Windows and Linux Threat Hunting
9 May 2021
24 October 2021
Table of Contents
Windows and Linux Threat Hunting
- Windows ASEPs
- https://cyberforensicator.com/2019/04/25/characteristics-and-detectability-of-windows-auto-start-extensibility-points-in-memory-forensics/
- https://www.sans.org/blog/offline-autoruns-revisited-auditing-malware-persistence/
- https://www.sans.org/blog/offline-autoruns-revisited-auditing-malware-persistence/
- Windows 11 Artifacts
- Prefetch
- Link Files
- Jumplists
- Recycle Bin
- Amcache
- AppCompatCache
- Registry
- Event Logs
- https://github.com/EricZimmerman?tab=repositories
- Persistence
AuditD
shadow files
btrfsecryptfsext2ext3ext4fusefuseblkjfsnfsoverlayramfsreiserfstmpfsudfvfatxfs
Research
- Threat Hunting Using Sysmon
- Sigma Fall of Fame
- rockstarL
- Install MITRE ATT&CK Navigator in an isolated environment 14 January 2022
- Digital Legacy and your last will and testament 4 January 2022
- OSINT CSI Linux TraceLabs 27 November 2021
- LoRa messenger for secure, off-the-grid communication 21 November 2021
- Bitcoin - Arbitrage and Algo Trading 16 October 2021