Forensics — topics
Steganography, traffic / memory / disk forensics. Paired with the ctf-jeopardy path’s misc track.
Steganography
- steganography-overview
- file-concentration · exif-metadata
- lsb-steganography · blind-watermarks
- audio-steganography
- compressed-archive-encryption
Disk and filesystem
Windows artefacts
- windows-event-log-analysis
- registry-hive-forensics
- scheduled-tasks-forensics
- lnk-jumplist-forensics
- browser-history-forensics
Memory and network
Incident response — defender’s whitebox
Detection engineering
Cloud incident response
- cloud-ir-aws-cloudtrail — CloudTrail-based AWS IR
- cloud-ir-azure-activity-log — Azure / Entra IR
- cloud-ir-gcp-audit-logs — GCP audit-log IR
- cloud-ir-k8s-audit-logs — Kubernetes IR
macOS / iOS forensics
- macos-forensics-fsevents-spotlight — file activity timeline
- macos-tcc-forensics — privacy / permission auditing
- macos-unified-logs-forensics — Unified Logs / tracev3
- ios-mobile-device-forensics — iOS device acquisition + analysis
IR case studies
- case-study-snowflake-2024 — SaaS tenant + infostealer
- case-study-3cx-supply-chain — cascading supply chain
- case-study-okta-2023-support-system — identity vendor + HARs
- case-study-capital-one-2019 — SSRF + IMDSv1
- case-study-solarwinds-2020 — SUNBURST cascading supply chain
- case-study-equifax-2017 — patch-management failure at scale
- case-study-moveit-2023 — MFT-class mass extortion
- case-study-lastpass-2022 — vault-vendor breach
Industry defender playbooks
- financial-sector-defender-playbook
- healthcare-sector-defender-playbook
- manufacturing-ot-defender-playbook
- retail-ecommerce-defender-playbook