Automatically generated based on tag:
| Title | Type | Summary | Location |
|---|
View on GitHub
- Windows
-
All
- NTFS
-
ETW
- Overview
- Tools
- Events integrity
- System uptime
- Authentication
- Remote Desktop
- PowerShell remoting
- Users and security groups
- Process creation
- PowerShell activity
- Network shares
- Devices and USB activity
- Windows Defender
- Windows Firewall
- Windows Services
- Windows Scheduled Tasks
- Registry ASEP
- WMI
- AD NTDS dumping
- Sigma rules
-
Registry
- Overview
- Timestamp
- Tools
- System information
- Devices and USB activity
- Auto-Start Extensibility Points
- BAM / DAM
- ComDlg32
- FeatureUsage
- Map Network Drive MRU
- MountPoints2
- MUICache
- PortProxy
- RecentApps
- RunMRU
- Scheduled tasks (Taskcache)
- Services
- Shellbags
- Terminal Server Client\Servers
- TypedURLs
- UserAssist
- WordWheelQuery
- Amcache
- Hiberfil.sys
- Jumplists
- LNK / Shortcut files
- .NET CLR UsageLogs
- PCA
- PowerShell ConsoleHost_history
- PowerShell Transcript
- Prefetch
- RDP
- RecentFileCache
- Recycle Bin
- Setupapi logs
- Shimcache
- SRUM
- Thumbs.db / Thumbcache
- UAL / SUM
- WebCacheV01
- Windows Defender
- Windows Push Notifications (wpndatabase.db)
- Windows Search Database
- Windows Timeline / ActivitiesCache
- WMI
- Third-party softwares
- RULER Project - Remote Monitoring and Management
- Web browsers
- Type - NTFS
- Type - ETW
- Type - Registry
- Category - System information
- Category - File knowledge
- Category - Files and folders access
- Category - Program execution
- Category - PowerShell activity
- Category - Browsing history
- Category - Network usage
- Category - USB activity
- Category - Lateral movement
- Category - Local persistence
- Category - Defense evasion
- Category - Miscellaneous