@chrissanders88@infosec.exchange
2026-07-14 13:56 UTC
Investigation Scenario 🔎
A Windows 11 workstation’s Microsoft-Windows-TaskScheduler/Operational log contains Event ID 106, indicating a new scheduled task named "OneDrive Update Service" was registered at 5:45 PM local time. The user insists they were away from the computer when this happened.
What do you look for to investigate whether an incident occurred?
#InvestigationPath #DFIR #SOC
Replies (1)
-
@FuturisticRobert@infosec.exchange 2026-07-14 14:00
@chrissanders88@infosec.exchange Is user logged in but session locked?If session locked, how long? Study process tree. What spawned what?Is OneDrive sanctioned for use? If sanctioned, what drives are registered?