domains / families / security / performing-endpoint-forensics-investigation

performing-endpoint-forensics-investigation

separate

'Performs digital forensics investigation on compromised endpoints including

When to use

• Investigating a confirmed or suspected endpoint compromise requiring forensic analysis
• Collecting volatile and non-volatile evidence for incident response or legal proceedings
• Analyzing memory dumps for malware, injected code, or credential theft artifacts
• Reconstructing attacker timelines from endpoint artifacts (prefetch, shimcache, amcache)

When not to use

• live threat hunting
• network forensics

Skill page

Source