Timeline Analysis and Artifact Correlation

Attackers move through environments over time — initial access, persistence, lateral movement, and exfiltration may span days or weeks. Timeline analysis correlates artifacts across sources to reconstruct the attack sequence and determine dwell time.

Key time sources: NTFS MAC times (MFT entries), Windows Event Log timestamps, Prefetch execution timestamps, registry last-write times, browser history timestamps, and $UsnJrnl change journal entries. Each has different precision and tamper resistance.

NTFS stores Modified (content changed), Accessed (last read), and Created times per file, plus a separate $STANDARD_INFORMATION attribute with additional timestamps. Attackers can modify MAC times (timestomping) — compare both attribute sets to detect manipulation.

Key Event IDs: 4624 (successful logon), 4625 (failed logon), 4648 (explicit credentials), 4688 (process creation with command line), 4698 (scheduled task created), 7045 (new service installed), 4720 (user account created). Filter these around the incident window.

Windows Prefetch records application execution timestamps and referenced files. Located at C:\Windows\Prefetch\, each .pf file contains the last 8 execution times of a program. Prefetch files persist after application deletion — proving a program ran even if deleted.

log2timeline (plaso) extracts timestamps from dozens of artifact types into a unified super-timeline. Filter with psort.py to focus on specific time windows and artifact types. The resulting CSV can be imported into timeline tools or spreadsheets for analysis.

Cross-reference: Event ID 4688 (process creation) with Prefetch execution, scheduled task XML creation in registry with 7045 event, lateral movement timestamps in security log with SMB traffic in network captures. Consistent timestamps across sources increase confidence.

Compare the system timeline against baselines. Creation of executables in user profile directories, registry Run key modifications at unusual hours, outbound connections from non-browser processes — these anomalies stand out in a clean timeline.

Correlate Volatility process start times (windows.pslist shows create_time) with Event Log 4688 entries to confirm process execution, and with network connections timeline to identify when C2 communication began relative to initial compromise.

A formal incident timeline documents: T+0 (initial access method and timestamp), each subsequent attacker action with evidence source, lateral movement hops, data staged and exfiltrated with timestamps, and containment action timestamps. This becomes the incident report backbone.

Attackers use timestomping tools to set MAC times of malicious files to match legitimate system files, hiding them in bulk timeline analysis. Detecting timestomping: compare $STANDARD_INFORMATION timestamps with $FILE_NAME attribute timestamps — they often differ after stomping.

What Windows Event ID indicates a new service was installed, often used for persistence?

Timeline analysis correlates timestamps from NTFS, Event Logs, Prefetch, registry, and network captures into a chronological attack narrative. Using plaso to build super-timelines and cross-referencing artifact sources reveals attacker dwell time and action sequence with high confidence.