Elena, a forensic investigator, is analyzing the behavior of a suspected malware infection. During her analysis, she notices several abnormal entries in the Windows Event Logs, specifically Event ID…

Question

Options

• AThe username and password used for unauthorized access
• BThe location of the file that was deleted by the malware
• CThe malicious process's registry key modification details
• DThe name of the process and the IP address it communicated with

• A
  2% (1)
• B
  5% (2)
• C
  9% (4)
• D
  84% (37)

Explanation

According to the CHFI v11 Operating System and Malware Forensics objectives, Windows Event ID 5156 is generated by the Windows Filtering Platform (WFP) and indicates that a network connection has been permitted. This event is highly valuable in malware investigations because it records detailed information about process-level network activity, which is a common indicator of Event ID 5156 logs typically include: Process name and Process ID (PID) that initiated the network connection Source and destination IP addresses Source and destination ports Protocol used (TCP/UDP) Direction of the connection (inbound or outbound) CHFI v11 explicitly highlights the importance of Windows Security Event Logs in tracing malware behavior, especially for identifying command-and-control (C2) communications, data exfiltration attempts, and lateral movement. By analyzing Event ID 5156, investigators can directly correlate a specific executable or malicious process with external IP addresses, helping establish attacker infrastructure and timelines.

No community discussion yet for this question.