An incident response team discovers that an attacker has been present in the network for 6 months. The attacker used a valid domain administrator account. Which forensic artifact is most useful for establishing a timeline of the attacker's activities within Active Directory?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because DC Security event logs capture authentication events, privilege use, account creation, and group changes with timestamps — providing a chronological record of the attacker's actions using the compromised admin account over time. AD object modification timestamps (whenChanged attribute) corroborate changes made to AD objects.
Full explanation below image
Full Explanation
B is correct because DC Security event logs capture authentication events, privilege use, account creation, and group changes with timestamps — providing a chronological record of the attacker's actions using the compromised admin account over time. AD object modification timestamps (whenChanged attribute) corroborate changes made to AD objects. A is wrong because a current group membership report shows only the present state, not historical changes. C is wrong because DHCP leases show current or recent IP-to-hostname mappings, not AD action history. D is wrong because the DNS zone file shows current DNS records, not a history of attacker activity.