Tags

Chrome

• What files were downloaded using a web browser?
• What pages did web browsers visit?

CrowdStrike

• What process made the DNS query?
• What web browsers were running at a given time?
• Was an Incognito/Private browser session used?
• Were any system event logs cleared?

DNS

• What process made the DNS query?

Edge

• What files were downloaded using a web browser?
• What pages did web browsers visit?

Event Logs

• Have there been any executions of PsExec?
• Have there been any executions of PsExeSrv?
• Were any system event logs cleared?

Firefox

• What pages did web browsers visit?

Internet Explorer

• What pages did web browsers visit?

Linux

• Were any system event logs cleared?

NTFS

• What files were downloaded using a web browser?

Prefetch

• Have there been any executions of PsExec?
• Have there been any executions of PsExeSrv?

Process Execution

• What web browsers were running at a given time?
• Was an Incognito/Private browser session used?

SQLite

• What files were downloaded using a web browser?
• What pages did web browsers visit?

Safari

• What files were downloaded using a web browser?
• What pages did web browsers visit?

Sysmon

• What process made the DNS query?

T1070.001

• Were any system event logs cleared?

T1070.002

• Were any system event logs cleared?

USN Journal

• What files were downloaded using a web browser?

Web Browser

• What files were downloaded using a web browser?
• What web browsers were running at a given time?
• What pages did web browsers visit?
• Was an Incognito/Private browser session used?

Windows

• What files were downloaded using a web browser?
• What process made the DNS query?
• Have there been any executions of PsExec?
• Have there been any executions of PsExeSrv?
• Were any system event logs cleared?

macOS

• What files were downloaded using a web browser?
• Were any system event logs cleared?