[Practice] “Time of Crime: 14:30!” ⏱️ Reconstructing Malicious Activity Timeline and Completing the Scenario

Jul 13, 2026

—

Hello, digital forensic investigators uncovering the truth of incidents! 🕵️‍♂️⌚️

Until now, we have gathered the puzzle pieces of malware one by one.

We’ve analyzed code, behavioral logs, mapped to MITRE ATT&CK, and even understood the attacker’s intent. But there’s still one missing piece: ‘Time’.

In crime investigation movies, they reconstruct the incident by writing down the event times in order on a whiteboard, saying, “The culprit entered at 10 o’clock, stole the item in 5 minutes, and left!” right?

This process is essential in cybersecurity as well. If you arrange the jumbled logs in chronological order, the causality becomes clear: “Ah, external communication started 3 seconds after this file was executed!”

Today, we will conduct a practice session where we use AI to sort complex log data into a timeline and, based on that, create a movie-like ‘incident response scenario’. 🎬

1. 🕰️ Why is ‘Timeline’ important?

Log files are usually stored in the order they are generated, but when combining logs from multiple systems (firewall, PC, server), they can easily become jumbled. Timeline analysis reveals two things:

Causality: Confirming the link between cause (Dropper execution) and effect (Ransomware infection).
Dwell Time: How long did the hacker stay after infiltration before launching the attack?

Short (minutes): Automated attacks (e.g., ransomware)
Long (days/months): Advanced Persistent Threats (APT)

2. 📝 [Prerequisites] Logs with Timestamps

The logs collected in previous exercises must include ‘time information’.

[Example Input Log Data]

[14:05:22] Network Connect: 192.168.10.5:4444 (Process: svchost.exe)
[14:00:05] Process Create: malware.exe (Parent: explorer.exe)
[14:05:00] File Encrypt: C:Docsreport.docx
[14:00:10] File Create: C:Tempsvchost.exe (Source: malware.exe)
[14:00:12] RegSetValue: HKCURunUpdate (Target: C:Tempsvchost.exe)
[14:06:00] File Delete: C:WindowsSystem32ShadowCopy...

As you can see, the times are mixed up. If a person were to organize this manually in Excel, it would be incredibly tedious. Let’s have AI do it.

3. 🗣️ [Prompt] “Line them up in chronological order!”

We provide the logs to the AI and request not only chronological sorting but also an interpretation of which attack phase each step belongs to.

📋 Timeline Generation Prompt

[Role]

You are a digital forensic expert and incident investigator.

[Task]

Sort the mixed log data (Raw Logs) below in chronological order to create a ‘Timeline Table’.

[Requirements]

1. Sorting: List from the earliest time to the latest time.

2. Phase Identification: Tag each action with the corresponding attack phase. (e.g., Ingress, Installation, Execution, C2 Communication, Impact, etc.)

3. Scenario Summary: Based on the timeline, write a one-paragraph incident reconstruction scenario (Narrative) that explains “who, when, and what happened.”

[Log Data]

(Paste the Example Input Log Data above)

4. 📤 [Result] Incident Log Organized by AI

AI recognizes the times within the logs, precisely orders them, and interprets their meaning.

🤖 AI Analysis Result (Example)

⏱️ Malicious Activity Timeline Analysis

1. Timeline Table

| Time | Phase | Action Details | Notes |

| — | — | — | — |

| 14:00:05 | 🚪 Ingress & Execution | malware.exe process started | Initial infection point |

| 14:00:10 | 💾 Installation (Dropping) | C:Tempsvchost.exe malicious file created | Attempt to masquerade as a legitimate file |

| 14:00:12 | ⚓️ Persistence | svchost.exe registered in Registry Run key | For automatic execution after reboot |

| 14:05:00 | 💥 Impact | Encryption of important documents (report.docx) started | Ransomware activity |

| 14:05:22 | 📞 C2 Communication | Attempted connection to external server (192.168.10.5) | Key transmission or command reception |

| 14:06:00 | 🧹 Cleanup | Attempted deletion of shadow copies | Disabling recovery |

2. 🎬 Incident Reconstruction Scenario (Narrative)

At 14:00:05, the initial infection began when the user executed malware.exe. The malware immediately, within 5 seconds, hid its replica in a temporary folder and registered it in the registry to ensure persistence.

After approximately 5 minutes of dormancy (or preparation), around 14:05, it began full-scale file encryption while simultaneously attempting to communicate with an external C2 server. Finally, at 14:06, it showed meticulousness by attempting to delete backup files to hinder user recovery.

The total attack duration was approximately 6 minutes, indicating a very fast and automated attack.

5. 💡 Analyst’s Insight (So What?)

This timeline generated by AI reveals important facts.

Dormancy Period (14:00 ~ 14:05):
There was a term of approximately 5 minutes from initial execution to encryption.
What if our security monitoring system had detected and blocked “registry changes” at 14:02? Encryption (14:05) could have been prevented! 🛡️
This timeline serves as a basis for establishing future security policies, such as “we need to reduce our detection and response time to within 5 minutes.”

🎉 Conclusion: The Scenario is Complete!

Congratulations! 👏

You have now gathered fragmented log pieces and completed a perfect incident scenario with a clear “beginning, development, turn, and conclusion”.

When it entered (14:00:05)
In what order it moved (Execution -> Installation -> Encryption)
How long it took (6 minutes)

This scenario becomes the core material for the ‘Executive Summary’ at the beginning of the report. Executives prefer a story like “It was infected at 14:00 and compromised in 5 minutes” rather than complex technical jargon.

Now, this is truly the final step.

Next time, we will combine all the results created so far (overview, detailed analysis, timeline, response plan) to “generate the final report file (PDF/Markdown)”.

Let’s stay together until the end so your analysis journey can have a wonderful conclusion! Fighting! 🚀📝