DFIR cheat sheet
The GCFA concepts that come up most: the IR process, threat intel, evidence of execution, lateral movement, memory, timelines and NTFS anti-forensics. Search it like an index.
01The six-step IR process
- 1PreparationBefore anything happens
Methodology, playbooks, tools staged (EDR, KAPE, Velociraptor, memory capture), logging turned on and centralized, team roles defined.
- 2Identification and scopingIs it real, and how big?
Confirm the incident from an alert, hunt, or tip. Find every affected host and account. One alert is almost never the full scope.
- 3Containment and intelligence developmentLearn before you actlongest step
Limit the attacker without tipping them off while you learn how they work: initial access, persistence, C2, lateral movement, and which credentials they hold. Every finding becomes an IOC you hunt across the enterprise.
- 4Eradication and remediationOne coordinated event
Block IOCs, remove persistence, rebuild hosts, reset credentials (KRBTGT twice if Golden Tickets are possible), close the entry point. Do it all at once.
- 5RecoveryBack to business
Restore operations with new controls in place and closer monitoring to catch a return.
- 6Lessons learned and threat intelFeeds back into step 1
Update the playbook, turn TTPs into detections, map them to ATT&CK, and fix the logging gaps the incident exposed.
Steps 2 and 3 are a loop. New IOCs from containment find more infected hosts, which sends you back to scoping. Keep cycling until new hunts stop finding victims, and only then move to eradication.
Rules FOR508 drills in
- Don’t start with eradication. Wiping or unplugging early destroys evidence (especially memory) and warns the attacker.
- Remediation needs full scope. Clean 80% and the attacker keeps the other 20%.
- Don’t whack-a-mole. Cleaning hosts one at a time lets the attacker adapt and switch to backup access.
- Hunt, don’t just react. Reactive teams wait for alerts. Proactive teams assume breach and look.
What takes the longest, at a glance
- IR process
- Containment and intel development
- Super timeline method
- Kitchen sink (everything) vs. targeted at ~5–30 min
- String search setup
- Indexed search is slow to build, then fast to query
- NTFS journal history
$UsnJrnlkeeps days–weeks;$LogFileonly hours on busy systems- Hardest to detect
- Living off the land (no malware dropped)
02Threat intelligence
FOR508 attack lifecycle
| Phase | What’s happening |
|---|---|
| Initial compromise | Access is fragile and easy to disrupt |
| Low-privilege lateral movement | Persistence, privilege escalation, backdoors |
| High-privilege lateral movement | Domain-level access, staging the objective |
| Asset access and exfiltration | Collecting and removing data; leaves footprints |
Attackers spend most of their time in the two lateral movement cycles, so that’s where defenders get the most chances to catch them.
Indicator types
| Type | Examples | Value |
|---|---|---|
| Atomic | IP, domain, hash | Easy to change, noisy |
| Computed | YARA rule, regex, derived data | Stronger signal |
| Behavioral (TTPs) | “PsExec, then LSASS dump, then WMI consumer” | Hardest to change |
Kill chain: Recon → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives.
14 tactics, focused on post-compromise behavior, platform-agnostic. Use Navigator to map what you can and can’t detect.
STIX standard, machine and human readable. YARA text/binary patterns + boolean logic. OpenIOC Mandiant, declining.
MISP and CRITs manage IOCs and support those formats.
03Credential theft
| Attack | How it works | Mitigation |
|---|---|---|
| Pass-the-hash | Reuse NT hash pulled from LSASS (Mimikatz) instead of the password | Credential Guard, disable WDigest, no admin in RDP sessions |
| Pass-the-ticket | Steal a Kerberos ticket from memory and reuse it | Credential Guard, Remote Credential Guard |
| Overpass-the-hash | Use the NT hash to request Kerberos tickets | Credential Guard, Protected Users, disable RC4 |
| Kerberoasting | Request service tickets for SPN accounts, crack offline | Long, complex service passwords; managed service accounts |
| Golden Ticket | Forged TGT signed with the KRBTGT hash; survives password resets | Protect DA accounts; rotate KRBTGT |
| Silver Ticket | Forged service ticket for one service; skips the DC | Regular computer account password updates |
| Skeleton Key | Patches LSASS on a DC so one master password works for any account | Protect DA accounts; smart cards for privileged users |
| DCSync | Pretends to be a DC and replicates password hashes | Audit and limit accounts with replication rights |
Where credentials live
- Local hashes
- SAM:
C:\Windows\System32\config\SAM - Domain hashes
- NTDS.DIT:
C:\Windows\NTDS\NTDS.DIT(ntdsutil, VSS) - Tokens, tickets
- LSASS process memory
- Cached creds
HKLM\SECURITY\Cache(limit with cachedlogonscount)- LSA secrets
HKLM\SECURITY\Policy\Secrets(use gMSA)
Detection: privileged account use (4672), new accounts (4720), after-hours or workstation-to-workstation logons, failed logons (4625). Avoid shared local admin passwords and limit RID 500. BloodHound maps AD privilege paths and is hard to detect because it uses normal LDAP queries.
04Persistence to check first
HKLM/HKCU\...\CurrentVersion\Run and RunOnce. Tools: Autoruns, RegRipper, Registry Explorer, Kansa.
New service, replaced binary, or failure recovery set to run malware. sc qc, Get-SvcFail.ps1.
at.exe (old) and schtasks.exe, which can run remotely. Used for persistence and lateral movement.
Search order, phantom (e.g., fxsst.dll), side-loading (SxS), relative path.
Filter + Consumer + FilterToConsumerBinding in root\subscription. Event 5861.
svchost.exe running from \Temp or $Recycle.Bin. Prioritize unsigned code, but signed malware exists.
05Evidence of execution
| Prefetch | ShimCache (AppCompatCache) | Amcache | |
|---|---|---|---|
| Location | C:\Windows\Prefetch\*.pf | SYSTEM hive ...\Session Manager\AppCompatCache | C:\Windows\AppCompat\Programs\Amcache.hve |
| Proves execution? | Yes | Not on its own | Not on its own |
| Key data | Run count, first and last run, files touched in the first 10 seconds | Full path, last modified time, file size; newest entry first | SHA1, path, size, publisher, install date, drivers |
| Gotchas | 1,024 file limit (Win8+) deletes old entries, so “first run” can be wrong. Hash = path, except svchost, dllhost, rundll32, backgroundtaskhost (path + command line) | Lives in memory and is written to disk only at shutdown or reboot. Volatility shimcachemem can read it live | InventoryApplicationFile, InventoryApplication, InventoryDriverBinary. Good for files dropped without installation |
| Tool | PECmd (-f file, -d folder) | AppCompatCacheParser, ShimCacheParser.py | AmcacheParser; AppCompatProcessor.py for both |
Prefetch creation date ≈ first run, modified date ≈ last run. Two Prefetch files with the same name but different hashes = the program ran from two paths.
06Lateral movement: source vs. destination
| Technique | Source host | Destination host |
|---|---|---|
| PsExec | psexec.exe in Prefetch; 4648 | 4624 type 3; 7045 / 4697 service PSEXESVC (or random); 5140 ADMIN$ |
| RDP | 4648; mstsc.exe | 4624 type 10; 4778 / 4779 reconnect and disconnect (client name + IP); 1149 |
| Admin shares | net use; 4648 | 4624 type 3; 5140 share accessed; 5145 file-level detail |
| Scheduled tasks | schtasks.exe / at.exe; 4648 | 4624 type 3; 4698 created (Task Scheduler 106); 200 / 201 run |
| WMI | wmic.exe; 4648 | 4624 type 3; children of WmiPrvSE.exe; 5861 if a consumer was made |
| PowerShell | 4648; 4104 script blocks | 4624 type 3; wsmprovhost.exe; 4104 script blocks |
| make_token / PTH | 4624 type 9 (new credentials); 4648 | 4624 type 3 with the stolen account |
07Event IDs worth memorizing
| ID | Meaning |
|---|---|
| 4624 / 4625 | Logon success / failure (check Logon Type) |
| 4634 / 4647 | Logoff / user-initiated logoff (match Logon ID for session length) |
| 4648 | Logon with explicit credentials (RunAs, remote with alt creds) |
| 4672 | Special (admin) privileges assigned |
| 4720 → 4732 | Account created → added to local group |
| 4768 / 4769 / 4771 | TGT request / service ticket / failed pre-auth |
| 4776 | NTLM credential validation |
| 4778 / 4779 | RDP session reconnect / disconnect |
| 4798 / 4799 | User / group enumeration (recon) |
| 4688 / 4689 | Process created / exited (command line if audited) |
| 7045 / 4697 | Service installed (System / Security) |
| 7034 / 7036 / 7040 | Service crashed / started-stopped / start type changed |
| 4698 / 4699 / 4702 | Task created / deleted / updated |
| 5140 / 5145 | Share accessed / file-level share check |
| 1102 | Security log cleared (logged in Security) |
| 104 | Any other log cleared (logged in System) |
| 4104 | PowerShell script block logging |
| 5861 | WMI permanent event consumer registered |
Logon types
- 2
- Console (interactive)
- 3
- Network
- 4
- Batch
- 5
- Service
- 7
- Unlock
- 8
- Network cleartext
- 9
- New credentials (RunAs)
- 10
- RDP (remote interactive)
- 11
- Cached
PowerShell history: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
08Memory forensics
Fileless malware, injected code, rootkits, and in-memory C2 often leave little or nothing on disk. Some attacks are nearly impossible to unravel without it.
Live capture: DumpIt, WinPMEM, FTK Imager, F-Response, Redline. Also hiberfil.sys, pagefile.sys, swapfile.sys, MEMORY.DMP. VMs: suspend, then grab .vmem (VMware), .bin/.vsv (Hyper-V), .sav (VirtualBox, partial).
Six-step analysis with Volatility
| # | Step | Plugins | Looking for |
|---|---|---|---|
| 1 | Identify rogue processes | pslist, psscan, pstree, psxview -R | Wrong parent, wrong path, misspelled names, hidden or unlinked processes |
| 2 | Analyze DLLs and handles | dlllist, cmdline, getsids, handles, mutantscan | Odd DLLs, suspicious arguments, SYSTEM where it shouldn’t be, known mutexes |
| 3 | Review network artifacts | netscan (Vista+); connections, connscan, sockets (XP/2003) | Non-browsers on 80/443, direct-to-IP, odd listeners, workstation-to-workstation |
| 4 | Look for code injection | malfind, ldrmodules, hollowfind | RWX pages, DLLs missing from PEB lists, hollowed images |
| 5 | Check for rootkits | ssdt | egrep -v '(ntos|win32k)', psxview, modscan, modules, apihooks, idt | Hooks pointing outside ntoskrnl/win32k, hidden drivers |
| 6 | Dump suspicious items | procdump, memdump, dlldump, moddump, filescan + dumpfiles, cmdscan, consoles | Pull samples for strings, YARA, AV, or reversing |
Start with imageinfo or kdbgscan to pick the profile (Volatility 3: windows.info.Info, no profile needed). KDBG gives Volatility the process list (_EPROCESS), loaded modules, and VADs.
Code injection types
| Type | How it works | Catch it with |
|---|---|---|
| DLL injection | OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread → LoadLibrary | dlllist, ldrmodules |
| Process hollowing | Start legit process suspended, unmap its code, write malware, resume | hollowfind, malfind |
| Reflective DLL | DLL carries its own loader and skips the Windows loader | malfind, ldrmodules |
Pairs people mix up
- pslist vs psscan
- Walks the linked list vs. scans for signatures (finds unlinked and exited)
- cmdscan vs consoles
- Commands only vs. commands and output
- procdump vs memdump
- Rebuilt executable vs. all process memory
- modules vs modscan
- Linked list overview vs. signature scan for hidden drivers
- baseline -U vs -K
- Not in clean image (unknown) vs. in it (known)
09Timeline analysis
NTFS timestamps (MACB)
- M
- Modified: content last changed
- A
- Accessed: last read
- C
- MFT Changed: metadata changed (not creation)
- B
- Born: created
Stored in UTC. SMB copy rule: modified time comes over from the source, creation time is set when the file lands. Modified older than created = copied file, a lateral movement clue. Timestamps can also change from Office/WinZip, archives (ZIP/RAR keep modified time), AV scans, and timestomping.
Five-step timeline process
- Determine scope: the questions and the timeframe
- Narrow pivot points: alert time, bad URL/DNS, process, file name, account, lateral movement, anti-forensic tools
- Choose the method: filesystem or super timeline
- Filter: cut noise to the pivot points
- Analyze: read context before and after each pivot
| Filesystem timeline | Super timeline | |
|---|---|---|
| Tools | MFTECmd or fls → mactime | log2timeline → pinfo → psort |
| Data | Filesystem metadata only | Filesystem + artifacts + registry + logs |
| Use | Fast triage, many filesystems | Full, detailed picture |
Plaso tools
- log2timeline
- Extracts events into a Plaso storage file
- pinfo
- Shows storage metadata, parsers, errors
- psort
- Filters, sorts, dedupes, sets time zone, outputs
Kitchen sink = all parsers on the full image, slowest and biggest. Targeted = parser lists, filter files, or KAPE triage images, ~5–30 min.
10Anti-forensics and NTFS
| $LogFile | $UsnJrnl | |
|---|---|---|
| Analogy | Flight data recorder | Cockpit voice recorder |
| Detail | Low-level transactions | High-level changes (create, rename, delete) |
| Keeps | Hours on busy systems | Days to weeks |
| Tool | LogFileParser | MFTECmd (--vss for snapshots) |
MFT facts
- Each entry is 1,024 bytes: header,
$STANDARD_INFORMATION,$FILE_NAME,$DATA - Small files are resident (data inside the MFT entry)
- Entries are allocated in order, so neighbors were likely created together
$I30directory index slack can hold names of deleted files (Indx2Csv, Velociraptor)- Alternate Data Streams can hide data
What happens when a file is deleted
Clusters marked free in $Bitmap. Data stays until reused.
A bit flips in the MFT record. Metadata stays until the record is reused.
$FILE_NAME and the parent’s $I30 entry stay until reuse.
Recovery
- Metadata method (MFT entry intact): icat, tsk_recover, FTK Imager
- Carving (entry reused): PhotoRec, 300+ types; bulk_extractor-rec for MFT, $I30, $UsnJrnl, $LogFile, EVTX records
- Deleted VSS: vss_carver.py. Mount VSCs with vshadowmount, Arsenal Image Mounter, F-Response
- Registry: Registry Explorer recovers deleted keys and finds large or Base64 values hiding fileless malware
Wipers still leave traces
Repeated renames in $UsnJrnl, its own Prefetch, $I30 slack, Search index logs.
$UsnJrnl, $LogFile, $I30 slack, MFT records. Countermeasures: bigger journals, VSS on with ScopeSnapshots off, central log forwarding, Sysmon.
no hits. try a shorter term.
Built from “A Guide to GIAC Certified Forensic Analyst” (Ishrag Hamid) plus standard Windows references for a few items (RDP 1149, wsmprovhost, netscan OS support, ShimCache execution caveat). Verify against your SANS FOR508 books when indexing.