Debugging

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution,

'Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download

'Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry

Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration,

'Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

'Analyzes network traffic generated by malware during sandbox execution or live incident response to identify

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation,

Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments,

'Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode,

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns,

Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence

Identify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs)

Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations

Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable

'Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and

'Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies,

'Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous