Windows Execution Artifacts (Part 2)
In this hands-on lab, you will learn to discover and analyze artifacts generated by execution in Windows systems. You will practice identifying evidence of execution under specific conditions and attributing that evidence to user accounts. Part 2 of 2.

Course Content
Upon completing this lab, you should be able to:
- List and describe common locations on a system where evidence related to execution can be found.
- Given a set of criteria (file name, user account, etc.), identify evidence relating to executable files and their potential activity.
- Attribute specific execution artifacts to user accounts where possible.