An incident response team discovers that an attacker has been present in the network for 6 months. The attacker used a valid domain administrator account. Which forensic artifact is most useful for establishing a timeline of the attacker's activities within Active Directory?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because DC Security event logs capture authentication events, privilege use, account creation, and group changes with timestamps — providing a chronological record of the attacker's actions using the compromised admin account over time. AD object modification timestamps (whenChanged attribute) corroborate changes made to AD objects.
Full Explanation
B is correct because DC Security event logs capture authentication events, privilege use, account creation, and group changes with timestamps — providing a chronological record of the attacker's actions using the compromised admin account over time. AD object modification timestamps (whenChanged attribute) corroborate changes made to AD objects. A is wrong because a current group membership report shows only the present state, not historical changes. C is wrong because DHCP leases show current or recent IP-to-hostname mappings, not AD action history. D is wrong because the DNS zone file shows current DNS records, not a history of attacker activity.