Tags

Every page is tagged by type (artifact, tool, technique, concept, playbook) and section. Click a tag to see related pages.

active-directory

• Day 4 — Responder, Internet Allow Listing, Vulnerability Management, Web Security and AD Hardening
• Lateral Movement & Domain Compromise

adversary

• AD Certificate Services Abuse (ESC1 / ESC8)
• AS-REP Roasting
• DCSync
• EternalBlue & SMBv1 Exploitation
• Golden, Silver Tickets & Pass-the-Ticket
• Hardening by Windows Version
• Impair Defenses & Log Clearing
• Kerberoasting
• LLMNR/NBT-NS Poisoning & NTLM Relay
• LOLBins — Signed Binary Proxy Execution
• LSASS Credential Dumping
• Pass-the-Hash
• Persistence — Services, Tasks, Run Keys
• Phishing Delivery & Initial Execution
• PowerShell Download Cradles & Encoded Commands
• PrintNightmare & Print Spooler Abuse
• Process Injection
• PsExec & SMB Lateral Movement
• RDP — Remote Desktop Abuse
• SAM, LSA Secrets & NTDS.dit Extraction
• Token Impersonation & Potato Attacks
• UAC Bypass
• WMI & WinRM Execution

adversary-emulation

• Day 3 — EDR, Threat Emulation and Host Firewalls

analysis

• Attack Stages over HTTP, Choosing an Analysis Method, URL Reputation
• Base64 — How It Works, Recognising It, Suspicious Base64
• Finding Malware through User-Agents and Cookies
• Judging Requests — Checklist, Exploit Kits, URLs inside URLs
• Malicious Files on Good Sites, File Extraction, Frequent Requests, Bare-IP Connections
• Screenshots, Sandboxes, and When to Go Manual

antisyphon

• Day 1 — Allow Listing and Password Attacks
• Day 2 — Egress Traffic Analysis and Logging
• Day 3 — EDR, Threat Emulation and Host Firewalls
• Day 4 — Responder, Internet Allow Listing, Vulnerability Management, Web Security and AD Hardening

application-allowlisting

• Day 1 — Allow Listing and Password Attacks

apt

• North Korea (DPRK) — Groups & Incidents
• North Korea — TTPs & Hunting

arkime

• Arkime
• Arkime Search Syntax
• Intrusion Detection with Arkime

artifact

• $MFT, $UsnJrnl & $LogFile
• Amcache
• Authentication & Shell History
• Filesystem & Timestamps
• LNK Files & Jump Lists
• Linux Persistence
• Logs, Processes & Live Triage
• Prefetch
• Registry Keys for DFIR
• SRUM
• Shimcache (AppCompatCache)
• Windows Event Logs (EVTX)
• conn.log
• dns.log
• files.log & pe.log
• http.log
• ssl.log & x509.log

basics

• Essential Linux Commands
• HTTP Status Codes
• Well-Known Ports
• Windows Event IDs

beaconing

• Day 2 — Egress Traffic Analysis and Logging

blue-team

• Attack Stages over HTTP, Choosing an Analysis Method, URL Reputation
• Base64 — How It Works, Recognising It, Suspicious Base64
• Blockchain DNS and IDNs (Punycode)
• Blue Team Essentials
• DNS
• DNS Abuse — Unauthorised DNS, Shared Hosting, Record Tampering, Tunnelling
• DNS Log Collection and Safe Investigation
• Domain Signals — TLD, Reputation, Age, Randomness, ASN, Geolocation
• Encrypted DNS — DoT, DoH, DoQ, DNSSEC and Collection Strategy
• Finding Malware through User-Agents and Cookies
• HTTP
• HTTP(S) Analysis & Attacks
• HTTPS — TLS Decryption, Working Without It, Reading Certificates
• Header Reading Practice — One Request, One Response
• Judging Requests — Checklist, Exploit Kits, URLs inside URLs
• Malicious Files on Good Sites, File Extraction, Frequent Requests, Bare-IP Connections
• New HTTP Standards — HTTP/2, HTTP/3/QUIC, WebSocket, and HTTP Wrap-up
• POST, Other Methods and Request Headers
• Response Headers and Status Codes
• Screenshots, Sandboxes, and When to Go Manual
• Spotting Exploit Kits, and Malicious/Suspicious/Benign Practice
• Suspicious DNS Triage Sheet · Corrections · Common Confusions
• TLS Fingerprints (JA3, JA3S, JARM, JA4), TLS 1.3, and the HTTP(S) Analysis Wrap-up
• Understanding DNS — Structure and Records
• Web Servers, URLs and GET

botsv3

• BOTSv3 Investigation Workflow

bpf

• Lesson 1.7 — Selecting Only the Packets You Need with BPF

c2

• Beaconing & C2 Detection

carving

• 1.13 — Lab Guide: Carving Exfiltrated Data

cheatsheet

• Arkime Search Syntax
• Eric Zimmerman Tools
• SPL Cheat Sheet
• Suspicious DNS Triage Sheet · Corrections · Common Confusions

cloud

• Account Compromise & BEC

cobalt-strike

• 3.1 Architecture and command behavior
• 3.2 Sessions and file systems
• 3.3 Processes and collection
• 3.4 Execution and external tools
• 3.5 Modern defense and review
• Post-Exploitation

collection

• Disk & Memory Imaging
• KAPE
• Velociraptor

concept

• Beaconing & C2 Detection
• Credentials, Registry & Rootkits
• DNS Log Collection and Safe Investigation
• Data Discovery & Time
• Domain Signals — TLD, Reputation, Age, Randomness, ASN, Geolocation
• Encrypted DNS — DoT, DoH, DoQ, DNSSEC and Collection Strategy
• Essential Linux Commands
• HTTP Status Codes
• Hunting Patterns in SPL
• Intrusion Detection with Arkime
• New HTTP Standards — HTTP/2, HTTP/3/QUIC, WebSocket, and HTTP Wrap-up
• POST, Other Methods and Request Headers
• Processes & Code Injection
• Response Headers and Status Codes
• Understanding DNS — Structure and Records
• Web Servers, URLs and GET
• Well-Known Ports
• Windows Event IDs
• rex, Field Extraction & eval

credential-access

• AD Certificate Services Abuse (ESC1 / ESC8)
• AS-REP Roasting
• Credentials, Registry & Rootkits
• DCSync
• Golden, Silver Tickets & Pass-the-Ticket
• Kerberoasting
• LLMNR/NBT-NS Poisoning & NTLM Relay
• LSASS Credential Dumping
• Pass-the-Hash
• SAM, LSA Secrets & NTDS.dit Extraction

defense-evasion

• Impair Defenses & Log Clearing
• LOLBins — Signed Binary Proxy Execution
• PowerShell Download Cradles & Encoded Commands
• Process Injection
• UAC Bypass

detection

• North Korea — TTPs & Hunting
• Purple-Team Weekly Loop

dfir

• Plaso & Super-Timelines
• Velociraptor
• Volatility 3 Workflow

dns

• Blockchain DNS and IDNs (Punycode)
• DNS
• DNS Abuse — Unauthorised DNS, Shared Hosting, Record Tampering, Tunnelling
• DNS Log Collection and Safe Investigation
• Domain Signals — TLD, Reputation, Age, Randomness, ASN, Geolocation
• Encrypted DNS — DoT, DoH, DoQ, DNSSEC and Collection Strategy
• Suspicious DNS Triage Sheet · Corrections · Common Confusions
• Understanding DNS — Structure and Records
• dns.log

dnssec

• Encrypted DNS — DoT, DoH, DoQ, DNSSEC and Collection Strategy

doh

• Encrypted DNS — DoT, DoH, DoQ, DNSSEC and Collection Strategy

dprk

• North Korea (DPRK) — Groups & Incidents
• North Korea — TTPs & Hunting

edr

• Day 3 — EDR, Threat Emulation and Host Firewalls

egress

• Day 2 — Egress Traffic Analysis and Logging

encryption

• 1.12 — Challenges and Opportunities in Network Investigations

enrichment

• Domain Signals — TLD, Reputation, Age, Randomness, ASN, Geolocation

evidence-acquisition

• 1.11 — Evidence Acquisition: Where and With What Do We Collect Packets?

execution

• Amcache
• LOLBins — Signed Binary Proxy Execution
• Phishing Delivery & Initial Execution
• PowerShell Download Cradles & Encoded Commands
• Prefetch
• SRUM
• Shimcache (AppCompatCache)
• WMI & WinRM Execution

exfiltration

• Data Exfiltration

exploitation

• EternalBlue & SMBv1 Exploitation
• PrintNightmare & Print Spooler Abuse

file-knowledge

• LNK Files & Jump Lists

files

• files.log & pe.log

filesystem

• $MFT, $UsnJrnl & $LogFile
• Filesystem & Timestamps

hardening

• Hardening by Windows Version

host-firewall

• Day 3 — EDR, Threat Emulation and Host Firewalls

http

• Attack Stages over HTTP, Choosing an Analysis Method, URL Reputation
• Base64 — How It Works, Recognising It, Suspicious Base64
• Finding Malware through User-Agents and Cookies
• HTTP
• HTTP(S) Analysis & Attacks
• HTTPS — TLS Decryption, Working Without It, Reading Certificates
• Header Reading Practice — One Request, One Response
• Judging Requests — Checklist, Exploit Kits, URLs inside URLs
• Malicious Files on Good Sites, File Extraction, Frequent Requests, Bare-IP Connections
• New HTTP Standards — HTTP/2, HTTP/3/QUIC, WebSocket, and HTTP Wrap-up
• POST, Other Methods and Request Headers
• Response Headers and Status Codes
• Screenshots, Sandboxes, and When to Go Manual
• Spotting Exploit Kits, and Malicious/Suspicious/Benign Practice
• TLS Fingerprints (JA3, JA3S, JARM, JA4), TLS 1.3, and the HTTP(S) Analysis Wrap-up
• Web Servers, URLs and GET
• http.log

hunting

• Beaconing & C2 Detection
• Hunting Patterns in SPL
• Intrusion Detection with Arkime
• Velociraptor

identity

• Account Compromise & BEC

idn

• Blockchain DNS and IDNs (Punycode)

imaging

• Disk & Memory Imaging

initial-access

• 1 Initial Access
• Phishing Delivery & Initial Execution
• RDP — Remote Desktop Abuse
• Web Shell & Server Compromise

injection

• Processes & Code Injection

internet-allowlisting

• Day 4 — Responder, Internet Allow Listing, Vulnerability Management, Web Security and AD Hardening

lab

• Lab: Kerberoasting

lateral-movement

• EternalBlue & SMBv1 Exploitation
• Golden, Silver Tickets & Pass-the-Ticket
• LLMNR/NBT-NS Poisoning & NTLM Relay
• Lateral Movement & Domain Compromise
• Pass-the-Hash
• PsExec & SMB Lateral Movement
• RDP — Remote Desktop Abuse
• WMI & WinRM Execution

learning

• 24-Month Curriculum
• Learning Path
• Purple-Team Weekly Loop
• Roadmap
• Training Resources

linux

• Authentication & Shell History
• Essential Linux Commands
• Filesystem & Timestamps
• Linux Persistence
• Logs, Processes & Live Triage

logs

• Authentication & Shell History
• Logs, Processes & Live Triage
• Windows Event Logs (EVTX)

memory

• Credentials, Registry & Rootkits
• Processes & Code Injection
• Volatility 3 Workflow

methodology

• Identifying Artefacts by Scenario

nat

• 1.12 — Challenges and Opportunities in Network Investigations

netflow

• 1.11 — Evidence Acquisition: Where and With What Do We Collect Packets?

network

• Arkime
• Arkime Search Syntax
• Beaconing & C2 Detection
• HTTP Status Codes
• Intrusion Detection with Arkime
• SRUM
• Security Searches by Question
• Well-Known Ports
• Wireshark & tshark
• conn.log
• dns.log
• files.log & pe.log
• http.log
• ssl.log & x509.log

network-forensics

• 1.10 — Lab Guide: Getting Hands-On with tcpdump and Wireshark
• 1.11 — Evidence Acquisition: Where and With What Do We Collect Packets?
• 1.12 — Challenges and Opportunities in Network Investigations
• 1.13 — Lab Guide: Carving Exfiltrated Data
• Lesson 1.1 — Evidence Beyond the Disk: Why Network Forensics, and the Investigator's Mindset
• Lesson 1.2 — Web Proxies: How They Work, the Main Products, and Why the Config File Is Evidence
• Lesson 1.3 — Reading Proxy Logs: The Ten Default Fields, Custom Formats, and Unix Time
• Lesson 1.4 — Reconstructing an Incident from Proxy Logs Alone: Investigation Walkthrough
• Lesson 1.5 — Commercial Proxy Logs, and Pulling Responses Out of the Proxy Cache
• Lesson 1.6 — The Container for Packets: libpcap, tcpdump, and the pcap/pcapng File Format
• Lesson 1.7 — Selecting Only the Packets You Need with BPF
• Lesson 1.8 — Practical tcpdump Options and Reading the Wireshark Window
• Lesson 1.9 — Wireshark Display Filters and Following Streams
• Network Forensics
• Part 1 — Foundations of Network Evidence

ntfs

• $MFT, $UsnJrnl & $LogFile

ntlm-relay

• Day 4 — Responder, Internet Allow Listing, Vulnerability Management, Web Security and AD Hardening

opsec

• DNS Log Collection and Safe Investigation

oscp

• Active Directory
• Exam Format & Scoring
• Exam Workflow
• Exam-Day Strategy
• Impacket Practical Handbook
• Lab Walkthroughs
• Lab: Kerberoasting
• Linux Privilege Escalation
• Methodology & Habits
• My Study Plan
• OSCP Practical Field Guide
• OSCP+
• Password Attacks
• Pivoting & Tunnelling
• Practice Labs & Machine Lists
• Recon & Enumeration
• Reporting
• Shells & File Transfer
• Web & Initial Access
• Windows Privilege Escalation

parsing

• Eric Zimmerman Tools

passwords

• Day 1 — Allow Listing and Password Attacks

pcap

• Arkime
• Lesson 1.6 — The Container for Packets: libpcap, tcpdump, and the pcap/pcapng File Format
• Lesson 1.7 — Selecting Only the Packets You Need with BPF
• Lesson 1.8 — Practical tcpdump Options and Reading the Wireshark Window
• Wireshark & tshark

pentesting

• Nmap
• Nmap host discovery & port scanning
• Nmap output & performance
• Nmap service enumeration & NSE

persistence

• 2 Persistence
• Linux Persistence
• Persistence — Services, Tasks, Run Keys

phishing

• 1 Initial Access
• Blockchain DNS and IDNs (Punycode)

ping-castle

• Day 4 — Responder, Internet Allow Listing, Vulnerability Management, Web Security and AD Hardening

playbook

• Account Compromise & BEC
• BOTSv3 Investigation Workflow
• Compromised Workstation
• Data Exfiltration
• Lateral Movement & Domain Compromise
• Ransomware
• Security Searches by Question
• Web Shell & Server Compromise

post-exploitation

• 3.1 Architecture and command behavior
• 3.2 Sessions and file systems
• 3.3 Processes and collection
• 3.4 Execution and external tools
• 3.5 Modern defense and review
• Post-Exploitation

practical

• Impacket Practical Handbook
• OSCP Practical Field Guide

practice

• Header Reading Practice — One Request, One Response
• Spotting Exploit Kits, and Malicious/Suspicious/Benign Practice

privilege-escalation

• AD Certificate Services Abuse (ESC1 / ESC8)
• PrintNightmare & Print Spooler Abuse
• Process Injection
• Token Impersonation & Potato Attacks
• UAC Bypass

proxy

• Lesson 1.2 — Web Proxies: How They Work, the Main Products, and Why the Config File Is Evidence
• Lesson 1.3 — Reading Proxy Logs: The Ten Default Fields, Custom Formats, and Unix Time
• Lesson 1.4 — Reconstructing an Incident from Proxy Logs Alone: Investigation Walkthrough
• Lesson 1.5 — Commercial Proxy Logs, and Pulling Responses Out of the Proxy Cache

ransomware

• Ransomware

recon

• Nmap
• Nmap host discovery & port scanning
• Nmap output & performance
• Nmap service enumeration & NSE

redteam

• 1 Initial Access
• 2 Persistence
• 3.1 Architecture and command behavior
• 3.2 Sessions and file systems
• 3.3 Processes and collection
• 3.4 Execution and external tools
• 3.5 Modern defense and review
• Post-Exploitation

reference

• Hardening by Windows Version

regex

• rex, Field Extraction & eval

registry

• Registry Keys for DFIR

splunk

• BOTSv3 Investigation Workflow
• Data Discovery & Time
• Hunting Patterns in SPL
• SPL Cheat Sheet
• Security Searches by Question
• rex, Field Extraction & eval

sysmon

• Day 3 — EDR, Threat Emulation and Host Firewalls

tcpdump

• 1.10 — Lab Guide: Getting Hands-On with tcpdump and Wireshark

technique

• AD Certificate Services Abuse (ESC1 / ESC8)
• AS-REP Roasting
• Blockchain DNS and IDNs (Punycode)
• DCSync
• DNS Abuse — Unauthorised DNS, Shared Hosting, Record Tampering, Tunnelling
• EternalBlue & SMBv1 Exploitation
• Golden, Silver Tickets & Pass-the-Ticket
• Impair Defenses & Log Clearing
• Kerberoasting
• LLMNR/NBT-NS Poisoning & NTLM Relay
• LOLBins — Signed Binary Proxy Execution
• LSASS Credential Dumping
• Pass-the-Hash
• Persistence — Services, Tasks, Run Keys
• Phishing Delivery & Initial Execution
• PowerShell Download Cradles & Encoded Commands
• PrintNightmare & Print Spooler Abuse
• Process Injection
• PsExec & SMB Lateral Movement
• RDP — Remote Desktop Abuse
• SAM, LSA Secrets & NTDS.dit Extraction
• Token Impersonation & Potato Attacks
• UAC Bypass
• WMI & WinRM Execution

threat-intel

• North Korea (DPRK) — Groups & Incidents
• North Korea — TTPs & Hunting
• Threat Intelligence

timelining

• Plaso & Super-Timelines

tls

• HTTPS — TLS Decryption, Working Without It, Reading Certificates
• TLS Fingerprints (JA3, JA3S, JARM, JA4), TLS 1.3, and the HTTP(S) Analysis Wrap-up
• ssl.log & x509.log

tool

• Arkime
• Arkime Search Syntax
• Disk & Memory Imaging
• Eric Zimmerman Tools
• KAPE
• Nmap
• Nmap host discovery & port scanning
• Nmap output & performance
• Nmap service enumeration & NSE
• Plaso & Super-Timelines
• SPL Cheat Sheet
• Velociraptor
• Volatility 3 Workflow
• Wireshark & tshark

training

• 1.10 — Lab Guide: Getting Hands-On with tcpdump and Wireshark
• 1.11 — Evidence Acquisition: Where and With What Do We Collect Packets?
• 1.12 — Challenges and Opportunities in Network Investigations
• 1.13 — Lab Guide: Carving Exfiltrated Data
• Attack Stages over HTTP, Choosing an Analysis Method, URL Reputation
• Base64 — How It Works, Recognising It, Suspicious Base64
• Blockchain DNS and IDNs (Punycode)
• Blue Team Essentials
• DNS
• DNS Abuse — Unauthorised DNS, Shared Hosting, Record Tampering, Tunnelling
• DNS Log Collection and Safe Investigation
• Day 1 — Allow Listing and Password Attacks
• Day 2 — Egress Traffic Analysis and Logging
• Day 3 — EDR, Threat Emulation and Host Firewalls
• Day 4 — Responder, Internet Allow Listing, Vulnerability Management, Web Security and AD Hardening
• Domain Signals — TLD, Reputation, Age, Randomness, ASN, Geolocation
• Encrypted DNS — DoT, DoH, DoQ, DNSSEC and Collection Strategy
• Finding Malware through User-Agents and Cookies
• HTTP
• HTTP(S) Analysis & Attacks
• HTTPS — TLS Decryption, Working Without It, Reading Certificates
• Header Reading Practice — One Request, One Response
• Judging Requests — Checklist, Exploit Kits, URLs inside URLs
• Lesson 1.1 — Evidence Beyond the Disk: Why Network Forensics, and the Investigator's Mindset
• Lesson 1.2 — Web Proxies: How They Work, the Main Products, and Why the Config File Is Evidence
• Lesson 1.3 — Reading Proxy Logs: The Ten Default Fields, Custom Formats, and Unix Time
• Lesson 1.4 — Reconstructing an Incident from Proxy Logs Alone: Investigation Walkthrough
• Lesson 1.5 — Commercial Proxy Logs, and Pulling Responses Out of the Proxy Cache
• Lesson 1.6 — The Container for Packets: libpcap, tcpdump, and the pcap/pcapng File Format
• Lesson 1.7 — Selecting Only the Packets You Need with BPF
• Lesson 1.8 — Practical tcpdump Options and Reading the Wireshark Window
• Lesson 1.9 — Wireshark Display Filters and Following Streams
• Malicious Files on Good Sites, File Extraction, Frequent Requests, Bare-IP Connections
• Network Forensics
• New HTTP Standards — HTTP/2, HTTP/3/QUIC, WebSocket, and HTTP Wrap-up
• POST, Other Methods and Request Headers
• Part 1 — Foundations of Network Evidence
• Response Headers and Status Codes
• Screenshots, Sandboxes, and When to Go Manual
• Spotting Exploit Kits, and Malicious/Suspicious/Benign Practice
• Suspicious DNS Triage Sheet · Corrections · Common Confusions
• TLS Fingerprints (JA3, JA3S, JARM, JA4), TLS 1.3, and the HTTP(S) Analysis Wrap-up
• Understanding DNS — Structure and Records
• Web Servers, URLs and GET

triage

• Compromised Workstation
• Identifying Artefacts by Scenario
• KAPE
• Logs, Processes & Live Triage

tshark

• 1.10 — Lab Guide: Getting Hands-On with tcpdump and Wireshark
• 1.13 — Lab Guide: Carving Exfiltrated Data

tunneling

• 1.12 — Challenges and Opportunities in Network Investigations
• DNS Abuse — Unauthorised DNS, Shared Hosting, Record Tampering, Tunnelling

vulnerability-management

• Day 4 — Responder, Internet Allow Listing, Vulnerability Management, Web Security and AD Hardening

webshell

• Web Shell & Server Compromise

windows

• $MFT, $UsnJrnl & $LogFile
• Amcache
• Eric Zimmerman Tools
• Identifying Artefacts by Scenario
• KAPE
• LNK Files & Jump Lists
• Prefetch
• Registry Keys for DFIR
• SRUM
• Security Searches by Question
• Shimcache (AppCompatCache)
• Windows Event IDs
• Windows Event Logs (EVTX)

wireshark

• 1.10 — Lab Guide: Getting Hands-On with tcpdump and Wireshark
• 1.13 — Lab Guide: Carving Exfiltrated Data
• Lesson 1.8 — Practical tcpdump Options and Reading the Wireshark Window
• Lesson 1.9 — Wireshark Display Filters and Following Streams

zeek

• Day 2 — Egress Traffic Analysis and Logging
• conn.log
• dns.log
• files.log & pe.log
• http.log
• ssl.log & x509.log