Demonstration · AI off · 4.26.13
Cover
Client: Northwind Holdings
Case: NW-IR-041
Analyst: M. Ortiz
Timezone: America/New_York
Host / user: WS-14 / j.hale
Classification: Synthetic demonstration — not independently captured product output
How this report was produced
CaseScope assembled case metadata, evidence list, processing status, hunt rows, and IOC dispositions stored on the case. The analyst entered the finding title, accepted/rejected indicators, remediation recommendation, and limitations. Conclusions required analyst approval. This HTML is a website mock of that package; it was not exported by a running CaseScope instance.
Executive summary
Suspicious remote-access activity on WS-14. Huntress alert at 18:14:11 corroborated by EVTX at 18:14:07 and firewall egress at 18:16:02 to 10.8.4.21. Analyst accepted 10.8.4.21 and rejected 10.0.0.15. No memory image. AI off.
Scope
Single workstation investigation after an endpoint alert. Not a full-estate hunt.
Evidence examined
- kape_ws14.zip — processed, published (CaseScope)
- huntress_ws14.csv — processed, published (CaseScope)
- northwind_edge.csv — processed, published (CaseScope)
- Memory — not supplied
Investigative methodology
Published ingest, then hunt by host/user/time, then analyst IOC disposition, then finding. Deterministic analysis suggestions were starting points only.
Timeline
18:14:07 EVTX PowerShell (WS-14 / j.hale) · 18:14:11 Huntress · 18:16:02 firewall to 10.8.4.21
Findings
Finding: suspicious remote access on WS-14. Analyst-approved. Support: EVTX + Huntress + firewall. Firewall row is corroboration, not sole proof.
Supporting evidence
Cited events remain on the case. Screenshots of the console are not attached in this demonstration package.
Analyst conclusions
Accepted IOC 10.8.4.21. Rejected 10.0.0.15. CaseScope did not determine the conclusion.
Limitations
No memory. Huntress export status is compatible, not certified. No actor attribution. No claim of court admissibility.
Recommendations
Isolate WS-14, reset j.hale, review RDP exposure, collect memory if the host is still available.
Tool and version appendix
CaseScope 4.26.13. EvtxECmd/Hayabusa for EVTX. AI: none. Not a reproducibility-center export (planned).