifacts (beyond EVTX)
| Artifact | Path | Win11 note |
|---|---|---|
| Prefetch | C:\Windows\Prefetch\*.pf |
Often disabled on Win11 — check before relying |
| AmCache | Amcache.hve |
Strong execution/install signal |
| USN Journal | NTFS metadata | fsutil usn queryjournal C: |
| WER | C:\ProgramData\Microsoft\Windows\WER\ |
Crash reports — see wer.dll in 00-dll-target-selection |
| Defender quarantine | Under ProgramData\Microsoft\Windows Defender\ |
Post-detection forensics |
5. Investigation workflow (repeatable)
flowchart TD A[Alert or hypothesis] --> B[Live triage
processes + network] B --> C[Defender EVTX
1116/1121/5007] C --> D[Security EVTX
4624/4648/4688] D --> E[Persistence
tasks / services / Run keys] E --> F[Filesystem timeline
MFT / AmCache / Prefetch] F --> G[Conclusion + hardening]
6. Lab exercises — .114
Exercise A — Defender event tail
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 30 |
Where-Object { $_.Id -in 1116,1117,1121,1122,5007 } |
Select-Object TimeCreated, Id, @{N='Short';E={$_.Message.SubstringMin(120,$_.Message.Length)}}
Exercise B — Security log sample
Get-WinEvent -LogName Security -MaxEvents 20 |
Where-Object { $_.Id -in 4624,4625,4648,4672 } |
Select-Object TimeCreated, Id, Message | Format-List
Exercise C — Gap analysis
Get-WinEvent -ListLog * -ErrorAction SilentlyContinue |
Where-Object { $_.LogName -match 'Sysmon|PowerShell|Defender|TaskScheduler' } |
Select-Object LogName, RecordCount, IsEnabled | Format-Table -AutoSize
Pass: document three gaps on .114 and one remediation. Post-2026-09-01: Sysmon and Task Scheduler log gaps closed — document remaining gaps (e.g. advanced audit policy).