1. tools
1.1 collect
| Evidence | Tool |
|---|---|
| 💿 Harddisk image | guymanager, dc3dd |
| 🖥️ Live Windows | dfir-orc, doc |
| 🖥️ Live Windows | KAPE |
| 🖥️ Live Windows | fastir |
1.2 triage
| Evidence | Tool | Description |
|---|---|---|
| 💿 Harddisk image | sleuthkit, doc | Forensics tools to investigate volume and file system data: img_stat, mmls, ils, blkls, fls, fsstat |
| 📂 NTFS METAfiles | analyzeMFT, MFTExplorer | ADS, Anti-forensics (SNI,FN), Downloads from the internet. Process($LogFile, $UsnJrnl, AmCache) & Network Acivity ($LogFmt). |
| 📃 Logs Security KDC | LogonTracer | Generates graphs of the Logons Activity. |
| 📃 Logs Security Windows | evtx_dump, fd, timeline explorer | Multi-threaded EVTX parser supporting both XML and JSON EVTX. |
| 🖥️ Live Windows | cmd, powershell | PSsession, WinRegistry, ADQuery, Transfer with Powershell, Logs. |
| 🖥️ Live Linux | bash, bash2, logs | bash and logs manipulation. |
| 🌐 Web browsing | hindsight | chromium, firefox, safari. |
| 👾 File OLE | /dfir/mlw/ole | editing in progress… |
| 👾 File PDF | /dfir/mlw/pdf | Cheatsheet for dist67/malicious PDF workshop with ‘pdfid.py’ and ‘pdf-parser.py’ tools. |
| 👾 File LNK | /dfir/mlw/lnk | editing in progress… |
| 👾 File PNG | /dfir/mlw/png | editing in progress… |
| 👾 ADS Motw | PS live: Get-Item, Get-Content -Stream | Covers also, bypass with softwares unsupporting-ADS (7Z,CSPROJ) & container files (ISO,VHD). |
2. kb
| Operating System | KnowledgeBase (KB) | Description |
|---|---|---|
| 📃 Windows | Project Windows Events | ARTIFACT: Exhaustive artifacts list tagged with categories: File Download, Program Execution, Deleted File or File Knowledge, Network Activity, Physical Location File/Folder, Opening Account, Usage External Device/USB, Usage Browser Usage. |
| 📃 Windows | UltimateWindowsSecurity | LOGS: Encyclopedia for the Windows Security Logs. |
| 🗑️ Windows | STRONTIC | EXE: First place to look for what is a binary about. |
| 🗑️ Windows | Project Windows Drivers | SYS: CuratedList of LOL drivers used adversaries to bypass sec contorlsand carry out attacks. |
| 🗑️ Windows | Project LOLBAS | LOLBAS: Windows LOLBAS offensive security techniques used for download, execute and bypass. |
| 🗑️ Windows | Project wadcoms | AD: Windows/AD offensive security techniques. |
| 🗑️ Windows | Project Hickjack Libs | LIB: … |
| 🗑️ Windows | csandker.io - redteam TTPs over Windows Named Pipes | PIPES: Advanced project on security informations regarding Windows Named pipes. |
| 🐧 Linux | Project GTFO | GTFO: Linux GTFO offensive security techniques used for download, execute and bypass. |
| 🐧 Linux | explainshell | SHELL: explain command-lines FU. |