ETW ‐ Lab - lpcyber1/SEC440 GitHub Wiki

Deliverables

Deliverable #1: Finding Notepad and File Created using WPA

Deliverable #2: Finding Notepad and File Created using PrefView

Deliverable #3 - Submit a screenshot of the PowerShell provider output you found.

Deliverable #4: provide a screenshot of your query mytrace1 output.

Deliverable #5: provide a screenshot of your query mytrace1 output showing the provider being added to this trace.

Deliverable #6: You are required to do the following (PLEASE READ CAREFULLY):

Deliverable #7: provide a screenshot of your query showing that both mytrace1 and mytrace2 are running.

Deliverable #8: provide a screenshot of your query showing that both mytrace1 and mytrace2 are no longer running and have been successfully stopped, similar to the output of 1.4.

Deliverable #9: You are required to find traces of usage in the mytrace1.etl for all of the following:

Deliverable #10: You are required to find PowerShell CmdLet traces of usage in the mytrace2.etl for all of the following:

Deliverable #11: Use the methods and techniques that you have learned so far to analyze this file and find the following:

What was the name of the process that loaded the suspicious DLL?

What was the name of the DLL?

Where is this Td from (file location)?