Exploring a real-world scenario of identifying the root cause

The cybersecurity team reported an alert triggered on hostname (DESKTOP-T7HCR2I) for a malicious hacking tool, and during the investigation, the team could not identify the root cause. As digital forensic examiners, we are now tasked with identifying the source of the malicious binary and reporting back to the cybersecurity team.

One of the things we check during such an incident is what log source types we have and how we can find our evidence to map it for the current incident. Since we are focusing on Windows artifacts, we need a way to pull the triage image over the network or we can perform that locally. In the real world, usually, we use tools such as endpoint detection and response to access the endpoint directly and collect the desired artifacts. However, in our lab scenario, we will perform manual collection using KAPE, as we covered it in Chapter 2.

By running the following KAPE script, we will collect our...