1.1 collect
1.2 triage
| Evidence |
Tool |
Description |
| 💿 Harddisk image |
sleuthkit, doc |
Forensics tools to investigate volume and file system data: img_stat, mmls, ils, blkls, fls, fsstat |
| 📂 NTFS METAfiles |
analyzeMFT, MFTExplorer |
ADS, Anti-forensics (SNI,FN), Downloads from the internet. Process($LogFile, $UsnJrnl, AmCache) & Network Acivity ($LogFmt). |
| 📃 Logs Security KDC |
LogonTracer |
Generates graphs of the Logons Activity. |
| 📃 Logs Security Windows |
evtx_dump, fd, timeline explorer |
Multi-threaded EVTX parser supporting both XML and JSON EVTX. |
| 🖥️ Live Windows |
cmd, powershell |
PSsession, WinRegistry, ADQuery, Transfer with Powershell, Logs. |
| 🖥️ Live Linux |
bash, bash2, logs |
bash and logs manipulation. |
| 🌐 Web browsing |
hindsight |
chromium, firefox, safari. |
| 👾 File OLE |
/dfir/mlw/ole |
editing in progress… |
| 👾 File PDF |
/dfir/mlw/pdf |
Cheatsheet for dist67/malicious PDF workshop with ‘pdfid.py’ and ‘pdf-parser.py’ tools. |
| 👾 File LNK |
/dfir/mlw/lnk |
editing in progress… |
| 👾 File PNG |
/dfir/mlw/png |
editing in progress… |
| 👾 ADS Motw |
PS live: Get-Item, Get-Content -Stream |
Covers also, bypass with softwares unsupporting-ADS (7Z,CSPROJ) & container files (ISO,VHD). |
2. kb
| Operating System |
KnowledgeBase (KB) |
Description |
| 📃 Windows |
Project Windows Events |
ARTIFACT: Exhaustive artifacts list tagged with categories: File Download, Program Execution, Deleted File or File Knowledge, Network Activity, Physical Location File/Folder, Opening Account, Usage External Device/USB, Usage Browser Usage. |
| 📃 Windows |
UltimateWindowsSecurity |
LOGS: Encyclopedia for the Windows Security Logs. |
| 🗑️ Windows |
STRONTIC |
EXE: First place to look for what is a binary about. |
| 🗑️ Windows |
Project Windows Drivers |
SYS: CuratedList of LOL drivers used adversaries to bypass sec contorlsand carry out attacks. |
| 🗑️ Windows |
Project LOLBAS |
LOLBAS: Windows LOLBAS offensive security techniques used for download, execute and bypass. |
| 🗑️ Windows |
Project wadcoms |
AD: Windows/AD offensive security techniques. |
| 🗑️ Windows |
Project Hickjack Libs |
LIB: … |
| 🗑️ Windows |
csandker.io - redteam TTPs over Windows Named Pipes |
PIPES: Advanced project on security informations regarding Windows Named pipes. |
| 🐧 Linux |
Project GTFO |
GTFO: Linux GTFO offensive security techniques used for download, execute and bypass. |
| 🐧 Linux |
explainshell |
SHELL: explain command-lines FU. |