◇ OpenCyber Academy
Technical · Chapter 3 · English

Chapter 3 — Operating systems and identities

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Operating systems and identities

Lesson map

Lesson 03 published. Map, example, EX009.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 USB artefacts"]
  N2["3.2 Execution and persistence"]
  N3["3.3 Accounts"]
  N4["3.4 Identity evidence"]
  N5["3.5 Privilege"]
  N6["3.6 Recording context"]
  N7["3.7 Policy question"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX009"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 USB artefacts"]
  N2["3.2 Execution and persistence"]
  N3["3.3 Accounts"]
  N4["3.4 Identity evidence"]
  N5["3.5 Privilege"]
  N6["3.6 Recording context"]
  N7["3.7 Policy question"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX009"]

[Learning outcomes]
    |
    v
[3.1 USB artefacts]
    |
    v
[3.2 Execution and persistence]
    |
    v
[3.3 Accounts]
    |
    v
[3.4 Identity evidence]
    |
    v
[3.5 Privilege]
    |
    v
[3.6 Recording context]
    |
    v
[3.7 Policy question]
    |
    v
[Worked example] --> [Exercise EX009]

Learning outcomes

You will (1) identify OS artefacts of USB use, program execution and persistence; (2) relate local and domain accounts to activity; (3) recognise shared-account problems; (4) record account context carefully.

3.1 USB artefacts

Windows records connected USB devices — vendor, product, serial number and connection times — in the registry and event logs. EDR may record mounts too.

These records are what later show the ward stick, serial SN-7731, on three PCs in order. The registry keeps the first and last connection times, while event logs and EDR record each mount. Sana collects these artefacts with the triage tool rather than browsing the registry on the live PC, which would add her own activity to the record.

3.2 Execution and persistence

Prefetch (where enabled), EDR process records and event logs show programs that ran. Persistence may use startup folders, run keys, scheduled tasks or services. Carrier (2005) explains the file-system metadata that shows when files appeared.

On WARD4-PC2, EDR process records show wscript.exe running the hidden script and writing svch.exe, and the startup folder holds the 'Updater' shortcut that would start it again at logon. File-system times show exactly when svch.exe first appeared in C:/Users/Public that morning. Sana records each artefact with its source, because prefetch may be disabled on some ward builds.

3.3 Accounts

Ward PCs at Westbrook use a shared ward account so staff can log in quickly in emergencies. Actions on WARD4-PC2 appear under "ward4.shared", which identifies the session, not the nurse.

Anyone on the ward who knows the shared password can use the session, so the same account name covers several nurses during a shift. The account was logged on at 07:01, three hours before the stick was used. Sana's notes therefore never attach an action to a named nurse, even though one nurse reported the pop-up.

3.4 Identity evidence

The domain controller logs the ward account's logon at 07:01. Badge logs show which staff entered Ward 4, but cannot place a person at a specific PC.

The domain controller log confirms the session began at 07:01 and continued through the incident. Badge records show who entered the ward but not who sat at WARD4-PC2, so Sana does not combine them into a claim about a person. If a name were ever needed, it would come from the ward manager's account of who used the PC, recorded as a statement.

3.5 Privilege

The shared account has standard user rights, which limits what malware running under it can change without further steps.

Standard rights explain the persistence choices the attacker's tool made: it wrote to C:/Users/Public and the user's startup folder because those are writable without administrator rights. They also mean system-wide changes, such as installing a service, would have needed a further step. Sana records the account's rights with the findings, since they limit what the program could have done.

3.6 Recording context

Findings state "under account ward4.shared", never "the nurse ran".

The wording matters because the case file goes to managers who may read 'the nurse ran' as blame for someone who simply opened the rota. 'Under account ward4.shared on WARD4-PC2 at 10:02:40' states exactly what the records show and nothing more. Owen checks the wording in every summary before it leaves the security team. The same rule applies to PHARM-PC3, where findings name the account recorded in the logs and never a member of pharmacy staff.

3.7 Policy question

Shared accounts trade accountability for speed; the investigation will note this for the hospital's risk review.

The shared account made logon fast during emergencies, which matters on a ward, but it also means nobody can say which person opened the rota shortcut. Sana writes the observation for the hospital's risk review without recommending a change herself, because the decision balances clinical speed against accountability. Owen raises it with the IT board alongside the other lessons from the incident. The observation is phrased as a trade-off, not a fault, so the ward does not read it as criticism.

Logon types

Event logs record how an account logged on: interactively at the keyboard, over the network, or via remote desktop. The ward4.shared logon at 07:01 was interactive, consistent with someone at the PC. Sana notes the type because a remote logon would change the investigation's direction and the people involved.

Worked example

On WARD4-PC2, a startup-folder shortcut named "Updater" pointing to C:/Users/Public/svch.exe was created at 10:02:45 under ward4.shared. Sana records the path, time and account, noting that standard user rights allowed writing to the Public folder and the user's startup folder.

Synthetic case. The artefacts are invented.

Errors and limits

Artefact behaviour depends on OS version and settings; record both.

Exercises

Synthesis

OS artefacts show devices, execution and persistence; account context must be stated precisely, especially with shared accounts.

Continue studying — chapter 03 of 18

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →