Windows and Linux Threat Hunting

Table of Contents

Windows ASEPs
- https://cyberforensicator.com/2019/04/25/characteristics-and-detectability-of-windows-auto-start-extensibility-points-in-memory-forensics/
- https://www.sans.org/blog/offline-autoruns-revisited-auditing-malware-persistence/
- https://www.sans.org/blog/offline-autoruns-revisited-auditing-malware-persistence/
Windows 11 Artifacts
- Prefetch
- Link Files
- Jumplists
- Recycle Bin
- Amcache
- AppCompatCache
- Registry
- Event Logs
- https://github.com/EricZimmerman?tab=repositories
Persistence
- https://pentestlab.blog/methodologies/red-teaming/persistence/

AuditD

shadow files

Research