Practice Lab · 10 · Forensics
Suspicious Download Case
Investigate a fictional suspicious download by correlating browser history, file metadata, process creation, network activity, scheduled persistence, and Defender evidence.
The lab does not require executing unknown content. Your job is to reconstruct behavior from evidence and contain only what is supported.
Lab Snapshot
Mission briefing
Determine whether the download was present, executed, persistent, and network-active
This fictional case uses an authorized practice workstation and prepared evidence only.
A suspicious archive was downloaded by a user during a normal work session.
Your goal is to determine what happened after the download without executing any unknown file.
Preserve hashes, paths, timestamps, browser artifacts, process evidence, persistence clues, and network evidence before remediation.
Do not open or run the suspicious executable during the investigation.
Separate direct evidence from assumptions about intent.
Use multiple artifacts to support conclusions about download, extraction, execution, persistence, and communication.
Contain or remove only what the evidence supports and only inside the authorized lab.
Case profile
Start with the known facts
User
Jordan
System
Windows 11 practice workstation
Initial clue
Unexpected ZIP archive in Downloads
Primary question
Was the downloaded content only present, or was it executed and made persistent?
Investigation boundary
Analyze the suspicious file without running it
Hashing, metadata review, event logs, scheduled tasks, Defender evidence, and process/network correlation can reveal behavior without intentionally launching the unknown executable.
Browser evidence
Establish how the file arrived
Download history
Establish how and when the archive arrived and whether the browser recorded a completed download.
Visited pages
Add context around the user's browsing activity without assuming the visit itself proves execution.
Cached content
Use supporting artifacts to confirm the sequence around the download.
File evidence
Preserve hashes, paths, and timestamps
Hash the archive
Record a stable identifier for the downloaded archive before further analysis.
Get-FileHash "$env:USERPROFILE\Downloads\update-tool.zip" -Algorithm SHA256
Inspect metadata
Record path, size, and timestamps without opening or modifying the archive.
Get-Item "$env:USERPROFILE\Downloads\update-tool.zip" | Format-List Name,Length,CreationTime,LastWriteTime,FullName
Inspect extracted artifacts
Document extracted files if the fictional case already includes them, while avoiding execution.
Get-ChildItem "$env:USERPROFILE\Downloads\UpdateTool" -Force | Select-Object Name,Length,CreationTime,LastWriteTime
Hash the executable
Identify the executable and preserve evidence before containment or removal.
Get-FileHash "$env:USERPROFILE\Downloads\UpdateTool\update-tool.exe" -Algorithm SHA256
Execution evidence
Determine whether the file actually ran
Process creation evidence
Look for execution records that include the suspicious path, user, process ID, and parent process.
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4688} -MaxEvents 100Running processes
Determine whether any process matching the suspicious artifact is currently active.
Get-Process | Sort-Object ProcessName
Recent service installation
Check whether execution created or installed a service.
Get-WinEvent -FilterHashtable @{LogName="System"; Id=7045} -MaxEvents 50PowerShell evidence
Review PowerShell activity if the case suggests a script or shell was launched.
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 80
Persistence evidence
Check whether execution was designed to return
Scheduled tasks
Identify tasks that may launch the suspicious executable at logon or on a schedule.
Get-ScheduledTask
Get-ScheduledTask | Where-Object {$_.TaskName -match "Update|Check|Tool"}Startup folders
Check common startup locations for links or executables.
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
Get-ChildItem "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force
Run keys
Review common autorun registry locations for suspicious entries.
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Services
Identify newly added or oddly named services that require deeper correlation.
Get-Service | Sort-Object Name
Network evidence
Tie communication to the suspicious process
Current connections
Review active TCP connections and correlate them with process ownership where possible.
Get-NetTCPConnection | Sort-Object State,RemoteAddress
Process-to-connection mapping
Tie remote communication to an owning PID rather than treating every connection as suspicious.
Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
Listening ports
Check whether a suspicious process created a local listener.
Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess
DNS cache
Use cached name-resolution evidence as supporting context for recent communication.
Get-DnsClientCache
Fictional evidence set
Correlate the case from download to persistence
Jordan's browser history shows a visit to a fictional download page for an 'update helper.'
Investigation prompt
What additional evidence would you want before claiming a file was downloaded?
The browser records a completed download named update-tool.zip into Jordan's Downloads folder.
Investigation prompt
What does this establish, and what does it still not prove?
A folder named UpdateTool appears with update-tool.exe inside it.
Investigation prompt
What event likely occurred between the archive download and this folder's appearance?
A process-creation event records update-tool.exe launched from the extracted folder under Jordan's account.
Investigation prompt
Why is this stronger evidence than file presence?
The PID associated with update-tool.exe opens an outbound TCP connection to a fictional external address.
Investigation prompt
How does PID correlation strengthen the network evidence?
A new task named UpdateCheck launches update-tool.exe at user logon.
Investigation prompt
What behavior does this add to the case?
Microsoft Defender records a detection tied to the same executable path, but the file remains present in the prepared lab snapshot.
Investigation prompt
Why should the detection be correlated with other evidence rather than treated as the entire investigation?
Jordan logs off while the UpdateCheck task remains configured.
Investigation prompt
What would you predict may occur at Jordan's next logon if the task is not removed?
Case questions
Build conclusions from supporting artifacts
Did the archive arrive through the browser?
Evidence to use
Browser download history + file presence
Was the archive extracted?
Evidence to use
Extracted folder + file metadata
Was the executable launched?
Evidence to use
Process-creation event
Did it communicate externally?
Evidence to use
Owning PID + outbound connection
Did it create persistence?
Evidence to use
Scheduled task action + trigger
Did security tooling react?
Evidence to use
Defender event tied to the same path/hash
Preserve first
Capture the evidence before containment changes system state
Record SHA-256 hashes for the archive and executable.
Record browser download URL, destination path, and timestamp.
Record archive and extracted-file metadata.
Record process ID, parent process, user, path, and command line.
Record the scheduled-task name, action, trigger, run-as account, and timestamps.
Record network endpoints and owning PID.
Record Defender evidence including path, detection time, and threat name from the prepared lab.
Keep an evidence notebook separating facts, interpretations, and remediation actions.
Authorized containment examples
Contain only what the evidence supports
These examples apply only to the fictional practice workstation after evidence preservation.
Disable a suspicious scheduled task
Use only after the case evidence confirms the task is tied to the suspicious executable.
Disable-ScheduledTask -TaskName "UpdateCheck"
Stop a verified suspicious process
Use only in the authorized lab after preserving process and network evidence.
Stop-Process -Id <PID>
Remove persistence after preservation
Remove only after documenting the task definition and confirming it is not required.
Unregister-ScheduledTask -TaskName "UpdateCheck" -Confirm:$false
Re-scan with Defender
Use as a verification step after containment in the practice environment.
Start-MpScan -ScanType QuickScan
Verification
Prove the suspicious behavior no longer persists
Execution
The suspicious process is no longer running after authorized containment.
Get-Process | Sort-Object ProcessName
Persistence
The confirmed suspicious task is disabled or removed according to the lab decision.
Get-ScheduledTask | Where-Object {$_.TaskName -eq "UpdateCheck"}Network
No connection remains tied to the suspicious process.
Get-NetTCPConnection | Select-Object RemoteAddress,RemotePort,State,OwningProcess
Defender
Defender remains enabled and the system shows the expected post-containment security state.
Get-MpComputerStatus
Get-MpThreatDetection
Evidence
Your recorded evidence identifiers still match the preserved case data.
Get-FileHash "$env:USERPROFILE\Downloads\update-tool.zip" -Algorithm SHA256
Reflection
Debrief the suspicious download case
What is the difference between proving a file was downloaded and proving it was executed?
Why is process-creation evidence especially valuable in this case?
Why should network activity be tied to a PID when possible?
How does the scheduled task change the case from a one-time event to persistent behavior?
Why should Defender evidence be correlated with browser, process, and persistence artifacts?
Why should the suspicious executable not be opened during the investigation?
What should be preserved before removing the scheduled task?
Which two artifacts provide the strongest evidence that the suspicious file affected system behavior?
Completion checklist
Finish only when the case is supported and contained
I preserved hashes and metadata before containment.
I confirmed the archive arrived through the browser.
I distinguished file presence from execution.
I correlated the executable with a process-creation event.
I tied network activity to the suspicious PID.
I identified persistence through the scheduled task.
I reviewed Defender evidence without relying on it alone.
I separated direct observations from inferences.
I applied only narrow authorized containment actions.
I verified the suspicious behavior no longer persists.