03 · Event Logs
Active Directory Forensics: Domain Controller Event Logs
Investigate domain controllers: Kerberos and NTLM events, account and group changes, DCSync 4662, directory changes, GPO abuse, NTDS.dit theft, forged tickets.
Articles tagged: #event-logs
11 · Anti-Forensics
Detecting Windows Anti-Forensics: What Survives the Cleanup
Detect log clearing, timestomping, secure deletion, VSS deletion and Defender tampering on Windows, mapped to MITRE ATT&CK, with the traces each one leaves.
08 · Lateral Movement
Lateral Movement Forensics: RDP, PsExec, WMI and WinRM
Map source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
03 · Event Logs
Windows Event Log Forensics: EVTX, Event IDs and Hunting
A practitioner guide to Windows event logs: EVTX format, key channels, Security and Sysmon event IDs, audit policy, cleared-log recovery and hunting tools.