👋whoami
Security Operations
Offensive Security Operations
- 🎯Penetration Testing
  - Techniques
    MITRE ATT&CK
    Reconnaissance
    Resource Development
    T1608 - Stage Capabilities
    Staging Malware and Tools on Kali Linux
    Initial Access
    Execution
    Persistence
    Privilege Escalation
    Defense Evasion
    Credential Access
    Discovery
    Lateral Movement
    Collection
    Command and Control
    Exfiltration
    Impact
    CAPEC
    100 - Overflow Buffers
    66 - SQL Injection
    94 - Adversary-in-the-Middle (AiTM)
    252 - PHP Local File Inclusion (LFI)
    560 - Use of Known Domain Credentials
    644 - Use of Captured Hashes (Pass-the-Hash (PtH))
    633 - Token Impersonation
    Technology Focused
    Cloud
    Amazon Web Services (AWS)
    Google Cloud Platform (GCP)
    Network Protocols and Services
    Port 20/21 - FTP
    Port 22 - SSH
    Port 23 - Telnet
    Port 25 - SMTP
    Port 53 - DNS
    Port 80 - HTTP
    Port 110/995 - POP3
    Port 135/593 - MSRPC
    Port 137-139 - NetBIOS
    Port 143/993 - IMAP
    Port 443 - HTTPS
    Port 445 - SMB
    Port 3389 - RDP
    Port 5355 - LLMNR
    ARP
    Databases
    Port 1433/1434 - MSSQL
    Port 3306 - MySQL/MariaDB
    DHCP
    Web
    PHP
    Windows
    Active Directory
    Wireless
    Linux
  - Offensive Security Tools
- 🚩Capture The Flag (CTF)
Guides
General Resources

Powered by GitBook

On this page

Guides

DFIR

Evidence Artifacts

What evidence artifacts are used by DFIR analysts when conducting incident investigations?

PreviousDFIR NextEvent Logs

Last updated 1 year ago

Various evidence artifacts that can be used for DFIR investigations when attempt to trace what an adversary has done on a network, application, or host.

🔍