Where every investigation begins
"Was a remote PowerShell session used to reach this computer from somewhere else on the network?"
Without a question, evidence is just noise.
What would we expect to find?
Prefetch: activity log
What would you expect?
Shimcache: execution history
What would you expect?
Amcache: application record
What would you expect?
Eventlog: process-creation record
What would you expect?
Eventlog: logon record
What would you expect?
Netstat: live connections
What would you expect?
What did we actually find?
Prefetch: activity log
foundSession-host process, once
Shimcache: execution history
foundSession-host process, independently
Amcache: application record
foundSession-host process, a third time
Eventlog: process-creation record
foundProcess-creation record, 5 times
Eventlog: logon record
foundNetwork logon, type 3, 21 times
Netstat: live connections
foundListener open at collectionsnapshot: point-in-time only
What else could explain this?
Click each piece of evidence.
Lateral movement to another host
Session-host process ranwsmprovhost.exe
Network logon recordedtype 3
Listener open at collectionport 5985
Routine remote administration
Session-host process ranwsmprovhost.exe
Network logon recordedtype 3
Listener open at collectionport 5985
An automated job or agent
Session-host process ranwsmprovhost.exe
Network logon recordedtype 3
Listener open at collectionport 5985
What if we also had the other computer's evidence?
The same case file has it: a scheduled task for persistence, a credential validated against this computer, and a file copied over minutes before the session started, all on the other computer. This predicate doesn't match any of that yet, by design. With it, the ambiguity above mostly resolves.
What does the evidence support?
0 of 3 considered
A session was hosted here. Why, and by whom, has not been established.
Add each piece of evidence in any order. What each one means is the investigator's call, not Evidenx's.
Permanent, independent records
The session-host process appears in three separate records: Prefetch, Shimcache, and Amcache. They write independently and agree.
Three independent sources
Ambient corroboration
The network logon and open listener are real, but every remote-administration session looks the same way. Neither is unique to this explanation.
Shared with routine use
Declared out of scope
Which computer initiated the session, and what ran afterward, isn't part of what this evidence declares. That's a limit of scope, not an absence of evidence.
A limit of scope, not an absence
What would make us change our mind?
That is where the evidence stands. But every conclusion has a way to be wrong.
Which of these would most change what we believe?
Which of these would most change what we believe?
Investigators call this counterfactual reasoning: identifying what evidence would overturn a conclusion. It is not a sign of weakness. It is how you know your conclusion is honest.
Could this structure travel beyond cyber?
Illustrative examples only. Evidenx is focused on digital forensics and incident response today.
Question
Prediction
Evidence
Absence
What changes this?
Significance
You didn't find an answer in the data.You built the best explanation the evidence could support.That is the only kind of understanding that exists.
The steps you just took have names.
| The question you started with | Hypothesis |
| What you expected to find | Prediction |
| What you tested evidence against | Observation |
| What you built piece by piece | Claim |
| What would change your mind | Counterfactual |
The evidence changed.
The reasoning didn't.
The reasoning didn't.
The same structure can carry beyond incident response. Evidenx starts there.
Data→Information→Understanding→Your conclusion
The conclusion is yours
Evidenx™ took the evidence up the ladder: from data, to information, to understanding. It stops there. Evidenx™ provides the evidence, not the verdict.
Evidenx™
Knowledge Construction.™ Not Telemetry.
The Key to Understanding.™
© Evidenx™ UG. All rights reserved.
