DHParser Hands-on Labs

Choose the Interactive Lab to practise a complete single-record examination in the browser. Use the Full Lab to process instructor-provided evidence in an isolated Windows VM and preserve a reviewable case package.

Interactive Lab

Full Lab

Isolated Windows VM · Setup: 20–30 min · Exercise: 60–100 min

DHParser Full Lab

Authorised DetectionHistory evidence required

Hands-on Defender DetectionHistory forensics

Verify it. Parse it. Bound the finding.

Work from a case-controlled binary record to a reproducible JSON result. Use Command Prompt to run DHParser, Notepad to locate key fields, and independent sources to separate Defender detection telemetry from execution and intent.

⏱ Setup: 20–30 min · Exercise: 60–100 min◆ Guided beginner✓ Evidence required

Start the Full Lab

Outcome-led, not screenshot-led

Work to the checkpoints and expected evidence. Paths, Defender records, and parser messages can differ by collection and version, so record meaningful differences instead of forcing the supplied result.

Use supplied or authorised evidence

Do not download malware or credential-dumping software to create a record. Use the instructor-provided DetectionHistory set or an approved benign test artefact in a disposable and isolated VM.

Before you begin

You need: an instructor-provided DetectionHistory tree and manifest, a Windows analysis VM, DHParser v1.0.1 or an approved build, Command Prompt, Notepad, and an approved SHA-256 utility.

How to use this lab

Stop at a milestone when a hash, input count, parser message, or output cannot be reconciled. Resolve that boundary before interpreting the JSON.

Recommended first

Beginner Core Lab

Verify one working record, run a single-file parse, review seven fields, and write a bounded finding.

Expected time: 60–100 minutes across three activities.

Optional extension

Execution hypothesis

Test whether independent process or execution artefacts support the tracked path during the relevant time window.

Expected time: one additional analysis session.

1. Session 1Verify inputs
2. Session 2Parse and review
3. Session 3Corroborate and report

Objective

Case SUSA-126 contains an endpoint collection with a Defender DetectionHistory record created after a safe EICAR test file appeared in LAB\mira's Downloads folder on LAB-WIN11. Produce a reviewable package that connects the acquired binary record to parsed JSON and a bounded finding. A second analyst must be able to reproduce the command and distinguish observed fields from inference.

Case fact	Starting information
Case	SUSA-126
Host	LAB-WIN11
User context	LAB\mira
Source	Acquired Defender DetectionHistory tree
Working record	Numbered folder 22, supplied GUID file
Report window	2026-08-26 03:00:00 to 03:30:00 UTC

01

Activity 1: Establish the evidence boundary

1. Create separate source, working, output, and notes folders inside the case directory.
2. Record the acquired record's original host path, numbered parent folder, GUID filename, acquisition method, and source SHA-256.
3. Copy the record to working without changing its relative parent and filename.
4. Hash the working copy and confirm that it matches the source manifest.
5. Confirm that the output folder is empty before the run.
6. Hash dhparser.exe and record its source, filename, size, and displayed version.

Milestone 1Boundary verifiedOne protected source maps to one matching working copy, one empty output folder, and one attributable parser executable.

Expected result The source and working SHA-256 values match and no parser-created file is mixed with acquired evidence.

02

Activity 2: Parse and validate the record

1. List the working record with dir and retain the numbered folder and GUID filename in the case note.
2. Build a quoted command using -f for that one GUID record and -o for the empty output folder.
3. Record the exact command before running it.
4. Run DHParser and preserve its version, discovered path, parsed count, skipped or error messages, elapsed time, and output location.
5. Reconcile one expected input with the parser's reported population.
6. List and hash the generated JSON, then verify that its GUID filename maps to the binary source.
7. Open the JSON in Notepad and use Edit > Find to locate the threat name, tracking time, path, SHA-256, status ID, user, and spawning process.

Milestone 2Parse reproducedThe exact command and complete messages map a verified working record to one hashed JSON result.

Expected result The expected, parsed, skipped, and failed populations reconcile and all seven fields are recorded exactly as displayed.

03

Activity 3: Corroborate and report

1. Create an observation table containing field name, exact value, source JSON, and whether each statement is observed or inferred.
2. Preserve ThreatTrackingStartTime in UTC. Record any local-time conversion separately with its zone and method.
3. Keep ThreatStatusID as a raw observed value until an authoritative Defender source establishes its meaning in this context.
4. Compare the record with available Defender Operational events, protection or quarantine data, file-system evidence, and process evidence.
5. State whether each source supports, conflicts with, or cannot test the execution hypothesis.
6. Write a finding that identifies what Defender recorded and lists what remains unproven.

Milestone 3Finding boundedThe note separates retained Defender telemetry from execution, remediation, human attribution, and intent.

Expected result Another analyst can reproduce the parse, verify the output, and understand why the conclusion stops at detection-record level.

Test the execution hypothesis

Use one independent source such as process-creation telemetry, Prefetch, Amcache, or EDR data. Record whether it supports, conflicts with, or cannot test execution of the tracked path. Absence is meaningful only when that source was expected, retained, and collected for the relevant window.

Full Lab evidence checklist

This checklist applies to the VM-based Full Lab. If you completed the Interactive Lab, retain its downloaded evidence summary instead.

• Core completion

  Required to connect acquired evidence, parser execution, JSON, and conclusion.

  • Original path, numbered folder, GUID filename, acquisition method, and source SHA-256.
  • Working-copy SHA-256 matched to the source manifest.
  • DHParser source, version, filename, size, and SHA-256.
  • Exact command and complete parser messages.
  • Expected, parsed, skipped, and failed counts reconciled.
  • JSON filename, size, timestamp, and SHA-256.
  • Seven key fields recorded with source UTC preserved.
  • Supported finding with execution, remediation, attribution, and intent limitations.

• Good analyst practice

  Records that strengthen independent review.

  • At least one independent source assessed against a named hypothesis.
  • Working and output folders retained or disposed of under case policy.

0 of 10 recorded Mark each item when you have saved the evidence.Reset

Troubleshooting

Symptom	First check
Working hash differs	Stop before parsing; confirm the copied record, acquisition manifest, and hashing method.
Access denied	Confirm authority and parse an accessible working copy rather than the live protected tree.
Record is not discovered	Check quotes, numbered folder, GUID filename, current drive, and selected parsing mode.
Parsed count differs	Preserve every message and reconcile renamed, skipped, malformed, or unrelated files.
JSON field is missing	Confirm source size and hash, parser version, record variation, and known tool limitations.
Time appears unexpected	Preserve parsed UTC and document the host time context and any conversion separately.

Clean up

Protect the source, parser log, hashes, JSON, focused notes, and conclusion under case policy. Remove disposable training output only after retention is confirmed and restore the isolated VM to its approved snapshot when appropriate.

PreviousParse and reviewNextReturn to the DHParser overview