REVIEW: RED TEAM Operator: Windows Evasion Course by SEKTOR7 Institute.
Category: incident response
Enumerating Processes with CreateToolhelp32Snapshot
Quick and dirty example of process enumeration using CreateToolhelp32Snapshot
Finding Processes With Suspicious CWD Using procfs
Find malware running from temporary directories using procfs.
Finding Masquerading Processes With procfs
Find masquerading processes using procfs.
Using procfs For Forensics and Incident Response
Using procfs For Forensics and Incident Response.
CTF Triage Data Acquisition
A quick overview of triage data acquisition in the context of attack/defend CTFs.
Accessing Alternate Data Streams on VMDK Images on Linux
Accessing Alternate Data Streams on VMDK Images on Linux.
Windows Startup Folders
Windows Startup Folder locations.
Volatility Notes
Some notes and links related to the Volatility Framework
Volatility on Ubuntu 20.04
Quick and dirty way to get Volatility working on Ubuntu 20.04
Windows Sysinternals Notes
Notes about Windows Sysinternals tools from a security point of view.
Finding Bad With Package Managers
Learn how to use dpkg, rpm, and other related tools to find malware on your systems.
