Forensics Investigation and Malware Analysis · Topic 2 of 3
Investigating Application, Email and Insider Incidents
Learn how to investigate web application attacks, email headers and phishing, and insider incidents with logs and endpoint data for the CSA 312-39 exam.
- 5 min
- The web access log shows IP, time, request, status code and size for every request.
- Read Received headers from bottom to top; From is easy to forge.
- The Message ID helps find every copy of a phishing email in mail logs.
What it is
Investigation goes beyond response. Response stops the incident; investigation reconstructs exactly what happened so the root cause is fixed and the findings can support legal, HR or regulatory action.
This page covers three common cases: attacks on applications, attacks delivered by email, and incidents caused by insiders. Each has its own key evidence sources.
How it works
Investigating application security incidents
Start with the web server access log, which records each request. In the Common Log Format a line holds the client IP, the user identity fields, the timestamp, the request line (method, path, protocol), the status code and the response size.
| Evidence | What to look for |
|---|---|
| Web server access logs | Attack strings in URLs or parameters, scanning patterns, status codes |
| Web server error logs | Application errors triggered by malformed input |
| WAF logs | Blocked and allowed attack patterns, rule names |
| Application logs | Logins, privilege changes, business actions taken |
| Database logs | Unusual queries, bulk reads, schema changes |
| File system | New or changed scripts in web folders (web shells) |
Useful status codes: 200 OK (request succeeded), 301/302 redirects, 401 unauthorized, 403 forbidden, 404 not found, 500 internal server error. A run of 500 errors on one parameter followed by a 200 often marks an injection attempt that finally worked.
The investigator answers: which vulnerability was used, from which IPs, starting when, which data was read or changed, and whether persistence such as a web shell was left behind.
Investigating email security incidents
The message header is the core evidence. Get the original message, with full headers, from the mail system or the user.
| Header field | Investigation use |
|---|---|
| Received | Each mail server hop; the bottom entry is closest to the sender |
| From | Displayed sender, easy to forge |
| Reply-To | Where replies go; a mismatch with From is suspicious |
| Return-Path | Bounce address, used for SPF checking |
| Message-ID | Unique ID, useful to search mail logs for every copy |
| Authentication-Results | SPF, DKIM and DMARC pass or fail |
Then examine links (lookalike domains, redirects) and attachments (file hash, sandbox report). Mail gateway logs show who else received it, and proxy and endpoint logs show who clicked or opened the file.
Investigating insider incidents
Insiders use valid accounts, so the investigation focuses on what a person did and whether it was authorized.
| Evidence | What it shows |
|---|---|
| Authentication logs | When and where the user logged on (Windows event IDs 4624 and 4625, logon type) |
| File access auditing | Files opened, copied or deleted (event ID 4663 when auditing is enabled) |
| USB and device logs | Removable storage connected |
| DLP alerts | Sensitive data sent by email, web upload or USB |
| Email and cloud logs | Forwarding to personal accounts, sharing links |
| Endpoint and EDR data | Programs run, archives created, deleted files |
| Physical access logs | Badge entries outside normal hours |
The investigator builds a timeline linking the person to each action, compares it with job duties and policy, and keeps findings strictly need to know. HR and legal decide what monitoring is allowed and how results are used.
Building the timeline
Every investigation ends in a timeline: a time ordered list of events from all sources, normalized to one time zone. It shows the first sign of compromise, each step of the attack and the last attacker activity.
A worked example
A customer database appears on a paste site. Web logs show a series of requests with SQL injection strings from one IP, with HTTP 500 errors for an hour and then several 200 responses with very large response sizes.
Database logs confirm bulk reads from the customer table at the same time. The investigator reports the vulnerable parameter, attacker IP, exact time window and records exposed, which drives the code fix and breach notification.
How the exam asks about this
- "Which email header entry is closest to the true sender?" → The bottom Received header.
- "Web logs show many HTTP 500 responses on one parameter followed by 200 responses with large sizes. What does this suggest?" → A successful injection attack after trial and error.
- "Which Windows event ID records an attempt to access an audited file?" → 4663.
What to remember for the exam
- The web access log shows IP, time, request, status code and size for every request.
- Read Received headers from bottom to top; From is easy to forge.
- The Message ID helps find every copy of a phishing email in mail logs.
- Insider investigations link a person to actions with logon, file, USB, DLP and EDR evidence.
- A normalized timeline across sources is the core result of any investigation.
File access event ID 4663 only appears if object access auditing is enabled on that file or folder. No audit policy means no record.
Common mistakes
Trusting the From line. It is set by the sender; authentication results and Received headers tell the truth.
Using only the WAF log. It shows blocked attempts but not what the application and database actually returned.
Investigating an insider without HR and legal. Unauthorized monitoring can make evidence unusable and create legal risk.
Check yourself
Which status code pattern hints that a web attack succeeded?
Errors such as 500 during probing, then 200 responses with unusually large sizes for the same request.
Why is the Message ID useful in a phishing investigation?
It uniquely identifies the message so mail logs can find every recipient of the same email.
What is the final product of an investigation?
A time ordered timeline and report that explains how the incident happened, its scope and its root cause.
Topic 2 of 3 in Forensics Investigation and Malware Analysis
Test yourself on Forensics Investigation and Malware Analysis
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.