A financial services firm has detected anomalous internal network traffic originating from a compromised HR workstation (Hostname: HR-WIN10-04). Threat intelligence suggests the adversary is utilizing "Living off the Land" (LotL) techniques to pivot laterally to highly sensitive database servers without dropping custom malware.
The Digital Forensics and Incident Response (DFIR) team has acquired a triage image from the HR workstation, including the Master File Table (MFT), Registry hives, and Windows Event Logs. The analyst's current objective is to definitively prove whether the attacker used the native Windows Remote Desktop client (mstsc.exe) to connect to other hosts on the network.
In a digital-forensics investigation, an analyst is searching for evidence of "lateral movement" within a network. Which artifact on a Windows system provides evidence of remote desktop (RDP) connections to other hosts?
The triage log indicates outbound port 3389 (RDP) traffic. To attribute this to a specific user profile and confirm the destination hostnames or IPs as entered by the attacker, the investigator must examine specific user-attributed registry keys and event logs linked to the native Windows Remote Desktop client.
Analysis Phase. The investigator is analyzing extracted Windows artifacts (Registry and Event Logs) to reconstruct the timeline of lateral movement and identify compromised target systems.
A is the correct answer. Outbound RDP connections are heavily documented by Windows. The NTUSER.DAT registry hive stores connection history at Software\Microsoft\Terminal Server Client\Servers, which explicitly lists the target IPs/hostnames the user connected to. Additionally, the Microsoft-Windows-TerminalServices-ClientActiveXCore event log tracks successful outgoing RDP connections, making this combination the definitive artifact for RDP lateral movement.
SYSTEM\CurrentControlSet\Enum\USBSTOR key tracks physical USB mass storage devices that have been connected to the system. It contains no network or lateral movement data.$I files) and content (via $R files) of deleted files. It does not track network connections or RDP sessions.C:\Windows\Prefetch) tracks the execution history of applications (like proving mstsc.exe was run). However, it does not store the destination IP or host connected to, meaning it is insufficient as direct evidence of "connections to other hosts."A forensic analyst would mount the compromised user's NTUSER.DAT hive and use a tool like Registry Explorer or RECmd to parse the Terminal Server Client\Servers key. They would extract the list of target IPs (e.g., 10.0.5.50), noting the "UsernameHint" value which reveals the credentials the attacker attempted to use. They would then pivot to the target system (DB-PROD-01) and search for Event ID 4624 (Logon Type 10 - RemoteInteractive) to confirm a successful breach.
Inbound vs. Outbound RDP: Forensic investigators must distinguish between inbound and outbound artifacts.
Outbound (The Attacker's source): Look at NTUSER.DAT (Terminal Server Client), TerminalServices-ClientActiveXCore logs, and bitmap caches (%LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache).
Inbound (The Victim system): Look at the Security log (Event IDs 4624/4625 Logon Type 10) and the TerminalServices-LocalSessionManager logs (Event IDs 21, 24, 25) to see who connected in.
Enhance your digital forensics readiness with our comprehensive CHFI practice environments.
Explore more CHFI simulations