An incident response team discovers that an attacker has been present in the network for 6 months. The attacker used a valid domain administrator account. Which forensic artifact is most useful for establishing a timeline of the attacker's activities within Active Directory?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need the domain controller Security event logs because they record logons, privilege use, account creation, group changes, and Kerberos activity with timestamps. When you correlate those events over the 6-month period with AD object modification timestamps and directory service change logs, you get a chronological picture of what the attacker did inside Active Directory.
Full Explanation
The Windows Security Event logs from domain controllers, including Event IDs 4624, 4625, 4648, 4672, 4720, 4728, 4768, and 4769, are correct because they capture authentication events, privilege use, account creation, group changes, and Kerberos activity with timestamps. Correlating those events over the 6-month period provides a chronological record of the attacker's actions using the compromised domain administrator account over time. AD object modification timestamps, such as the whenChanged attribute, and directory service change logs corroborate changes made to AD objects. The current Active Directory group membership report is wrong because it shows only the present state, not historical changes. The current DHCP lease table is wrong because it shows current or recent IP-to-hostname mappings, not AD action history. The DNS forward lookup zone file is wrong because it shows current DNS records, not a history of attacker activity.