"Lab 13 — Endpoint Malware Investigation"

Mission Information

Item	Details
Lab	13
Lab Name	Endpoint Malware Investigation
Track	CompTIA CySA+
Difficulty	Intermediate
Estimated Time	120–150 minutes
Primary Role	Cybersecurity Analyst / SOC Analyst
Environment	CySA+ Endpoint Investigation Lab
Primary Systems	Windows Endpoint + SIEM + Analyst Workstation
Skills	Endpoint Triage, Process Analysis, Persistence Investigation, File Analysis, Registry Analysis, Network Correlation, IOC Pivoting

Mission Scenario

You are working as a Cybersecurity Analyst at GHC Enterprise.

In Lab 12, you performed static analysis on a suspicious attachment recovered from a phishing investigation.

The file appeared capable of:

Process Execution
File Creation
Registry Modification
Network Communication

You now need to answer the next critical question:

Did the suspicious file execute on an endpoint, and what happened afterward?

The SOC has identified:

CYSA-WIN01
10.10.10.20

as a potentially affected workstation.

Your task is to investigate endpoint telemetry and reconstruct:

• whether the suspicious file executed

• which process launched it

• which child processes appeared

• what commands were executed

• whether files were created

• whether persistence was attempted

• whether registry keys changed

• whether scheduled tasks or services appeared

• whether PowerShell was used

• which network connections followed

• whether extracted IOCs appear elsewhere

• whether the endpoint should be contained

Mission Objective: Perform a structured endpoint malware investigation and determine the execution chain, persistence indicators, network behavior, scope, and required response actions.

Mission Objectives

By completing this lab, you will be able to:

• investigate suspicious process execution

• analyze parent-child process relationships

• review process command lines

• correlate Windows Event ID 4688

• investigate PowerShell activity

• identify suspicious file creation

• inspect common persistence locations

• investigate registry autoruns

• investigate scheduled tasks

• investigate Windows services

• analyze active network connections

• correlate process and network activity

• pivot on file hashes and IOCs

• build an endpoint execution timeline

• assess malware impact

• determine containment requirements

• document endpoint investigation findings

1. Endpoint Malware Investigation Workflow

A typical endpoint investigation follows:

Malware Alert
    ↓
Identify Endpoint
    ↓
Establish Time Window
    ↓
Find Initial Process
    ↓
Analyze Parent / Child Processes
    ↓
Inspect Command Lines
    ↓
Review File Activity
    ↓
Investigate Persistence
    ↓
Review PowerShell
    ↓
Analyze Network Connections
    ↓
Pivot on IOCs
    ↓
Determine Scope
    ↓
Containment Decision

The goal is to reconstruct what actually happened on the system.

2. Static Analysis vs Endpoint Investigation

In Lab 12, static analysis identified potential capabilities.

For example:

Networking APIs
Registry APIs
File APIs

That means the sample may perform those actions.

Endpoint investigation asks:

Did those actions actually occur?

This distinction matters.

Static Analysis:
Potential Capability

Endpoint Telemetry:
Observed Behavior

3. Start the Lab Environment

Start:

CYSA-SIEM
10.10.10.40

CYSA-ANALYST
10.10.10.10

CYSA-WIN01
10.10.10.20

Verify:

Windows telemetry is arriving
Process auditing is enabled
PowerShell logging is available
SIEM is searchable

Do not execute real malware to generate activity.

Use instructor-provided telemetry, safe simulated events, or benign commands that represent the investigation workflow.

4. Create the Investigation Workspace

On CYSA-ANALYST:

mkdir -p ~/CySA-Lab/Investigations/LAB13/{Evidence,Screenshots,IOCs,Findings}

Create:

touch ~/CySA-Lab/Investigations/LAB13/investigation-notes.md

Use:

Investigation ID:
LAB13-ENDPOINT-001

5. Establish the Investigation Scope

Record:

Endpoint:
CYSA-WIN01

IP:
10.10.10.20

Suspected File:
<suspicious filename>

SHA-256:
<hash from Lab 12>

Alert Time:
<timestamp>

Set your SIEM investigation window to include time before and after the suspected execution.

Example:

Alert:
20:15

Investigation Window:
20:00–20:45

6. Begin with the File Hash

Search the SIEM or endpoint telemetry for the SHA-256 from Lab 12.

Look for:

File observed
File created
File scanned
Process executed
Endpoint detection

If hash telemetry is unavailable, pivot using:

Filename
Path
Timestamp
User

7. Search for the Suspicious Filename

Search:

<suspicious filename>

Potential locations might include:

Downloads
Desktop
Temp
AppData
ProgramData
User Profile

Record any matching events.

8. Investigate Process Creation

Windows process execution may appear in:

Security Event ID 4688

Search:

4688

Filter to:

CYSA-WIN01

Review:

Timestamp
User
New Process Name
Process ID
Parent Process
Parent Process ID
Command Line

9. Identify the Initial Suspicious Process

Suppose telemetry shows:

Process:
C:\Users\user01\Downloads\invoice.exe

Record:

Filename
Full Path
Process ID
Parent Process
User
Timestamp
Command Line

The first suspicious execution becomes your process pivot.

10. Investigate the Parent Process

Ask:

What launched the suspicious process?

Example:

explorer.exe
      ↓
invoice.exe

This may suggest the user manually opened the file.

Another pattern:

outlook.exe
      ↓
invoice.exe

may suggest email-delivered execution.

Or:

powershell.exe
      ↓
invoice.exe

may suggest scripted execution.

Parent context is critical.

11. Build the Process Tree

Create a process chain.

Example:

explorer.exe
     ↓
invoice.exe
     ↓
cmd.exe
     ↓
whoami.exe

or:

outlook.exe
     ↓
document.exe
     ↓
powershell.exe

Do not assume every unusual chain is malicious.

Investigate context.

12. Analyze Child Processes

Search for processes where:

Parent Process ID

matches the suspicious process.

Look for child processes such as:

cmd.exe
powershell.exe
rundll32.exe
regsvr32.exe
schtasks.exe
sc.exe
whoami.exe
ipconfig.exe
net.exe

These can be legitimate but may provide important behavior clues.

13. Inspect Command Lines

Review command-line telemetry carefully.

Examples of useful fields:

Process
Arguments
Script Path
Remote Host
Filename
Registry Path
Service Name

A command line provides far more context than:

powershell.exe executed

14. Investigate PowerShell Activity

Search:

powershell.exe

and where available:

4104

Review:

User
Parent Process
Script Content
Command Line
Timestamp

Safe lab activity may include:

whoami
Get-Process
Get-NetIPAddress

The objective is to understand how PowerShell telemetry fits into the process chain.

15. Correlate Event 4688 and 4104

Suppose:

4688:
powershell.exe launched

and:

4104:
PowerShell commands recorded

Together:

Process Execution
      +
Script Content
      =
Stronger Evidence

16. Investigate File Creation

Search endpoint telemetry for files created around the alert time.

Potentially interesting directories include:

C:\Users\<user>\AppData\
C:\Users\<user>\Downloads\
C:\Windows\Temp\
C:\ProgramData\
C:\Users\Public\

Record:

Filename
Full Path
Creation Time
Creating Process
Hash

17. Review Recently Modified Files

On the endpoint, where authorized, PowerShell can help identify recently modified files.

For example:

Get-ChildItem "$env:TEMP" -File |
Sort-Object LastWriteTime -Descending |
Select-Object -First 20 Name, FullName, LastWriteTime

This is a triage technique.

Do not delete anything during investigation.

18. Compare File Activity with Static Analysis

Suppose Lab 12 contained a string:

update.dat

Search endpoint telemetry for:

update.dat

If the file appears after suspicious process execution:

Static Indicator
      +
Observed File Creation
      =
Behavior Validation

19. Investigate Persistence

Malware may attempt to survive:

Logoff
Reboot
Process Termination

Common persistence locations include:

Registry Run Keys
Scheduled Tasks
Windows Services
Startup Folder

Your goal is to investigate these locations without creating malicious persistence.

20. Investigate Registry Run Keys

Review common locations:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Using PowerShell:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

And:

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"

Look for:

Unexpected Entries
Unknown Paths
Executables in User-Writable Directories
Recently Added Values

21. Compare Registry Evidence with Malware Strings

If static analysis identified:

CurrentVersion\Run

and endpoint investigation reveals:

Unexpected Run entry

your confidence increases.

Again:

Static Capability
     +
Observed Registry Change
     =
Behavioral Evidence

22. Investigate Scheduled Tasks

List tasks:

Get-ScheduledTask |
Select-Object TaskName, TaskPath, State

Look for:

Unusual task names
Recent task creation
Unknown executables
Scripts from Temp or AppData
Unexpected user context

Review Task Scheduler telemetry where available.

23. Investigate Scheduled Task Creation Events

Relevant telemetry may include:

4698 — Scheduled task created

Search:

4698

Record:

Task Name
User
Timestamp
Command
Arguments

24. Investigate Windows Services

Review running services:

Get-Service |
Where-Object {$_.Status -eq "Running"}

Inspect:

Service Name
Display Name
Status

For additional details:

Get-CimInstance Win32_Service |
Select-Object Name, State, StartMode, PathName

Look for unexpected executable paths.

25. Investigate Service Installation Events

Relevant Windows telemetry can include:

4697

and Service Control Manager events.

Search for service creation near the investigation time.

Record:

Service Name
Binary Path
Account
Start Type
Timestamp

26. Investigate Startup Folder

Review:

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup

and:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Look for unexpected shortcuts, scripts, or executables.

27. Investigate User Account Changes

Search for account-related events such as:

4720 — Account created
4722 — Account enabled
4724 — Password reset
4726 — Account deleted
4732 — Added to local group

Unexpected account creation after suspected malware execution may indicate expansion of access.

28. Investigate Local Administrators

On CYSA-WIN01:

Get-LocalGroupMember -Group "Administrators"

Compare against the expected baseline.

Look for unexpected members.

29. Investigate Network Connections

Use endpoint telemetry or PowerShell.

Run:

Get-NetTCPConnection

For a more focused view:

Get-NetTCPConnection -State Established

Review:

Local Address
Local Port
Remote Address
Remote Port
State
Owning Process

30. Map Network Connection to Process

Identify:

OwningProcess

Then:

Get-Process -Id <PID>

Now you can correlate:

Process
   ↓
Network Connection

This is one of the most important endpoint investigation relationships.

31. Correlate with Zeek

Search the SIEM for the endpoint IP:

10.10.10.20

Look for:

DNS activity
TCP connections
HTTP
TLS
Destination IP
Destination Port

Compare network timestamps with process execution.

32. Correlate with Suricata

Search for IDS alerts involving:

CYSA-WIN01

or:

10.10.10.20

Record:

Signature
Destination
Protocol
Severity
Timestamp

33. Search for Domains from Lab 12

Take domains extracted from static analysis.

Search the SIEM.

Ask:

Did CYSA-WIN01 resolve this domain?

When?

Did a connection follow?

Which process was active?

If telemetry aligns:

Suspicious Process
      +
Domain Resolution
      +
Network Connection

provides strong investigation context.

34. Search for IP Indicators

Pivot on suspicious IPs from Lab 12.

Determine:

Was the IP contacted?
Which endpoint contacted it?
Which port?
When?
How many times?

35. Investigate DNS-to-Connection Sequence

Example:

20:15:04
Suspicious Process Starts

20:15:07
DNS Query for suspicious domain

20:15:08
Domain Resolves to IP

20:15:10
TCP Connection to Resolved IP

The timeline may suggest relationship.

Be precise:

The sequence is consistent with process-associated network activity.

Do not claim causal linkage without supporting process telemetry.

36. Investigate Process Hashes

If your endpoint tooling records hashes, compare them with:

SHA-256 from Lab 12

A matching hash provides stronger evidence that the same file was present or executed.

37. Search the Environment for the Hash

Search across all endpoints.

Ask:

Is CYSA-WIN01 the only affected host?

Potential results:

1 host → limited scope

12 hosts → potential outbreak

Scope is critical for incident severity.

38. Search for the Suspicious Filename Across Hosts

If hash telemetry is unavailable, search the filename and path.

Remember:

Filename Match

is weaker than:

Hash Match

because files can share names.

39. Investigate Related Users

Determine:

Which user executed the file?

Did the user receive the phishing email?

Was the account later used suspiciously?

This connects:

Phishing
   +
Malware
   +
Identity

40. Build the Execution Timeline

Create:

Time	Source	Activity
20:10	Email	Attachment delivered
20:14	Windows	Suspicious file created
20:15	4688	Suspicious process executed
20:15	4688	PowerShell spawned
20:16	File	New file created
20:17	Registry	Persistence indicator
20:18	DNS	Suspicious domain queried
20:18	Zeek	External connection
20:19	Suricata	Network alert

Your actual timeline will depend on the safe telemetry available.

41. Build the Process Timeline

Example:

outlook.exe
     ↓
suspicious.exe
     ↓
powershell.exe
     ↓
system-discovery-command

Record timestamps.

This process lineage may help explain the attack progression.

42. Determine Persistence Status

Classify:

No Persistence Identified

Potential Persistence

Confirmed Persistence

Potential evidence includes:

Run key
Scheduled task
Service
Startup folder

Do not mark persistence as confirmed based only on static strings.

43. Determine Network Activity Status

Classify:

No suspicious network activity identified

Potential suspicious network activity

Confirmed suspicious network connection

Use evidence from:

Endpoint
Zeek
Suricata
DNS

44. Determine Execution Status

Possible classifications:

File Present — Execution Not Confirmed

Execution Likely

Execution Confirmed

Execution confirmation can be strengthened by:

4688 process event
EDR process event
Matching process hash
Parent-child relationship
Command line

45. Determine Scope

Ask:

How many endpoints have the hash?

How many endpoints contacted the IOC?

How many users received the attachment?

How many users executed it?

Are privileged accounts involved?

Was lateral movement observed?

Scope changes response priority.

46. Identify Indicators of Compromise

Build an endpoint IOC list:

SHA-256
Filename
File Path
Domain
IP Address
Registry Key
Scheduled Task
Service Name
Process Name
Command Line

Separate:

Strong Indicators

from:

Contextual Indicators

47. Map Observed Activity to MITRE ATT&CK

Map only observed behavior.

Examples may include:

Observed Behavior	Possible ATT&CK Context
PowerShell	Command and Scripting Interpreter
Run-key modification	Registry Run Keys / Startup Folder
Scheduled task	Scheduled Task/Job
Service creation	System Services
User discovery	System Owner/User Discovery
Network configuration discovery	System Network Configuration Discovery
External connection	Application Layer Protocol

ATT&CK mapping supports communication and detection development.

48. Assess Evidence Confidence

For each finding, use:

Confirmed
Likely
Possible
Not Observed
Unknown

Example:

Suspicious Process Execution:
Confirmed

Persistence:
Possible

External Network Activity:
Confirmed

Credential Theft:
Unknown

49. Determine Containment Need

Containment may be appropriate when:

Malware execution is confirmed
Suspicious network activity is ongoing
Persistence is identified
Credentials may be compromised
Multiple hosts are affected
High-value assets are involved

Possible actions include:

Isolate Endpoint
Disable Network Access
Quarantine File
Terminate Malicious Process
Disable Compromised Account
Revoke Sessions
Block Confirmed IOCs
Preserve Evidence

Follow organizational policy.

50. Preserve Evidence Before Destructive Actions

Before deleting files or terminating processes, consider whether evidence must be preserved.

Potential evidence includes:

Event Logs
Process Information
Network Connections
Files
Hashes
Registry Values
Scheduled Tasks
Services
Memory

Incident response must balance:

Containment
     vs
Evidence Preservation

51. Mission Challenge — Endpoint Compromise Investigation

The SOC provides:

A suspicious attachment identified during the phishing investigation may have executed on CYSA-WIN01. Determine what occurred and whether containment is required.

Investigate and answer:

1. Was the suspicious file present?

2. What was its full path?

3. Did the file hash match Lab 12?

4. Was process execution observed?

5. Which user executed it?

6. What was the parent process?

7. Which child processes appeared?

8. Was PowerShell executed?

9. What commands were observed?

10. Were additional files created?

11. Were suspicious files placed in Temp, AppData, or ProgramData?

12. Were registry Run keys modified?

13. Were scheduled tasks created?

14. Were services created?

15. Were new accounts created?

16. Were administrator memberships changed?

17. Did the endpoint generate suspicious DNS queries?

18. Did it contact suspicious IPs?

19. Which processes owned those connections?

20. Did Zeek confirm network activity?

21. Did Suricata generate alerts?

22. Were the same IOCs observed on other endpoints?

23. Is execution confirmed?

24. Is persistence confirmed?

25. What is the incident scope?

26. Should the endpoint be contained?

27. What actions should the SOC take next?

52. Document Your Findings

Update:

~/CySA-Lab/Investigations/LAB13/investigation-notes.md

Use:

# LAB13 Endpoint Malware Investigation

## Investigation ID

LAB13-ENDPOINT-001

## Endpoint

- Host:
- IP:
- User:
- Investigation Window:

## Suspicious File

- Filename:
- Full Path:
- SHA-256:
- File Present:
- Hash Match:

## Execution Evidence

Document:
- Event ID
- Process
- PID
- Parent Process
- User
- Command Line
- Timestamp

## Process Tree

Document the parent-child process chain.

## PowerShell Activity

Document:
- process
- parent
- command
- script block
- timestamp

## File Activity

Document newly created or modified files.

## Persistence Investigation

### Registry
Document suspicious Run keys.

### Scheduled Tasks
Document suspicious tasks.

### Services
Document suspicious services.

### Startup Locations
Document relevant findings.

## Account Activity

Document:
- new users
- privilege changes
- group modifications

## Network Activity

Document:
- DNS queries
- remote IPs
- ports
- owning processes
- Zeek correlation
- Suricata correlation

## IOC Pivoting

Document where extracted IOCs appeared.

## Scope

Document affected:
- users
- endpoints
- accounts
- network destinations

## Assessment

### Execution
Confirmed / Likely / Not Confirmed

### Persistence
Confirmed / Possible / Not Observed

### Network Activity
Confirmed / Possible / Not Observed

### Overall Classification
Benign / Suspicious / Malicious / Inconclusive

## Severity

Low / Medium / High / Critical

## Containment Decision

Contain / Monitor / Continue Investigation

## Recommended Actions

Document response actions.

53. Example Analyst Findings

A simulated assessment might resemble:

Investigation:
LAB13-ENDPOINT-001

Endpoint:
CYSA-WIN01
10.10.10.20

Suspicious File:
invoice.exe

Hash:
Matched the sample investigated in Lab 12.

Execution:
Confirmed through Windows process creation telemetry.

Parent Process:
User shell process.

Child Activity:
PowerShell and system discovery activity observed.

Persistence:
Potential persistence indicator identified in an autorun location.

Network Activity:
Endpoint generated DNS and network activity involving an IOC identified during static analysis.

Network Correlation:
Zeek confirmed the connection.
Related Suricata telemetry was available.

Scope:
Current evidence identifies one affected endpoint.

Classification:
Malicious Activity — Simulated Laboratory Scenario

Severity:
High

Containment:
Recommended in a real environment.

Recommended Action:
Isolate the endpoint, preserve evidence, terminate confirmed malicious execution according to IR procedures, quarantine the file, block validated IOCs, investigate the user account, and hunt for the same indicators across the environment.

54. Evidence to Capture

Capture:

01-endpoint-alert.png
02-file-hash-search.png
03-suspicious-file-path.png
04-event-4688.png
05-parent-process.png
06-process-tree.png
07-command-line.png
08-powershell-event.png
09-file-creation.png
10-registry-run-key.png
11-scheduled-tasks.png
12-services.png
13-user-account-review.png
14-active-network-connections.png
15-process-network-correlation.png
16-zeek-correlation.png
17-suricata-correlation.png
18-ioc-pivot.png
19-environment-hash-search.png
20-execution-timeline.png
21-incident-scope.png
22-analyst-findings.png

55. Validation Checklist

• Investigation scope was established

• File hash was searched

• Suspicious filename was investigated

• Process creation telemetry was reviewed

• Event ID 4688 was analyzed

• Initial suspicious process was identified

• Parent process was identified

• Child processes were investigated

• Process tree was constructed

• Command-line telemetry was reviewed

• PowerShell activity was investigated

• Event 4104 was reviewed where available

• File creation activity was investigated

• Static-analysis indicators were compared with endpoint behavior

• Registry Run keys were investigated

• Scheduled tasks were investigated

• Service activity was investigated

• Startup locations were reviewed

• Account-management activity was investigated

• Local administrators were reviewed

• Network connections were investigated

• Network connections were mapped to processes

• Zeek telemetry was correlated

• Suricata telemetry was correlated

• Static-analysis domains were searched

• Static-analysis IPs were searched

• Hash was searched across the environment

• Investigation scope was determined

• Execution status was classified

• Persistence status was classified

• Network-activity status was classified

• ATT&CK techniques were mapped where supported

• Containment requirements were considered

• Evidence was captured

• Analyst findings were documented

56. Mission Review

In this mission, you moved from asking:

What might this file be capable of?

to:

What actually happened on the endpoint?

The investigation evolved through:

Suspicious File
      ↓
Hash / Filename Pivot
      ↓
Process Execution
      ↓
Parent / Child Analysis
      ↓
Command Lines
      ↓
PowerShell
      ↓
File Activity
      ↓
Persistence
      ↓
Network Activity
      ↓
IOC Correlation
      ↓
Scope
      ↓
Containment Decision

The critical lesson is:

Malware investigations become much stronger when sample intelligence, endpoint telemetry, identity activity, and network evidence all tell the same story.

A mature analyst distinguishes:

Potential Capability
        ↓
Observed Behavior
        ↓
Correlated Evidence
        ↓
Confirmed Impact

Skills Developed

After completing this mission, you should be able to:

• perform endpoint malware triage

• investigate process execution

• construct process trees

• analyze parent-child relationships

• investigate process command lines

• investigate PowerShell telemetry

• analyze file-creation activity

• investigate registry persistence

• investigate scheduled tasks

• investigate Windows services

• review account changes

• analyze endpoint network connections

• map network connections to processes

• correlate endpoint and Zeek telemetry

• correlate Suricata alerts

• pivot on hashes, domains, and IPs

• determine malware execution status

• evaluate persistence

• determine incident scope

• assess containment requirements

• document endpoint compromise findings

What’s Next?

Lab 14 — Vulnerability Scanning and Assessment

You have now investigated a potentially compromised endpoint.

The next question for a cybersecurity analyst is broader:

Which weaknesses across the environment could attackers exploit?

In the next mission, you will move into vulnerability management and assessment.

You will investigate:

• vulnerability-scanning fundamentals

• asset discovery

• authenticated vs unauthenticated scans

• CVEs

• CVSS

• scanner severity

• false positives

• vulnerable software

• missing patches

• exposed services

• remediation validation

• vulnerability evidence

• risk-based prioritization

• vulnerability reporting

The workflow shifts from:

Incident Investigation

to:

Asset
  ↓
Vulnerability Scan
  ↓
Finding
  ↓
Validation
  ↓
Risk Assessment
  ↓
Remediation

➡️ Next: Lab 14 — Vulnerability Scanning and Assessment