Introduction to Windows IR

Active Directory remains a core technology for enterprises; by most estimates, around 95% of Fortune 500 companies use it. As a result, most ransomware attacks target AD environments, and you must know AD and Windows internals to respond properly. Throughout the path, you'll see how AD attacks occur from the adversary's point of view and gain technical skills to detect them, using both logs and forensic artifacts.

Path Structure

This path is mapped to MITRE ATT&CK and focuses on the most common techniques observed in real-world intrusions. By the end, you'll know how to detect, investigate, and defend against roughly 100 techniques shown below. Note that the SOC L2 path isn't a strict prerequisite, but it's a great addition and covers most gaps in this path.

MITRE techniques covered in the Windows IR path (in green)

Who Is It For

• DFIR professionals seeking practice with real-world incidents
• Security experts preparing for advanced blue-team certifications
• SOC analysts and engineers expanding into the DFIR world
• Red teamers wanting a defensive view of their engagements
• Other roles may still find some of the rooms valuable to:
  • See how the Windows OS works behind the scenes
  • Learn the mindset of attackers and defenders
  • Explore mitigations against attacks on Windows

You'll start with a preparation module most valuable for external DFIR teams: how to communicate with the customer, access the network, and collect forensic artifacts. In the next modules, you'll go technical and explore the most common MITRE ATT&CK techniques seen in AD intrusions, from Initial Access and Persistence to Exfiltration and Impact. Most rooms follow the same three-part structure:

Learning Objectives

• Learn how to start the IR process on a Windows environment
• Discover how to communicate with the customer during IR
• Explore DefenseBox and learn how to prepare your DFIR lab

Prerequisites

• Knowledge of IR and Windows fundamentals
• Completion of the SOC Level 2 path would help

Mobilize IR Resources

First, gather everything you need for IR, both from your end and the customer's. You might be lucky and have an IR coordinator who handles the organizational questions and leaves the technical work to you. Often, however, you need to manage the communication from start to finish. Either way, it's vital to meet the customer and gather a small but effective DFIR team. It's better to have 3 dedicated experts than 20 analysts who switch between SOC shifts and DFIR work.

Organize Intro Call

Once the DFIR team is gathered and you've established contact with OpenDoor's representative via phone or email, organize an intro call with the customer. Schedule it as soon as possible, even on a weekend night. Ask the customer to invite at least one technical employee who knows about the incident (usually the IT team), and ideally the CEO, CISO, or CTO, to meet your team and observe the process. On the call, introduce yourself and the team, enable meeting notes, and ask the questions below:

Practice

You're on a call with OpenDoor, where you are leading the DFIR team, and Oliver from OpenDoor's IT department is the most active participant. Click the Open Agent button above, ask what you want about the company and the incident, and answer the task questions. Keep in mind that not everyone is on the call, so you might not get all the answers you want.

Organize DFIR Chat

Once the intro call is done, set up a dedicated incident chat. You can still set up periodic meetings, but a chat is a must-have for live communication, as it keeps a searchable history and lets you ask small questions asynchronously, any time. Aim to focus on a single chat, often called the "war room". Ask the customer to invite only trusted members who can actively contribute to the DFIR, such as people from these teams:

• IT Team: Technical experts who can grant you access or guide you through the network architecture
• Security Team: SOC, InfoSec, or other teams that were handling the incident before you joined
• CTO or CISO: A representative from top management to oversee the whole incident response
• Depending on the case, you may also need representatives from legal or DevOps teams

Keep the war room simple but effective, ideally 5-10 people.
Don't invite unnecessary people for OPSEC purposes (next section)

OPSEC and IR Chats

Keep in mind that the customer's accounts and devices might be compromised, and attackers may be silently reading all conversations. Moreover, hackers sometimes publicly leak their victims' chats to prove the breach and simply show off, which causes reputational damage to the customer - and even more to you as a DFIR expert. For major incidents like the one at OpenDoor, follow these basic Operations Security (OPSEC) rules:

Redacted version of Ragnar Locker's screen capture of their victim's IR chat (SC Media (opens in new tab))

Communication Pitfalls

The main pitfall you'll hit with a client is overtrusting their statements. The customer's IT surely knows their network, but they can make mistakes; it's also easier to say "our network is segmented and passwords are strong" than to admit the real state of things. Beyond that, make sure you actually understand each other before drawing conclusions, since the same phrasing can mean different things to you and to them. For example:

• Our network is "segmented" - but all traffic is allowed between subnets
• MFA is "enabled" - but it's not enforced, and nobody actually uses it
• Public RDP is "disabled" - but it remained enabled during the incident

Playbook to Avoid Pitfalls

Practice

Continue your conversation with OpenDoor. Click the Open Agent button above, try to convince them to create a DFIR chat, and solve the mystery of why the EDR you found in Task 3 didn't generate any alerts throughout the whole attack. You should find the right words in the task's content. Good luck!

Minimal Lab Setup

As soon as the incident response starts, prepare the lab environment. Your first minimum requirement is a Windows machine with all necessary DFIR tools installed, where you will analyze acquired artifacts and forward them to sandboxes or specialized VMs, if required. You can also work from macOS or Linux, but it is generally more intuitive to analyze Windows artifacts from a Windows OS. Throughout the path, we will use DefenseBox, a custom-built machine to analyze DFIR artifacts:

Evidence Storage

The second must-have item is evidence storage where you and the customer will exchange collected artifacts, DFIR scripts, and EDR agents, if required. A cloud option like Google Drive would work, but keep in mind that a forensic-focused storage would be better. Ideal storage should cover the main Google Drive features, plus:

• Be private (most cloud vendors do OCR and scan the uploaded files)
• Be performant (no speed limits; close to you and the customer)
• Have audit logs (log who uploads, changes, or deletes the files)
• Not block access to the uploaded files classified as malware

Advanced DFIR Lab

For large investigations such as the OpenDoor breach, you may need to build a separate DFIR lab. For example, a Linux VM can be useful for tasks where Windows is not ideal, such as debugging Node.js malware or running pentest tools to verify attack steps. If you're working with large volumes of logs (e.g., 2 GB of IIS logs), it's best to ingest them into a SIEM, enrich them with GeoIP and reputation lookups, and analyze them there rather than struggling in a text editor. You may also want:

• An air-gapped sandbox VM to analyze malware without infection risk
• A syslog receiver for live logs from compromised firewalls and VPN appliances
• Velociraptor or EDR agents on compromised hosts (will be covered in later rooms)

Once the lab is ready, connect to it and collect/analyze artifacts from there

DefenseBox Practice

Launch DefenseBox by clicking Start DefenseBox and explore what's on it. You can also connect over OpenVPN and RDP using the credentials below.

• User: DFIRUser
• Password: Secure!

What's Next

Today we've covered the organizational stage of Windows Incident Response: how to communicate with the customer and how to prepare your DFIR lab. In the next room, we'll continue OpenDoor's storyline, access their network, collect forensic artifacts, and use them to uncover the breach.