'forensics' 검색 결과

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.