QuestionQ26
VerifiedForensics Investigation and Malware AnalysisA SOC analyst receives an alert that the system time on a critical Windows server was changed at 3:00 AM. No maintenance tasks are scheduled at that time. Unauthorized time changes can help evade security controls, including by changing timestamps to conceal malicious activity. The analyst must identify the relevant event codes that record system time changes and associated suspicious behavior. Which of the following Windows Security Event Codes should the analyst review to investigate possible tampering?
Community Discussion