Hypothesis Card

Activity consistent with a remote PowerShell session hosted on ACME-APP-04.

The automated check is deliberately target-only: it establishes that a session was served, and says nothing about who opened it. Everything below is therefore evidence an investigator reads, not a conclusion the tool reached, and it is labelled that way throughout so the two are never confused.

None of these could carry the reconstruction on its own, and none was asked to. They widen what an investigator sees around the anchor. Each is listed with what it does and, more usefully, what it cannot establish.

Confirmed, and showing reachability or authentication rather than execution:

What each one is for, and its limits, in the words of whoever wrote the check:

2026-10-07 to 2026-10-08, 19:58:28Z to 07:09:59Z, both hosts merged by timestamp. 11 hours 11 minutes.

Between 06:36:10Z and 07:09:59Z, the window the confirmed evidence spans, these hosts recorded 7,533 further things that nothing asked about. No alert covered them and no automated check looked for them. Grouped by where and what, largest first, and deliberately not filtered by relevance: an investigator decides what matters here, which is the whole point of showing it.

Outside the operating system's own directories

Under C:\Windows and friends

What each absence means, and whether it counts for anything. absent is searched and genuinely not there. not_collected means that evidence was never gathered, which says something about the collection and nothing about the incident.

That covers what was deliberately looked for, and nothing more. It is not a claim that nothing else is missing from this case. Steps 3 and 6 sit entirely outside what any automated check here asked about.

This is the honest edge of the tool. Everything named here was in the evidence, on this card, and visible to a human reading it; what is missing is the ability to reach it without one. That distinction is the reason the card separates confirmed findings from evidence throughout, instead of presenting a single undifferentiated story.

This establishes indicators only; it does not establish maliciousness, attribution, or intent.

What ran under it

The matched process is pid 3412. These processes were created beneath it, read from the 4688 records themselves: each row is one record stating a pid, its parent and its command line. Nothing here is inferred.

What followed, in the same window

Step 6 in full. These are the tightest groups outside the operating system's own directories, each a burst of filesystem records compressed into seconds:

• 79 file data change recorded in \.\c:\acmelab\scenario\businessdata\ on ACME-APP-04, 06:45:44Z to 06:45:45Z
• 60 file change recorded in \.\c:\users\bob\appdata\roaming\microsoft\windows\recent\customdestinations\ on ACME-WS-027, 07:03:38Z to 07:03:41Z
• 55 file creation recorded in \.\c:\acmelab\scenario\businessdata\ on ACME-APP-04, 06:45:44Z to 06:45:45Z
• 35 file change recorded in \.\c:\acmelab\scenario\businessdata\ on ACME-APP-04, 06:45:44Z to 06:45:45Z
• 20 file creation recorded in \.\c:\users\bob\appdata\roaming\microsoft\windows\recent\customdestinations\ on ACME-WS-027, 07:03:38Z to 07:03:41Z

Evidence against

None recorded, and that is not the same as none existing. contradicting_observations is empty on every hypothesis this version produces: the evaluator has no mechanism for populating it, so an empty list here means nothing was looked for, not that nothing was found. Read it as a gap in the tool, never as support for the hypothesis.

The nearest thing this card does carry is Step 7: 3 things that were expected and not found. Each is listed there with whether it counts for anything, and none of them is weighed against this reconstruction here.

The competing explanation

The matched evidence establishes that a session was hosted on ACME-APP-04 by Administrator from ACME-WS-027, at the times in Step 5. It does not establish that it was unauthorised. An administrator doing routine remote maintenance produces the same 4688, the same Type 3 logon and the same SRUM row. Nothing in the matched set distinguishes the two, and Evidenx does not classify.

What that explanation now also has to account for is above, and none of it was confirmed automatically: the command line of what ran under the session, and a burst of filesystem writes on the same host two minutes later. Those are facts on this card, not a verdict. Whether they are routine is answered by the same things that were already missing.