Detection Labs
Turning an artifact into something that alerts: what to watch, what is normal noise, and how to tell the two apart.
- Triage a Suspected-Compromised Windows 11 PC in 30 Minutes
A fast, ordered pass over a Windows 11 machine you think is compromised, using only free tools. What to check, in what sequence, and how to tell a real finding from normal noise.
Attack and detection · Beginner · T1057, T1543
- ShimCache vs Amcache vs Prefetch: Which One Proves Execution?
Three Windows artifacts get treated as interchangeable evidence that a program ran. Only one of them actually proves it. Here is what each records on Windows 11 and how to read them together.
Forensic artifact · Intermediate · T1057
- Reading the Windows Firewall Log (pfirewall.log) on Windows 11
Windows Firewall can log every allowed and dropped connection, but the logging is off by default. Here is how to turn it on, read the format, and find outbound traffic that should not be there.
Forensic artifact · Beginner · T1071
- Event IDs 7045 and 4698: Spotting Persistence on Windows 11
A new service and a new scheduled task are the two most common ways malware survives a reboot on Windows. Both are logged. Here is how to read those events and separate them from normal software installs.
Attack and detection · Intermediate · T1543.003, T1053.005
- Event ID 4624 and Logon Types: Who Signed In to a Windows PC
Security event 4624 records every successful logon, but the Logon Type field is what makes it useful. Here is what each type means on Windows 11 and which ones should make you look twice.
Forensic artifact · Beginner · T1078
- Scheduled Task Persistence on Windows 11: The Attack and Its Artifacts
How a persistent scheduled task is planted on Windows 11, demonstrated in an isolated lab, and the exact registry keys, XML files, and event IDs it leaves behind for a defender to find.
Attack and detection · Intermediate · T1053.005