DFIR Artifact Quick Reference

Audience: DFIR practitioners conducting Windows-centric incident response and forensic investigations.
Scope: Windows 10/11, Server 2016–2022 unless noted.
Legend: [EZ] = Eric Zimmerman tool | [TS] = Triaged from live system | [IMG] = Requires disk image

Table of Contents

  1. Execution Artifacts
  2. Persistence Mechanisms
  3. Account & Authentication Activity
  4. Lateral Movement Indicators
  5. File System & File Activity
  6. Network Activity
  7. Anti-Forensics & Defense Evasion
  8. Data Exfiltration Indicators
  9. Cloud & Browser Artifacts
  10. Key Event Log IDs Reference
  11. Critical Registry Keys Reference
  12. Recommended Toolchain

1. Execution Artifacts

Prefetch

PropertyDetail
PathC:\Windows\Prefetch\*.pf
Exists onWorkstations (enabled by default); Servers (disabled by default)
Key DataExecutable name, run count, last 8 run timestamps, files/dirs referenced
ToolPECmd.exe [EZ]
Investigative ValueProves execution even if binary is deleted; timestamps survive binary removal
ATT&CKT1204, T1059

Notes:

  • Max 1024 entries (Win8+), FIFO eviction
  • Hashes in filename are path + volume serial based — path changes = new hash
  • svchost.exe may have multiple prefetch files for different -k arguments

ShimCache (AppCompatCache)

PropertyDetail
Registry PathHKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
Key DataExecutable path, last modified time of binary, executed flag (Win7 only)
ToolAppCompatCacheParser.exe [EZ]
Investigative ValueRecords executables Windows has seen, regardless of whether they ran (Win8+)
ATT&CKT1036, T1059

Notes:

  • Win8/10+: Presence does NOT confirm execution — only that the file existed and metadata was touched
  • Cache is written to registry at shutdown — live acquisition may miss last session entries
  • Volatile: reboot can flush uncommitted entries

AmCache

PropertyDetail
PathC:\Windows\AppCompat\Programs\Amcache.hve
Key DataFull path, SHA1 hash of binary, first execution time, install date, publisher
ToolAmcacheParser.exe [EZ]
Investigative ValueSHA1 hash available without running the binary — pivot to VirusTotal immediately
ATT&CKT1204, T1027

Notes:

  • Hive is locked on live system — parse from VSS copy or offline image
  • Both ProgramEntries and UnassociatedFileEntries are investigatively valuable
  • SHA1 is of the PE header; truncated hashes common for large binaries

BAM / DAM (Background Activity Moderator)

PropertyDetail
Registry PathHKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\{SID}
Key DataExecutable path, last execution time (UTC) per user SID
ToolRegistry Explorer [EZ], reg query [TS]
Investigative ValueConfirms execution per-user with timestamps; survives binary deletion
ATT&CKT1204, T1059

Notes:

  • Windows 10 v1709+ only
  • Entries persist across reboots
  • Directly attributes execution to specific user accounts by SID

UserAssist

PropertyDetail
Registry PathHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count
Key DataROT-13 encoded executable names, run count, last run timestamp
ToolRegistry Explorer [EZ]
Investigative ValueGUI-launched application history with run count + last execution time per user
ATT&CKT1204.002

Notes:

  • ROT-13 decode required on all entries
  • Only tracks GUI-launched executables (not CLI-launched)
  • Two GUIDs present: UEME_RUNPATH and UEME_RUNPIDL

Jump Lists

PropertyDetail
Path%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\ and CustomDestinations\
Key DataRecently opened files per application (AppID), timestamps, file paths
ToolJLECmd.exe [EZ]
Investigative ValueFiles opened via specific applications; persists after target file deletion
ATT&CKT1204.002, T1566.001

2. Persistence Mechanisms

Run Keys

Registry PathScope
HKCU\Software\Microsoft\Windows\CurrentVersion\RunCurrent user, every logon
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceCurrent user, once
HKLM\Software\Microsoft\Windows\CurrentVersion\RunAll users, every logon
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceAll users, once

Tool: Registry Explorer [EZ], Autoruns (Sysinternals) | ATT&CK: T1547.001

Scheduled Tasks

PropertyDetail
Path (XML)C:\Windows\System32\Tasks\
Registry PathHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
Key DataTask name, triggers, actions (command + args), author, creation/modification times
ToolSchtasksParser.exe [EZ], manual XML review
Event IDs4698 (Created), 4702 (Updated), 4700/4701 (Enabled/Disabled)
ATT&CKT1053.005

Notes:

  • Deleted task XML may persist in registry under TaskCache
  • Compare filesystem vs. registry — discrepancy indicates tampering
  • Action fields often expose full command line including LOLBin abuse

Services

PropertyDetail
Registry PathHKLM\SYSTEM\CurrentControlSet\Services\
Key DataImagePath, Start type, DisplayName, Description
Event IDs7045 (New Service), 7034/7035/7036 (State changes)
ToolRegistry Explorer [EZ], sc query [TS]
ATT&CKT1543.003

Notes:

  • ImagePath pointing to Temp, AppData, or ProgramData = high suspicion
  • Services with no Description or generic names are a common malware indicator

WMI Subscriptions

PropertyDetail
PathC:\Windows\System32\wbem\Repository\
Key DataEventFilter, EventConsumer, FilterToConsumerBinding
ToolPyWMIPersistenceFinder.py, WMI Explorer
ATT&CKT1546.003

Notes:

  • No binary on disk required (script consumer) — extremely stealthy
  • Repository is binary format requiring specialized tooling
  • Check for CommandLineEventConsumer and ActiveScriptEventConsumer types

Startup Folders

PathScope
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Current user
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\All users

ATT&CK: T1547.001

3. Account & Authentication Activity

Key Security Event IDs

Event IDDescriptionLog
4624Successful logonSecurity
4625Failed logonSecurity
4634 / 4647LogoffSecurity
4648Explicit credential logon (RunAs, PTH indicator)Security
4672Special privileges assigned (admin logon)Security
4720User account createdSecurity
4726User account deletedSecurity
4728 / 4732 / 4756Member added to security/local/universal groupSecurity
4771Kerberos pre-auth failedSecurity (DC)
4776NTLM auth attemptSecurity (DC)
4768TGT requestedSecurity (DC)
4769Service ticket requestedSecurity (DC)

Logon Type Reference

TypeDescriptionAttack Relevance
2Interactive (console)Local access
3NetworkSMB, net use, lateral movement
4BatchScheduled task execution
5ServiceService account logon
7UnlockWorkstation unlock
8NetworkCleartextWinRM, IIS basic auth — credential exposure risk
9NewCredentialsRunAs /netonly — PTH indicator
10RemoteInteractiveRDP
11CachedInteractiveOffline / cached credential use

SAM Database

PropertyDetail
PathC:\Windows\System32\config\SAM
Key DataLocal accounts, NTLM hashes, account flags, last logon
ToolRegistry Explorer [EZ] with SYSTEM hive for decryption
ATT&CKT1003.002

4. Lateral Movement Indicators

RDP

ArtifactLocationKey Data
Event ID 4624 (Type 10)Security.evtxSource IP, username
Event ID 1149TerminalServices-RemoteConnectionManager%4Operational.evtxSource IP, username (pre-auth)
Event ID 21, 25TerminalServices-LocalSessionManager%4Operational.evtxSession logon/reconnect
Bitmap Cache%LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\Pixel fragments of remote session
MRU RegistryHKCU\Software\Microsoft\Terminal Server Client\DefaultRecently connected RDP hosts

SMB / Lateral Tool Transfer

ArtifactLocationKey Data
Event ID 4624 (Type 3)Security.evtxNetwork logon from remote host
Event ID 5140Security.evtxNetwork share accessed
Event ID 5145Security.evtxShare object access check
Named PipesSysmon Event ID 17/18PsExec, Cobalt Strike SMB beacons

PsExec

ArtifactLocation
Service creationSystem.evtx Event ID 7045 (PSEXESVC)
PrefetchPSEXESVC.EXE-*.pf on target host
RegistryHKLM\SYSTEM\CurrentControlSet\Services\PSEXESVC
Sequential logon eventsEvent ID 4624 Type 3 followed by Type 2, same source

WMI Remote Execution

ArtifactLocationKey Data
Event ID 4624 Type 3Security.evtxSource IP
WMI Activity LogMicrosoft-Windows-WMI-Activity%4Operational.evtxProcess creation, query execution
Sysmon Event ID 19/20/21Sysmon.evtxFilter/consumer activity
wmiprvse.exe child processesPrefetch, Sysmon Event ID 1Spawned command execution

Pass-the-Hash / Pass-the-Ticket Indicators

IndicatorDetail
Event ID 4624 Logon Type 9NewCredentials — explicit credential use
Event ID 4648Logon with explicit credentials
Event ID 4769 with RC4 encryptionDowngrade attack / Kerberoasting indicator
Source workstation mismatchLateral movement pivot
Event ID 4769 from non-domain-joined hostGolden/Silver Ticket activity

5. File System & File Activity

MFT (Master File Table)

PropertyDetail
Path$MFT at NTFS volume root
Key DataAll file metadata: $STANDARD_INFO and $FILE_NAME timestamps, size, parent directory
ToolMFTECmd.exe [EZ]
Investigative ValueTimestomping detection; file recovery; full volume enumeration
ATT&CKT1070.006

Timestomping Detection:

  • $STANDARD_INFORMATION ($SI) timestamps are user-modifiable via API
  • $FILE_NAME ($FN) timestamps are kernel-set — much harder to manipulate
  • $SI Creation time AFTER $FN Creation time = strong timestomping indicator
  • $SI with no subsecond precision = likely set by an external tool, not Windows

LNK Files (Shortcut Files)

PropertyDetail
Path%APPDATA%\Microsoft\Windows\Recent\
Key DataTarget file path, target MAC times, volume serial, machine ID, NetBIOS name
ToolLECmd.exe [EZ]
Investigative ValueProves file was opened; machine ID links artifact to specific host; persists after target deletion
ATT&CKT1547.009

Shellbags

PropertyDetail
Registry PathHKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Key DataFolder paths browsed via Explorer, timestamps, network paths, removable media paths
ToolSBECmd.exe [EZ]
Investigative ValueProves user navigated a directory even if it no longer exists; tracks removable media access
ATT&CKT1025, T1074

Volume Shadow Copies

PropertyDetail
Commandvssadmin list shadows [TS]
Investigative ValueAccess historical versions of locked files: SAM, NTDS.dit, registry hives
Toolvshadow.exe, Arsenal Image Mounter
ATT&CKT1490 — VSS deletion = ransomware precursor indicator

$LogFile and $UsnJrnl

ArtifactDetail
$LogFileNTFS transaction log — recent file operations; useful for post-deletion recovery
$UsnJrnl:$JChange journal — all create/modify/delete/rename ops with timestamps
ToolMFTECmd.exe [EZ] for $J; fsutil usn [TS]
Investigative ValueRename chains (unpacking activity), staging evidence, deleted file confirmation

6. Network Activity

DNS Cache (Live)

PropertyDetail
Commandipconfig /displaydns [TS]
Key DataRecently resolved hostnames and IPs
Investigative ValueC2 domain resolution evidence — volatile, lost on flush/reboot

Active Connections (Live)

CommandOutput
netstat -anobConnections with PID and binary name
Get-NetTCPConnectionPowerShell equivalent with richer output

Windows Firewall Logs

PropertyDetail
PathC:\Windows\System32\LogFiles\Firewall\pfirewall.log
Key DataAllow/drop, source/dest IP, port, protocol, direction
Investigative ValueEgress traffic patterns, port scanning, lateral movement paths

Sysmon Network Events

Event IDDescription
3Network connection (process, src/dst IP/port, DNS name if resolved)
22DNS query (process + queried domain)

PCAP Behavioral Indicators

PatternIndicator
Regular beaconing (low jitter intervals)C2 heartbeat
DNS queries with high-entropy subdomainsDNS tunneling (C2 or exfil)
Large outbound transfers during off-hoursData exfiltration
JA3/JA3S fingerprint mismatch for known appMalware using TLS
HTTP POST to bare IP address (no domain)C2 over HTTP
Long-duration low-bandwidth sessionsInteractive C2
Abnormal User-Agent stringsMalware HTTP C2

7. Anti-Forensics & Defense Evasion

Event Log Clearing

IndicatorDetail
Event ID 1102Security log cleared
Event ID 104System log cleared
Log timestamp gapsSelective event deletion
Sysmon Event ID 255Sysmon service error (tamper indicator)
ATT&CKT1070.001

Timestomping

IndicatorDetail
$SI vs $FN creation time discrepancyMFT parsing required
PE compile timestamp at epoch or future datePEStudio, exiftool analysis
ATT&CKT1070.006

File Deletion & Recycle Bin

ArtifactDetail
$I + $R file pairs$I = metadata (original path, deletion time, file size); $R = content
PathC:\$Recycle.Bin\{SID}\
ToolRBCmd.exe [EZ]
ATT&CKT1070.004

LOLBin (Living Off the Land Binary) Reference

BinaryCommon Abuse Method
certutil.exeDownload files, base64 decode payloads
mshta.exeExecute remote HTA scripts
regsvr32.exeSquiblydoo — execute remote scriptlets (bypass AppLocker)
rundll32.exeExecute arbitrary DLL exports
wscript.exe / cscript.exeExecute VBScript/JScript payloads
powershell.exeDownload cradles, reflective PE loading, AMSI bypass
msiexec.exeExecute remote MSI packages
bitsadmin.exeFile download, persistence via BITS jobs
wmic.exeRemote process creation, lateral movement
msbuild.exeExecute inline C# — fileless execution

Detection: Prefetch entries, Sysmon Event ID 1, Event ID 4688 (with command-line logging enabled)

8. Data Exfiltration Indicators

Staging Activity

ArtifactDetail
ShellbagsBrowsing to unusual network shares or external drives
$UsnJrnlMass file operations (bulk creates/renames in short window)
PrefetchCompression tool execution (rar.exe, 7z.exe, zip.exe)
LNK filesTarget paths pointing to archive staging directories
ATT&CKT1074.001

Compression Tools

IndicatorDetail
Prefetch entriesWinRAR, 7-Zip, tar, compress executions with timestamps
AmCache SHA1Hash of compression utility for VT lookup
Command-line args-p (password protection), split archive switches
ATT&CKT1560.001

Rclone / Cloud Exfiltration

IndicatorDetail
Prefetchrclone.exe execution
BAM/DAMrclone.exe per-user last execution timestamp
Config file%APPDATA%\rclone\rclone.conf — cloud provider credentials stored in plaintext
Sysmon Event ID 3Outbound connections to cloud storage API endpoints
ATT&CKT1567.002

9. Cloud & Browser Artifacts

Browser History & Downloads

BrowserArtifact Path
Chrome%LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite)
Edge%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History (SQLite)
Firefox%APPDATA%\Mozilla\Firefox\Profiles\*.default\places.sqlite
ToolHindsight (Chrome), DB Browser for SQLite
Key DataURLs visited, download file paths + timestamps, search terms

Browser Credentials & Cookies

ArtifactPath
Chrome Cookies%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies
Chrome Login Data%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data
ATT&CKT1539 (Session Cookie Theft), T1555.003

OneDrive Sync Artifacts

ArtifactPath
Sync logs%LOCALAPPDATA%\Microsoft\OneDrive\logs\
Settings/DB%LOCALAPPDATA%\Microsoft\OneDrive\settings\
Key DataFiles synced to cloud, timestamps, account UPN

10. Key Event Log IDs Reference

Event Log Locations

LogPath
SecurityC:\Windows\System32\winevt\Logs\Security.evtx
SystemC:\Windows\System32\winevt\Logs\System.evtx
ApplicationC:\Windows\System32\winevt\Logs\Application.evtx
SysmonC:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx
PowerShellC:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx
TaskSchedulerC:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx

Process Execution

Event IDLogDescription
4688SecurityProcess created (requires audit policy + CLI logging enabled)
1SysmonProcess created (hash, PPID, full command line)
5SysmonProcess terminated
400/403PowerShellEngine state change
4103PowerShell OperationalModule logging
4104PowerShell OperationalScript block logging (includes decoded content)

Object Access

Event IDLogDescription
4663SecurityObject access attempt
4656SecurityHandle to object requested
11SysmonFile created
23SysmonFile deleted (archived to Sysmon archive path)

Network

Event IDLogDescription
3SysmonNetwork connection initiated
22SysmonDNS query
5156SecurityWFP: connection allowed
5157SecurityWFP: connection blocked

Registry

Event IDLogDescription
13SysmonRegistry value set
14SysmonRegistry key/value renamed
4657SecurityRegistry value modified

11. Critical Registry Keys Reference

System Information

KeyValue
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersionOS version, build number, install date
HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerNameHostname
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\InterfacesNetwork interface config
HKLM\SYSTEM\MountedDevicesMounted volumes and drive letters

Evidence of Execution

KeyNotes
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssistGUI execution (ROT-13 encoded)
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCacheShimCache
HKCU\Software\Microsoft\Windows\Shell\MuiCacheBinary friendly name cache
HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\StoreCompat flags set at execution

User Activity

KeyNotes
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocsRecently opened files by extension
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRUFiles opened/saved via common dialog
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRUCommands typed into the Run box
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPathsPaths typed directly in Explorer

Network & Remote Access

KeyNotes
HKCU\Software\Microsoft\Terminal Server Client\DefaultRDP connection history (target hostnames)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\ProfilesNetwork profiles with connection timestamps
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\SignaturesNetwork GUIDs to profile mapping

Acquisition

ToolUse Case
KAPETargeted triage collection — configurable targets and modules
FTK ImagerFull disk image, memory capture, logical acquisition
WinPmem / Magnet RAM CaptureLive memory acquisition
VelociraptorEnterprise-scale remote artifact collection
CyLRLightweight live response artifact collection

Parsing & Analysis

ToolArtifacts Covered
Eric Zimmerman ToolsMFT, Prefetch, ShimCache, AmCache, JumpLists, LNK, Registry, Shellbags, $UsnJrnl, Recycle Bin
Registry ExplorerAll registry hives — full browsing with transaction log integration
Volatility3Memory forensics — processes, network, injections, malfind
Autopsy / FTKFull case management, file recovery, keyword search
Wireshark / NetworkMinerPCAP analysis, stream reconstruction
HayabusaRapid Windows Event Log threat hunting (Sigma-based)
ChainsawFast Event Log triage and hunting
FLOSSAutomated string extraction from malware
PEStudioStatic PE analysis — imports, strings, VT lookup
HindsightChrome/Chromium browser artifact parsing

Quick Investigation Checklists

Suspected Malware Execution

  • Prefetch — binary name, timestamps, run count, referenced files
  • AmCache — SHA1 hash → VirusTotal pivot
  • BAM/DAM — per-user execution timestamp
  • ShimCache — binary path presence (note: does not confirm execution on Win8+)
  • Event ID 4688 / Sysmon Event ID 1 — process tree, parent-child relationship, command line
  • MFT — $SI vs $FN timestamp comparison for timestomping
  • Sysmon Event ID 3/22 — outbound connections and DNS queries at time of execution

Suspected Lateral Movement

  • Event ID 4624 Logon Type 3 or 10 from unexpected source hosts
  • Event ID 4648 — explicit credential usage
  • RDP artifacts — Event IDs 1149, 21, 25; Bitmap cache; MRU registry key
  • SMB share access — Event IDs 5140/5145; C$ / ADMIN$ usage
  • Service creation on target — Event ID 7045 (PSEXESVC, randomized names)
  • Sysmon Event ID 17/18 — named pipe creation/connection

Suspected Exfiltration

  • Shellbags — unusual share/drive/network path browsing
  • Prefetch — compression tool execution (rar, 7z, zip)
  • Rclone config — %APPDATA%\rclone\rclone.conf
  • $UsnJrnl — mass file operations in compressed timeframe
  • Firewall logs / Sysmon Event ID 3 — large or sustained outbound transfers
  • Browser history — cloud storage platform access (Mega, Dropbox, Google Drive)

Suspected Persistence

  • Run keys — all standard autostart registry locations
  • Scheduled tasks — Event ID 4698; XML review; TaskCache registry entries
  • Services — Event ID 7045; suspicious ImagePath values
  • WMI subscriptions — repository parsing for consumers and filters
  • Startup folders — user-level and system-level

Last updated: 2026 | Maintained for sdp4n6.dev | Coverage: Windows 10/11, Server 2016–2022