Help Intro Digital Forensic's Rapid Triage Examination

HTB Content Academy
1

Any generous heart people can help me with their time? I am stuck in question no.2 of

“C:\Users\johndoe\Desktop\forensic_data\kape_output\D\Windows\System32\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx” using Timeline Explorer. It documents the creation of two scheduled tasks. Enter the name of the scheduled task that begins with “M” and concludes with “r” as your answer.

I tried to do it and import using time explorer but the output is so much like 6000 lines, any hint on this or what is the best way to filter it?

i tried to filter “task”, “schedule” or “106” but seems can’t find the answer. I am missing something?

1 Like
2

Did you find it? I’m stuck as well.

3

Dis you abel to solve this?

4

Are you done with this?

5

Yes. The first answer involves this: PS C:\Users\johndoe\Desktop\Get-ZimmermanTools\net6> .\MFTECmd.exe -f ‘C:\Users\johndoe\Desktop\forensic_data\kape_output\D$MFT’ --csv C:\Users\johndoe\Desktop\forensic_data\mft_analysis\ –csvf MFT.csv. The second answer involves this command: PS C:\Users\johndoe\Desktop\Get-ZimmermanTools\net6\EvtxeCmd> do: .\EvtxECmd.exe -f “C:\Users\johndoe\Desktop\forensic_data\kape_output\D\Windows\System32\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx” --csv “C:\Users\johndoe\Desktop\forensic_data\event_logs\csv_timeline” --csvf kape_event_log.csv. Use TimeLine Explorer to view the csv files.

2 Likes
6

Thanks. Whats the name of the field?

1 Like
7

Here is how you find it in the search: schtasks.exe

Then you will see ." … schtasks /Create /TN "Microsoft-Windows-*****Collector" … "

1 Like
9

this tip help me, I was stuck

10

tks man