Zeroska
  • 🐱Zeroska - The Bold
  • Computer/Cyber Security
    • ⭐Fresh off the boat - for new Blue Teamer/ SOC Analyst
    • 💀Necromancer (DFIR)
      • 🕵️DFIR and DFIR case
        • 🗃️Case Files
          • Misconfiguration 0x01
      • 📔My own DFIR notes
        • The Mark of The Web (MOTW)
        • LNK Shortcut
        • Prefetch, AmCache, ShimCache in Windows
        • Malicious Document (VBA, Office, PDF, ...)
        • SRUM (System Resource Usage Monitor)
        • Volatility notes
        • Understand Logon Session in Windows
        • "Very" Hidden sheets in Excel
        • Hidden Processes
      • 📔Notes
        • Useful Resources
        • Useful Resources DFIR
        • Saved Content (Backup for the OG content get deleted)
          • How to be best SOC analyst ever
    • 🧙‍♂️Defense Witchcraft
      • Data Analysis as a Defender
      • Active Directory
      • Windows Event Logs
        • Authentication (Windows Account Life Cycle Events)
      • MS Exchange
      • Windows
    • 💙My Current Blue Team Operation
      • VLAN Monitoring Template
      • Daily Monitoring Report
      • General Playbook
      • JupyterHub Configuration Guide
      • How to train your Blue Team
    • 🏭ICS/OT
      • Setup ICS/OT Simulation Learning Lab
      • Smart Grids
      • Learning Modbus TCP
      • Learning DNP3
      • Resources/Blogs/Links
    • 🥷Threat Intelligence
      • Small Cyber Threat Intelligence Program
      • Intelligence Analysis [VN]
      • OSINT Information Monitoring
        • Telegram Info-Stealer Monitoring
      • C2 Tracker
      • Fake Website Tracker
      • Dark Web Investigation Attempt
      • Threat Intelligence Quick Win
      • Resources/Blogs/Links
  • 😒Computer and Technology
    • My Home Lab Setup
    • 🐴ELK Stack
      • Useful Resources
      • ELK Stack - Container - Docker Compose - AWS ECS
      • ECS - Elastic Common Schema
      • Elasticsearch
      • Logstash
      • Troubleshooting and Problems
    • 🐧Linux
      • Setting up good SSH Authentication
      • Configure Auditd and how to leverage it
      • ELF Format
      • Useful Links
    • 📦Containers
      • Docker container logs is quite big
      • Worth Reading
    • 🪠Splunk Learning Experience
      • Splunk Test Lab
      • Data Collection Tier (How to get the data)
      • SC4S Custom Filter For Windows Event Log in Syslog Format (NXLog)
      • Useful Resources
  • Threat Hunting
    • Hunting for Implant
    • Using STRIDE and DREAD
    • 🐳Predators and Preys (Computing)
      • Tracks or Hunting Artifacts
    • 📦Network Packet Analysis
      • The Basic
      • Tshark | Zeek Copy & Paste
      • Network Analysis Resources
    • Grep | Powershell Search | Regex
    • Hunting Resources
  • 🎵In my remains
    • Choices
    • The Art of Facing Unknown Problems
    • Build the best DFIR team
    • Reverse Engineering - Đồ án hướng ngành A "Hụt" của tôi
Powered by GitBook
On this page

Was this helpful?

  1. Computer/Cyber Security
  2. Necromancer (DFIR)
  3. Notes

Useful Resources DFIR

Mostly blog and some youtube channel that I found on the internet

PreviousUseful ResourcesNextSaved Content (Backup for the OG content get deleted)

Last updated 2 years ago

Was this helpful?

Blogs

  • (Slide about DFIR using vol 2)

  • (handles, processes, and tokens)

  • (Cheatsheet about Windows Processes)

  • (unlink a LIST_ENTRY from ActiveProcessLinks List)

  • (Good blog about security)

  • (Volshell and ActiveProcessLinks List)

  • (Good blog to follow)

  • (Just more good blog to follow)

  • (Workflow)

  • (Windows Digital Forensic)

  • (THE BEST DFIR Blog)

  • (Excellent resources)

  • (command and cheat sheet for AD)

  • (DFIR Process - Guru stuff)

DFIR Challenge Site

Tools

Check these tags on Twitter for more scenarios

(Network Forensic)

(Windows Processes Search)

(MS File Definition Search)

(Cheat Sheet)

(Memory Acquisition)

(explain very well about the forensic topic)

💀
📔
https://docs.google.com/presentation/d/1N7RJ3yCJEJ0xfU12KFQW9I-c8Hu65QHgKgETVVTfY98/edit#slide=id.p
https://www.tophertimzen.com/resources/cs407/slides/week02_02-Processes.html#slide1
https://rstforums.com/forum/topic/85091-know-your-windows-processes-or-die-trying/
https://www.aldeid.com/wiki/LIST_ENTRY
https://www.aldeid.com/wiki/Main_Page
https://eforensicsmag.com/windows-process-internals-a-few-concepts-to-know-before-jumping-on-memory-forensics-by-kirtar-oza/
https://forensic4cast.com/
https://digiforensics.blogspot.com/
https://laskowski-tech.com/2019/02/18/volatility-workflow-for-basic-incident-response/
http://windowsir.blogspot.com/
https://aboutdfir.com/
https://www.appliedincidentresponse.com/resources/
https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/
https://chocolatecoat4n6.com/2022/10/27/investigation-framework-1-scoping/
https://www.honeynet.org/category/challenge/
https://downloads.digitalcorpora.org/corpora/scenarios/magnet/
https://winprocs.dfir.tips/
https://www.file.net/
https://www.jaiminton.com/cheatsheet/DFIR/#
https://github.com/Velocidex/WinPmem
https://www.youtube.com/c/13cubed
#InvestigationPath