Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using (SKILL.md metadata excerpt)
Setup not establishedSource observation · Source example · File structure observedCheck method & evidence →