Reconstructing the Host Timeline

What is it?

A host timeline is the ordered account of what happened on one machine — logons, process launches, persistence creation, file writes and network calls — laid on one axis of time so the intrusion reads as a story from initial access to objective.

Why it matters

Individual artefacts answer 'what'; the timeline answers 'what happened, in what order, and how far did it get?'. That is what an escalation, a containment decision and a report all need. It also exposes gaps — a missing expected event can mean anti-forensics, and the gap is a finding.

Where you see it

The timeline is assembled from Windows Security logon events (4624/4625 with the logon type), Sysmon process and file events, persistence creation events, and network telemetry — all normalised to one time zone (the skill from Module 1) and ordered.

What normal looks like

A normal host timeline is mostly interactive or service logons during working hours, applications launched by explorer, and updates from protected paths — a boring, explainable sequence with no chain from a document to a script to a callout.

What suspicious looks like

A suspicious timeline shows a coherent attacker arc: an unusual logon (a remote interactive logon at an odd hour), then execution, then persistence, then a callout — each step enabling the next. An impossible order or a conspicuous gap where logging should exist is itself suspicious.

How analysts investigate

Gather every host artefact for the window, normalise the timestamps, order them, then read the sequence as a story and test its causality — does each step enable the next? Note the logon type on the first access, and record any gap where an expected event is missing.

Common beginner mistakes

Listing artefacts without ordering them, so the causal story — and its impossibilities — never appears.
Ignoring the logon type, which distinguishes a benign network logon from a hands-on-keyboard remote session.
Reading a gap in the timeline as 'nothing happened' rather than possible anti-forensics.

What you will be able to do

Assemble host artefacts into one ordered, clock-corrected timeline.
Read a logon type to tell a benign logon from a hands-on-keyboard session.
Recognise a timeline gap as possible anti-forensics, and record it.

You have the process chain and the persistence. On their own they are facts; assembled in order they become an intrusion you can explain, escalate and report. The host timeline is where the deep-dive pays off — the whole arc, from first logon to final callout, on one axis.

Logon type	Meaning	When it's a flag
2 — interactive	At the console	On a server nobody sits at
3 — network	File share / auth	Usually benign
10 — remote interactive	RDP session	From an unusual source, off-hours

Worked example — read the arc

Host timeline · FIN-WS-09 (UTC, ordered)

09:14  4624  logon type 10 (RDP) from an unfamiliar workstation, off-hours
09:16  Sysmon 1  WINWORD.EXE -> powershell.exe -enc
09:16  Sysmon 11  rt.exe written to C:\Users\Public
09:17  4698  scheduled task created by a non-admin, runs rt.exe
09:18  network  rt.exe -> 45.9.148.200 every 60s

Five artefacts, ordered. Before reading on, decide: is this one causal arc, and where did it start?

The answer: yes, one arc, and it started with the type-10 remote logon. Each step enables the next: a hands-on-keyboard RDP session opens a document that runs an encoded PowerShell, which drops rt.exe, which is then made persistent by a scheduled task and begins beaconing. The order is causally coherent — access, execution, persistence, command-and-control. The type-10 logon at an odd hour from an unfamiliar source is the entry point, and the whole story is defensible because every step explains the one after it.

Recap

The host timeline turns separate artefacts into one ordered, causal intrusion story.
The logon type on the first access often decides how serious the entry is.
A gap where an event should be is itself a finding — possible anti-forensics.