/investigating-windows-endpoints

name: investigating-windows-endpoints
description: Investigate a compromised or suspicious Windows host from on-disk artifacts -- triage collection, evidence of execution (Prefetch, Amcache, Shimcache, SRUM, UserAssist, BAM), the event-log workhorses by ID (Security 4624/4688/4720/7045/1102, Sysmon, PowerShell 4104, RDP, WMI), persistence hunting across every autostart, lateral-movement traces, $MFT/USN filesystem forensics, anti-forensics detection, and building a super-timeline with the Eric Zimmerman suite, Chainsaw, Hayabusa, and Plaso. Use when triaging a compromised or suspicious Windows host, working through EVTX/Sysmon logs, reconstructing what executed on a Windows machine, hunting persistence and lateral-movement traces, or analyzing a KAPE/triage collection.
verified: 2026-07-26

Investigating Windows Endpoints

Windows records execution, persistence, and access in dozens of artifacts the attacker rarely cleans completely. The event logs are only the surface -- the registry, prefetch, amcache, and the file-system journals corroborate or contradict them. The investigation is cross-referencing independent artifacts into one timeline that no single cleared log can defeat.

When to Use

• Triaging a compromised or suspicious Windows host, live or from an image
• Working through a KAPE, Velociraptor, or EDR triage collection
• Reconstructing what executed on a Windows machine and in what order
• Parsing EVTX / Sysmon / PowerShell logs to reconstruct attacker activity
• Hunting persistence and lateral-movement traces across the endpoint
• Detecting timestomping, log clears, and other on-host anti-forensics

When NOT to Use

• **The host is Linux** -- use `analyzing-linux-persistence`
• **You need the overall IR process and multi-host coordination** -- use

`responding-to-incidents`; come here when one Windows host is the focus

• **You have a RAM capture to work** -- use `analyzing-memory-images`; come

here for the on-disk artifacts

• **The compromise is in cloud identity, not on the endpoint** -- use

`investigating-m365-entra`

• **Proactive fleet-wide hunting with no specific host** -- use

`hunting-threats`

• **You are the attacker on the host, not the responder** -- use

`escalating-windows-privileges`

Triage Collection First

Do not analyze the live disk in place. Collect a triage set, hash it, and work on the copy. For most incidents a targeted triage collection answers the question faster than a full image; image only the hosts that matter.

**Dead vs. live acquisition.** A powered-off host or a mounted disk image is a dead acquisition -- consistent, but you lose running processes, network state, and unflushed logs. A live host lets you capture volatile state (memory, `netstat -anob`, `Get-NetTCPConnection`, `tasklist /svc`) but every action mutates the disk; record what you touch. Capture memory first if the host is live and "are they still here" is open, then hand it to `analyzing-memory-images`.

:: KAPE targeted triage -- the fastest way to a defensible artifact set
kape.exe --tsource C: --target !SANS_Triage --tdest E:\out\host01 --vhdx host01
:: Broader coverage: registry hives, event logs, $MFT/$J, browser, prefetch
kape.exe --tsource C: --target KapeTriage,RegistryHives,EventLogs,FileSystem ^
  --tdest E:\out\host01

:: Then run the parsers (Modules) over what you collected
kape.exe --msource E:\out\host01 --mdest E:\out\host01\parsed ^
  --module !EZParser

Velociraptor (`Windows.KapeFiles.Targets`) collects the same set at fleet scale over an agent. Whatever the tool, verify hashes before and after every copy.

**Key artifact directories** to make sure your collection contains:

C:\Windows\System32\winevt\Logs\          Event logs (.evtx)
C:\Windows\System32\config\               Registry hives: SYSTEM, SOFTWARE, SAM, SECURITY
C:\Users\<u>\NTUSER.DAT                    Per-user registry hive
C:\Users\<u>\AppData\Local\Microsoft\Windows\UsrClass.dat   Shellbags, COM
C:\Windows\Prefetch\                       *.pf execution evidence
C:\Windows\appcompat\Programs\Amcache.hve  Amcache
C:\Windows\System32\sru\SRUDB.dat          SRUM
C:\Windows\System32\Tasks\                 Scheduled task XML
C:\$MFT  C:\$Extend\$UsnJrnl  C:\$LogFile  Filesystem journals
C:\$Recycle.Bin\                           Deleted-file $I records

Evidence of Execution

Multiple independent artifacts record that a binary ran. Cross-reference them -- agreement raises confidence, disagreement is itself a finding.

:: Prefetch -- run count, first/last run, files/dirs the binary touched.
:: Absent on most Servers; disabled on SSD-only systems -- note that, don't assume.
PECmd.exe -d C:\Windows\Prefetch --csv E:\out\parsed -q

:: Amcache -- SHA-1 of executed/present binaries, compile times, driver load
AmcacheParser.exe -f C:\Windows\appcompat\Programs\Amcache.hve ^
  --csv E:\out\parsed -i

:: Shimcache / AppCompatCache (SYSTEM hive) -- path + last-modified; presence
:: means the file was seen, NOT necessarily executed. Order is roughly LRU.
AppCompatCacheParser.exe -f C:\Windows\System32\config\SYSTEM --csv E:\out\parsed

:: SRUM -- per-process bytes sent/received and CPU over 30-60 days.
:: Ties an executable to network volume even when netflow is gone.
SrumECmd.exe -f C:\Windows\System32\sru\SRUDB.dat ^
  -r C:\Windows\System32\config\SOFTWARE --csv E:\out\parsed

From the user (NTUSER.DAT / UsrClass.dat) hives, parse GUI-execution and file-access evidence with `RECmd`:

:: UserAssist (GUI program launches, run count, focus time),
:: BAM/DAM (background/desktop activity moderator: last-run per exe per SID),
:: RecentDocs, and RunMRU in one pass with the bundled batch file
RECmd.exe -d C:\Users --bn BatchExamples\UserActivity.reb --csv E:\out\parsed

• **Jump Lists** (`...\Recent\AutomaticDestinations\*.automaticDestinations-ms`)

and **LNK files** (`...\Recent\*.lnk`) record opened files/apps with target path, volume serial, a