ForenShield Lab · Forensic Lab
Read the timeline of a compromised machine
About twenty events from a fictional Windows machine, most of them perfectly normal. Click, compare and flag the ones that should not be there.
- ≈ 12 min
- No account
- Fictional data
Outline
What you will do
Browse the events
Filter by processes, network, files or Windows events.
Inspect the details
Parent process, command line, user: it is all in the record.
Flag the anomalies
Only flag what looks suspicious to you: false alarms count too.
Read the answers
Each event is explained and the whole sequence is rebuilt.
Key takeaways
What you will learn
- Recognize an abnormal process parent
- Read Event IDs 4624, 4688, 7045 and 1102
- Link a process to its network and file activity
- Avoid concluding from a single event
On real data
Then move on to the real tools
The simulation is for practice. For your own data, use the tools designed for that purpose.
Frequently asked questions
Before you start
Are these logs real?
No, they were written for the exercise: the machine, users, addresses and hashes are made up. The demonstration performs no forensic analysis. To examine a real machine, use ForenShield Client.
Are the event numbers accurate?
Yes. The Event IDs and Sysmon events shown match their real meaning in Windows. The site’s Event ID reference lets you go further.
How is the grade calculated?
You earn points for each anomaly found and lose points for each normal event wrongly flagged. A good analyst finds the traces without crying wolf.