Windows Malware and Unauthorized Access Forensics

Quick Answer. Unauthorized-access and malware forensics on Windows correlates authentication anomalies (4625/4740/4776, 4624 LogonType 3/10 from unexpected sources), persistence artifacts (Run/RunOnce, Services with unsigned or LOLBin ImagePath, scheduled tasks, WMI event subscriptions, Winlogon shell hijacks, Image File Execution Options debugger keys), program execution evidence (Prefetch, Amcache SHA-1, Shimcache), PowerShell script-block logs (4104), network telemetry (SRUM, DNS cache), and known-bad IOC matching. The output is a written finding — with or without malware attribution — supporting or refuting the client’s factual claim.

Persistence: the ten places we always check

Living-off-the-land binaries (LOLBins) we always review

Attackers increasingly avoid custom malware and abuse signed Microsoft binaries. We review execution of the following against timing and command-line context:

• powershell.exe / pwsh.exe with -EncodedCommand, -NoProfile, -WindowStyle Hidden
• mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe -urlcache
• wmic.exe, bitsadmin.exe, msbuild.exe, installutil.exe
• curl.exe, wget equivalents, Invoke-WebRequest
• ntdsutil.exe, vssadmin.exe delete shadows (pre-encryption ransomware signal)
• net use, net localgroup administrators, psexec

Credential theft indicators

• LSASS access by non-Microsoft processes (Sysmon 10, or memory image evidence).
• Presence of ntds.dit or SAM/SYSTEM copies outside System32\config\.
• vssadmin create shadow followed by copy operations from the shadow — a classic credential-dump pattern.
• Kerberoasting: bursts of 4769 events for service accounts with RC4 encryption type.
• DCSync: 4662 with the specific replicate-directory-changes access mask from a non-DC source.

Ransomware pre-encryption signals

Where ransomware is suspected — or must be ruled out — we look for the tell-tale precursors: vssadmin delete shadows, wbadmin delete catalog, bcdedit /set {default} recoveryenabled No, mass rename operations in $UsnJrnl (thousands of renames within minutes), a new service or scheduled task installed just before mass encryption, and Defender / EDR tampering (Sysmon 26, Defender events 5001/5007).

What a defensive finding looks like

Many matters end with a defense-favorable conclusion: no evidence of malware execution, no unauthorized access, and observed behavior fully consistent with the legitimate user. In those cases the report enumerates what was searched, what would have appeared had the alleged event occurred, and why the absence of those artifacts is meaningful — anchored to the artifact categories detailed in the Windows Forensics hub.

How Elite Digital Forensics helps

Elite Digital Forensics is an independent, defense-aligned Windows forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Windows Forensics hub for the full analytical framework we bring to every matter.

Related Windows forensics pages

Frequently asked questions