Quick reference - first moves by platform #

Windows evidence of execution - ranked

  1. Prefetch (client only, last 8 runs)
  2. Amcache (presence + full-file SHA1 modern)
  3. SRUM (per-app, per-user, with network bytes)
  4. BAM/DAM (per-user last run)
  5. UserAssist (GUI launches)
  6. Sysmon EID 1, Security 4688 (if enabled)
  7. ShimCache - presence, not execution

Linux "first 10 minutes" triage

  1. Capture memory (AVML)
  2. w, last -Faiwx, lastb, ps auxwwef, netstat -antup or ss -tunap
  3. ls -laR /tmp /dev/shm /var/tmp; find deleted-but-mapped (ls -la /proc/*/exe 2>/dev/null | grep deleted)
  4. auth.log / secure, journalctl since suspected window
  5. cron, systemd timers, SSH authorized_keys scan
  6. UAC collection

macOS "first 10 minutes" triage

  1. sudo sysdiagnose
  2. log collect --last 30d
  3. sfltool dumpbtm for persistence
  4. Launch{Agents,Daemons} dirs; TCC.db, Quarantine DB
  5. FSEvents + Spotlight metadata on relevant paths
  6. aftermath / macOS UAC

AWS "first 10 minutes" triage

  1. Verify CloudTrail still logging; DescribeTrails, GetTrailStatus; StartLogging if stopped
  2. get-account-authorization-details snapshot of IAM
  3. Query CloudTrail (Athena) for last 7-30d: CreateAccessKey, UpdateLoginProfile, AssumeRole from new source IPs, console logins without MFA
  4. GuardDuty findings dump
  5. EBS snapshots of impacted instances to IR account

M365 "first 10 minutes" triage

  1. Enable Audit if not on; preserve via Purview hold
  2. UAL search for suspect user: Operations in UserLoggedIn, MailItemsAccessed, New-InboxRule, Add-MailboxPermission, Consent to application, Add service principal
  3. Entra sign-ins: Interactive + Non-interactive + Service Principal; filter sessionId with multiple IPs
  4. Risky users / Risky sign-ins export
  5. Enumerate inbox rules per impacted mbx (Get-InboxRule) + enterprise OAuth app consents
  6. Revoke refresh tokens; disable auto-forward; add CA policy blocking legacy auth if not present