Parse and review DetectionHistory¶
From binary record to reviewable JSON¶
Locate the working record¶
Confirm the full path, numbered parent, GUID filename, and working-copy hash.
The preserved example uses a copied record below folder 22.
Parse the smallest useful scope¶
Start with one record when validating an examination. Quote every path and send output to a separate empty folder.
"C:\Tools\DHParser\dhparser.exe" -f "E:\Cases\SUSA-126\working\22\A3F2D9B1-42A7-4D8E-90F1-2C5B7A6E1104" -o "E:\Cases\SUSA-126\output"
For a controlled collection, select the directory mode that matches its naming:
rem Normal recursive directory with expected DetectionHistory names
"C:\Tools\DHParser\dhparser.exe" -rf "E:\Cases\SUSA-126\working\DetectionHistory" -o "E:\Cases\SUSA-126\output"
rem Greedy recursive directory for a trusted collection whose files were renamed
"C:\Tools\DHParser\dhparser.exe" -rgf "E:\Cases\SUSA-126\working\renamed" -o "E:\Cases\SUSA-126\output"
Greedy mode can attempt unrelated extensionless files. Constrain the input and preserve every success, skip, and error rather than reporting only the records that parsed cleanly.
Reconcile the run¶
Before opening JSON, capture the exact command and terminal output. Compare the expected input population with the parsed, skipped, and failed records.
Version, filename, origin, and SHA-256
Full working path, source hash, and expected record count
Exact quoted command and analyst start time
Discovered, parsed, skipped, failed, and elapsed values
Folder, JSON filename, size, SHA-256, and creation time
An exit message that says one file parsed is evidence about parser completion, not proof that every field is correct or that the detection represents executed malware.
Confirm and inspect the output¶
List the output folder and hash each result before substantive review.
dir "E:\Cases\SUSA-126\output"
certutil -hashfile "E:\Cases\SUSA-126\output\A3F2D9B1-42A7-4D8E-90F1-2C5B7A6E1104.json" SHA256
notepad "E:\Cases\SUSA-126\output\A3F2D9B1-42A7-4D8E-90F1-2C5B7A6E1104.json"
Historical evidence only
This preserved JSON screenshot contains a credential-dumping-tool detection. Do not recreate it by downloading harmful tooling. The Interactive Lab uses a safe EICAR training record instead.
Interpret fields without overclaiming¶
Defender classification recorded for the detection. Treat it as a lead, not independent malware validation.
Parsed from FILETIME and displayed in UTC. Keep UTC in notes and state any conversion separately.
Preserve the raw numeric value. Validate meaning against authoritative Defender context before claiming remediation.
Identify what Defender tracked. Check file-system, quarantine, and collection evidence for current or historical presence.
Useful identity context, but not proof that the named person knowingly performed the activity.
A recorded relationship to corroborate with process creation, Prefetch, Amcache, browser, and other endpoint evidence.
Corroboration path¶
Ask a focused case question before adding sources:
Compare Defender Operational events with protection or management telemetry.
Examine file-system metadata, quarantine state, hashes, and acquisition scope.
Test process evidence, Prefetch, Amcache, Shimcache, EDR telemetry, and event logs.
Check browser, email, archive, removable-media, and relevant network evidence.
Build a timeline and corroborate identity, session, device, and intent. Do not infer this from one user field.
Defensible wording
“DHParser v1.0.1 parsed the hash-verified working record and produced JSON containing a Defender threat label, tracked path, SHA-256, UTC tracking time, user field, and spawning-process field. This establishes retained Defender detection telemetry, not successful execution, remediation, or human intent.”
Troubleshooting¶
| Symptom | Check | Preserve |
|---|---|---|
| Access denied | Confirm that acquisition is authorised and parse an accessible working copy | Source path, acquisition notes, and error text |
| No file found | Check quotes, numbered folder, GUID filename, and current drive | Command, dir output, and working-copy hash |
| Some records fail | Reconcile input count and naming; use greedy mode only for a trusted renamed collection | Failed names, messages, and successful count |
| JSON appears incomplete | Verify source size and hash; compare raw record and known tool limitations | Parser version, affected field, and validation result |
| Time looks unexpected | Confirm UTC display, host time context, and conversion method | Raw parsed UTC and separately calculated local time |