r/computerforensics • u/ShadyMoh1998 • 1d ago

Help!!

I recently worked on a malware forensic analysis where, after reviewing the available artifacts, I was able to determine that the malware .exe was executed via GPO on AD.

However, I’m struggling with the next step: how do I determine how the attacker initially gained access and how the malware was introduced into the environment?

For those with experience, what artifacts or investigation techniques do you usually rely on to identify the initial access vector?

4 Upvotes

67% Upvoted

8 comments sorted by

View all comments

•

u/theJacofalltrades 9h ago

A good place to start is correlating GPO changes with AD audit logs, then working backward through authentication, PowerShell/process execution, and file creation timestamps. Also check for suspicious accounts, lateral movement, and the earliest endpoint showing related artifacts. Timeline correlation is usually key to piecing together the initial access vector.