13Cubed | Investigating Windows Endpoints

13Cubed | Investigating Windows Endpoints7.4 GB
- Support - Onehack.Us.txt94.0 B
- 1. Welcome and Introduction
  - 1.Welcome and Introduction.ts350.1 MB
- 10. Additional Content
  - 01. Support - Onehack.Us.txt94.0 B
  - 31. Web Browser Forensics.ts267.6 MB
  - 32. Thumbs.db and Thumbcache.ts207.8 MB
- 2. Initial Setup
  - 2.Initial Setup.ts518.3 MB
- 3. Windows Event Logs
  - 00. Support - Onehack.Us.txt94.0 B
  - 3. Fundamentals.ts247.7 MB
  - 4. In-depth Analysis.ts524.0 MB
  - 5. Tools and Best Practices.ts422.5 MB
- 4. The Registry
  - 10. Scalable Analysis.ts174.6 MB
  - 6. Fundamentals.ts335.3 MB
  - 7. NTUSER.DAT.ts360.0 MB
  - 8. UsrClass.dat and ShellBags.ts296.8 MB
  - 9. USB Forensics, Networks, and More.ts220.1 MB
- 5. Evidence of Execution
  - 11. Introduction.ts47.8 MB
  - 12. Prefetch.ts545.3 MB
  - 13. Shimcache.ts304.3 MB
  - 14. AmCache.ts271.2 MB
  - 15. PCA.ts31.8 MB
  - 16. MUICache.ts87.4 MB
  - 17. UserAssist.ts162.5 MB
  - 18. SRUM.ts201.8 MB
- 6. Persistence, Privilege Escalation, and Lateral Movement
  - 19. Services and Scheduled Tasks.ts331.2 MB
  - 20. LSASS, NTDS.dit, WDigest.ts168.7 MB
  - 21. SMB, RDP, WMI, PsExec, UAL.ts259.1 MB
- 7. Anatomy of NTFS
  - 22. Introduction.ts43.9 MB
  - 23. Metafiles, MFT, Journaling, ADS.ts295.7 MB
  - 24. MACB Timestamps.ts165.5 MB
  - 25. Parsing the MFT and USN Journal.ts204.6 MB