Chapter 11 — Operating systems
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Execution artefacts"]
N2["11.2 Persistence locations"]
N3["11.3 Logons"]
N4["11.4 File-system timestamps"]
N5["11.5 Version dependence"]
N6["11.6 Linux and macOS"]
N7["11.7 Reading carefully"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Execution artefacts"]
N2["11.2 Persistence locations"]
N3["11.3 Logons"]
N4["11.4 File-system timestamps"]
N5["11.5 Version dependence"]
N6["11.6 Linux and macOS"]
N7["11.7 Reading carefully"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Execution artefacts]
|
v
[11.2 Persistence locations]
|
v
[11.3 Logons]
|
v
[11.4 File-system timestamps]
|
v
[11.5 Version dependence]
|
v
[11.6 Linux and macOS]
|
v
[11.7 Reading carefully]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) identify Windows artefacts of program execution and persistence; (2) explain how logs record logons; (3) read file-system timestamps; (4) understand how artefacts depend on versions.
11.1 Execution artefacts
Windows records evidence of programs running in several places: prefetch files (on systems where enabled), event logs when process auditing is on, and other application-compatibility and usage records. Each has rules about when entries are created and what they mean.
Because each artefact has its own rules, the absence of one is not proof that a program did not run: prefetch may be disabled, and process auditing may be off. Leah lists which artefacts were available on ws-114 and how each is configured, then checks for rundll32 with update.dll in each. Agreement across sources is stronger than any one alone.
11.2 Persistence locations
Registry run keys, scheduled tasks and services start programs automatically. On ws-114, a run key pointing at rundll32 with update.dll suggests persistence.
The worked example dates the run key at 09:31:07, about seventeen minutes after the POST to the fake page. A run key means the DLL would load at each logon by that user, so removing the file without removing the key, or the reverse, leaves the system in an inconsistent state that responders should record before cleaning up.
11.3 Logons
Security event logs record logon events with account name, logon type and source. They show which account was active when.
Logon type tells how the session was created: interactive at the keyboard, remote, or network access to shared files. On ws-114, the interactive logon by s.kaur at 08:55 shows who was signed in at the machine before the phishing email arrived at 09:12. A remote logon with the same account from elsewhere would suggest stolen credentials being used after the POST at 09:14:30.
11.4 File-system timestamps
NTFS stores creation, modification, metadata change and access times. Carrier (2005) explains these structures in detail. Copying a file often gives it a new creation time but keeps its original modification time.
This is why a file's creation time can be later than its modification time: the file was modified elsewhere, then copied here. For update.dll, such a pattern would fit a download that kept the original modification time from the attacker's server. Timestamps can also be altered deliberately, so Leah compares them with other records before relying on them.
11.5 Version dependence
Artefact behaviour changes between Windows versions and settings. Leah records the OS build and checks documentation for that version.
For example, whether prefetch is enabled and how many entries it keeps differs between versions and between desktop and server systems. A claim based on documentation for the wrong version may be wrong for ws-114. Leah writes the build number in her notes and cites the documentation version she used, so a reviewer can check both. If ws-114 is later upgraded, her notes still describe the system as it was when examined.
11.6 Linux and macOS
Other systems have equivalents: shell histories, system logs, launch agents, cron. Principles carry over; details differ.
A cron entry on Linux plays the same role as a Windows scheduled task, and a launch agent on macOS resembles a run key. Shell histories can show commands typed, though they can be disabled or edited. When the course moves to other systems, Leah reuses her checklist of questions, such as what ran and what persists, and looks up where each system records the answer.
11.7 Reading carefully
An artefact shows what the system recorded under its rules; interpreting it requires knowing those rules.
For example, a prefetch entry shows that a program was loaded, but not who ran it or whether it succeeded at its purpose. A run key shows configuration, not that the DLL actually loaded. Leah's report separates what the artefact records from what she infers from it, and names the rule that links the two. If the rule is uncertain, the inference is labelled as such rather than stated as fact.
Memory artefacts
Memory captures show running processes, loaded libraries and network connections at capture time. On ws-114, the capture lists rundll32 with update.dll loaded, matching the run key on disk. Two independent artefacts pointing the same way are stronger than either alone.
Worked example
ws-114's synthetic security log shows account "s.kaur" logged on interactively at 08:55. A run key created at 09:31:07 points to update.dll. Leah writes: "At the time the run key was created, the interactive session belonged to account s.kaur; this shows the account context, not that its owner created the key knowingly."
Synthetic case. The account and logs are invented.
Errors and limits
Some artefacts are disabled by default or cleared by maintenance; absence is weak evidence.
Exercises
- EX031 — Persistence clue. What on ws-114 suggests persistence? Rubric: 3 = run key to rundll32/update.dll; 2 = partial; 1 = logon; 0 = none.
- EX032 — Copy timestamps. What usually happens to timestamps when a file is copied? Rubric: 3 = new creation time, original modification kept; 2 = partial; 1 = all unchanged; 0 = none.
- EX033 — Account context. What does the logon tell us about the run key? Rubric: 3 = session account context, not knowing action by owner; 2 = partial; 1 = user did it; 0 = none.
Synthesis
OS artefacts record execution, persistence and logons under version-specific rules that must be known before interpretation.
Continue studying — chapter 11 of 40
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →