1
Q
Why investigate RAM?
A
Everything runs through it: processes, threads, malware, network sockets, URLs, IP addresses, open files, passwords, caches, clipboards, encryption keys, hard/software configurations, event logs, and registry eyes.
2
Q
Three exclusive things that only exist in memory and does not write on disk I should be aware of.
A
Incognito sessions run here, registry keys, and chat applications.
Incident Response
flashcards
Decks in class (24)
# Cards
-
Section 1.1: Incident Response & Threat Hunting21
-
Section 1.2: Threat Intelligence24
-
Section 1.3: Malware-ology12
-
Section 1.4: Malware Persistence36
-
Section 1.5: Hunting Across the Enterprise13
-
Section 1.6: Credential Theft50
-
Section 2.1: Intrusion Analysis: Evidence of Execution29
-
Section 2.2: Intrusion Analysis: Event Log Analysis65
-
Section 2.3: Intrusion Analysis: Lateral Movement Tactics50
-
Section 2.4: Intrusion Analysis: Command Line, Powershell, and WMI Analysis29
-
Section 3.1: Enterprise and Remote Analysis12
-
Section 3.2: Why Memory Forensics?2
-
Section 3.3: Acquiring Memory11
-
Section 3.4: Introduction to Memory Analysis43
-
Section 3.5: Injection, Rootkits, & Extraction41
-
Section 4.1: Malware Discovery7
-
Section 4.2: Timeline Analysis Overview23
-
Section 4.3: Filesystem Timeline Creation and Analysis11
-
Section 4.4: Super Timeline & Analysis11
-
Section 5.1: Anti-Forensics Overview4
-
Section 5.2: Recovery of Deleted Files via VSS17
-
Section 5.3: Advanced NTFS Filesystem Tactics58
-
Section 5.4: Advanced Evidence Recovery23
-
Section 5.5: Defensive Countermeasures5
