'forensics' 검색 결과

Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating malware that runs only in memory
• Checking suspicious processes and network connections
• Investigating signs of credential theft

Review how evidence can be altered during authorized security exercises on Windows and Linux. Covers logs, timestamps, memory, disk records, and network traces, alongside the signs defenders use to detect manipulation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning authorized evidence manipulation tests
• Reviewing Windows and Linux forensic artifacts
• Checking detection coverage for altered evidence

Audit whether a paper's EVALUATION DESIGN actually measures what it claims and whether its reporting is complete — the validity layer family D (experiment-forensics) cannot reach. Three patterns: train/test leakage means the reported score may not measure generalization (HP-EVAL-LEAKAGE — adopts the Kapoor & Narayanan 8-type / 3-category leakage taxonomy; the illegitimate-proxy / sampling-bias / pretraining-contamination subtypes hand off as needs_external_check, naming but NEVER running Oren-2023 exchangeability / Shi-2023 Min-K% / Golchin-2023 Time-Travel / BIG-bench canary); a load-bearing LLM judge is conflicted (same model/family as a compared system) or unvalidated (no human-agreement, no bias control) (HP-JUDGE-VALIDITY); a declared condition/metric is dropped or switched to favor the method, or 'best' is chosen with no held-out set (HP-SELECTIVE-REPORTING). Verdict-bearing at L0/L1 from the DESCRIBED protocol — NOT repo-gated like experiment-forensics; L2 only CONFIRMS against split/preprocessing/result files. A fresh cross-model reviewer (gpt-5.6-sol xhigh, read-only, fresh thread per pass) PROPOSES findings, each span-anchored to a ledger claim_id; tools/adjudicate_findings.py DECIDES the verdict. Leakage and under-reporting are usually HONEST methodological errors — every finding describes a discrepancy to CHECK, never an accusation. An LLM generating GROUND-TRUTH labels is HP-FAKE-GT (experiment-forensics) — routed there, not here. Emits eval-design-forensics.findings.json; computes NO verdict. Detect-only. Triggers: "eval design audit", "evaluation validity", "train/test leakage", "data leakage", "is the score measuring generalization", "LLM judge bias", "is the judge validated", "selective reporting", "cherry-picked results", "评估设计审计", "评测有效性", "数据泄漏", "训练测试集泄漏", "裁判模型有没有验证", "选择性报告".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Digital forensics v3 — disk imaging, memory analysis, network forensics, chain of custody, legal

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, t...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit a paper for numerical inconsistencies and other research integrity concerns. Record findings tied to source passages, track corrections and human waivers, and translate the audit report into workflow blocking or warning decisions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking a paper for integrity concerns before submission
• Adding evidence-linked findings to a peer review
• Tracking corrections and human decisions on audit findings

Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and root cause analysis. References industry-standard tools including Splunk, ELK Stack, and Wireshark. Provides forensic workflow from initial evidence collection through final investigation report. Keywords: digital forensics, breach investigation, evidence preservation, chain of custody, root cause analysis, Splunk, ELK, Wireshark.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Family-G proof & derivation integrity forensics: does a THIRD PARTY's written proof/derivation actually establish its theorem, or does it skip an obligation, assume its own conclusion, take an invalid step, drift a symbol's meaning, or smuggle an unstated assumption? Decides from the WRITTEN proof/derivation — verdict-bearing at L1 (the LaTeX source; PDF-extracted math is unreliable, so an L0 PDF-only run surfaces info only) — never asserts 'fabricated', only that the step shown does not hold. A fresh cross-model reviewer reads the theorem/proof + an extraction-only obligation scaffold and proposes per-obligation findings, each span-anchored to the evidence ledger (claims.json); reviewer≠adjudicator. Emits proof-derivation-forensics.findings.json; NEVER computes the verdict. dimension=proof, can be critical. Triggers: "proof forensics", "check this proof", "derivation integrity", "audit the math", "证明审计", "推导有没有漏洞".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Citation-integrity forensics: is every reference real, correctly attributed, and used in a context the cited work actually supports? Catches hallucinated references (no paper at the claimed arXiv id/DOI/venue, fabricated authors/year), metadata drift (wrong year/venue/version), and wrong-context citations (a real paper cited for a claim it never makes — or argues against). A hot zone for machine-generated papers. Decidable at L0 (text + canonical sources). Span-anchored to the evidence ledger (claims.json); the executor gathers canonical facts (DBLP / arXiv / DOI), then one FRESH cross-model thread per cited key proposes findings; reviewer != adjudicator. Emits citation-forensics.findings.json; NEVER computes the verdict. Triggers: "citation forensics", "check the references", "hallucinated citations", "wrong-context citation", "verify references", "引用核对".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert en forensique numérique avancée (disk imaging, memory analysis, network forensics, reporting, chain of custody, incident response)

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert en forensique numérique (disk imaging, memory analysis, network forensics, chain of custody)

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze Chrome, Edge, and other Chromium browser profiles with Hindsight to reconstruct web activity. Combine browsing history, downloads, cookies, and other stored records into a chronological timeline, with XLSX, JSON, or SQLite output for investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstructing browsing activity during incident response
• Checking download times and source URLs
• Comparing cookies and history in insider threat investigations

Analyze captured RAM with Volatility to investigate suspicious processes, injected code, network connections, and other evidence of compromise. The skill guides memory investigations and organizes findings into timelines and reports, including malware traces absent from disk.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating fileless malware after an endpoint alert
• Finding hidden processes and injected code
• Linking suspicious processes to network connections

Acquire Linux memory with LiME and examine it using Volatility 3. Extract processes, network connections, command history, loaded kernel modules, and signs of injected code to support investigations of compromised Linux systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Acquiring memory from a compromised Linux system
• Comparing process lists to investigate hidden processes
• Reviewing command history and network connections

Investigate compromised Docker containers by preserving evidence and examining image layers, logs, file changes, and host settings. Summarize suspicious activity, security configuration issues, and vulnerability findings to support incident response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a compromised application container
• Examining a suspicious image from a registry
• Checking evidence of a container escape attempt

Check a paper's numerical consistency using fixed rules, then record blocking or warning decisions and outstanding findings. The workflow preserves a traceable correction history, while explicitly leaving broader semantic review unavailable in its Codex mode.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check numerical consistency before submitting a paper
• Record audit findings and required corrections
• Detect outdated audit reports after paper changes

Analyze disk images, file systems, and memory captures for digital evidence recovery in forensic investigations and CTF challenges. Use when the user mentions 'disk forensics,' 'forensic analysis,' 'disk image,' 'file carving,' 'deleted files,' 'evidence recovery,' 'timeline analysis,' 'memory forensics,' 'volatility,' 'autopsy,' 'sleuthkit,' 'plaso,' 'log2timeline,' 'artifact analysis,' 'chain of custody,' or needs to examine a forensic image.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security forensics for git repos, AI skills, and MCP servers. Audits dependencies, detects prompt injection, credential theft, runtime dynamism, manifest drift, known CVEs, CISA KEV (actively exploited) vulns, and 2026 attack patterns. Not for fixing vulnerabilities or pentesting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.