How to Build a Behavioral Timeline
Template
| Timestamp | Source Tool | Action | Detail | IOC |
|---|---|---|---|---|
| T+0s | Procmon | Process Start | malware.exe launched | PID: 1234 |
| T+1s | Procmon | File Write | Dropped file to %TEMP% | Hash: abc... |
| ... | ... | ... | ... | ... |
Data Sources
- Procmon CSV export – Process, file, registry events
- Wireshark PCAP – Network timeline
- Process Explorer – Process tree snapshots
- FakeNet-NG logs – Intercepted connections
Correlation Tips
- Align all timestamps to sample execution (T+0)
- Look for causal chains across tools
- Note any sleep/delay periods
- Track process spawning sequences
Deliverable Checklist
- All file system changes documented
- All registry modifications documented
- All network connections documented
- Process tree captured
- IOCs extracted and categorized
- ATT&CK techniques mapped