252건 · 관련도순
Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting. Inspired by RAPTOR's 1800+ line OSS Forensics system.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics, or cloud identity compromise.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies wallet clusters, tracks fund movement through mixers and exchanges, and supports law enforcement attribution. Activates for requests involving ransomware payment tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence gathering.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Investigate how compiled or obfuscated programs work, including binaries, APKs, WASM, and firmware. Combine file inspection, decompilation, and observed execution to understand control flow, validation logic, and mechanisms that hinder analysis.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Research private companies through six perspectives, including business, finances, competition, and technology. Cross-check evidence, separate facts from inferences, and produce a valuation range, possible exit routes, and a map of missing information.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze DNS logs for signs of hidden command traffic and data theft. Use character randomness, query timing, TXT record inspection, and machine learning to identify suspicious domains and support security monitoring rules.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Examine recorded calls and voicemails for signs of AI-generated speech. Extract acoustic features, classify samples with machine learning, and prepare reports with confidence scores and sound visualizations to support voice impersonation investigations.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Build a shared incident timeline in Timesketch from endpoint, server, and cloud logs. Search events, add tags and investigator notes, reconstruct the attack sequence, and organize findings into a story for incident reporting.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.