Windows Prefetch: what it proves, and what it does not
Prefetch at the byte level: the SCCA header, MAM compression, the path hash, run times and volumes, with working Python and the limits to state in a report.
Tagged “Incident response”
4 posts
-
-
Reading Windows logon types in event 4624
Logon types, the 4624 fields that change the reading, 4625 failure codes, following a Logon ID through a session, and queries for PowerShell, wevtutil and KQL.
-
Detailed Guide to Detecting and Analyzing a Kerberoasting Attack in Active Directory Using Splunk
Detecting and investigating a Kerberoasting attack on Active Directory in Splunk, from the attack steps to the event 4769 fields that give it away.
-
Comprehensive Guide to Malware Analysis: Investigating Malicious RTF Files Using REMnux
A step-by-step analysis of a malicious RTF document on REMnux with rtfdump, rtfobj and scdbg, from embedded objects to the shellcode they carry.