πŸ”
Windows Forensic Handbook
search
⌘Ctrlk
πŸ”
Windows Forensic Handbook
  • πŸ‘‹Welcome
  • Artifacts by Type
    • πŸ—„οΈRegistry Artifacts
    • πŸ“‚Filesystem Artifacts
    • πŸ“…Event Log Artifacts
  • Artifacts by Activity
    • πŸƒβ€β™‚οΈExecution
      • Evidence of Execution
      • First Executed
      • Last Executed
      • Command Line Options
      • Execution Account
      • Parent and Child Information
        • EventID 4688: A new process has been created
        • EventID 1024: RDP ClientActiveX is trying to connect to the server
        • EventID 2004: Firewall Rule Added
        • EventID 2005: Firewall Rule Modified
        • EventID 2006: Firewall Rule Deleted
        • EventID 2071: Firewall Rule Added
        • EventID 2073: Firewall Rule Modified
        • EventID 2052: Firewall Rule Deleted
        • EventID 9707: Command Execution Started
        • EventID 4104: PowerShell Script Block Logging
      • Execution Timestamp
    • πŸ—’οΈFile Activity
    • πŸ‘¨β€πŸ”§Account Activity
    • 🌎Network Activity
    • πŸ”Browser Activity
    • πŸ–₯️System Enumeration
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Artifacts by Activitychevron-right
  2. πŸƒβ€β™‚οΈExecution

Parent and Child Information

EventID 4688: A new process has been createdchevron-rightEventID 1024: RDP ClientActiveX is trying to connect to the serverchevron-rightEventID 2004: Firewall Rule Addedchevron-rightEventID 2005: Firewall Rule Modifiedchevron-rightEventID 2006: Firewall Rule Deletedchevron-rightEventID 2071: Firewall Rule Addedchevron-rightEventID 2073: Firewall Rule Modifiedchevron-rightEventID 2052: Firewall Rule Deletedchevron-rightEventID 9707: Command Execution Startedchevron-rightEventID 4104: PowerShell Script Block Loggingchevron-right

Last updated 2 years ago