ctf-forensics

Risky tool definition detected

Data Exfiltration

Destructive Action

Tool passed security scan

Context Poisoning

Tool passed security scan

Risky tool definition detected

Malicious tool definition detected

Risky tool definition detected

Tool: ctf-forensics/windows.md [2/2] Description: output files in MFT # strings -el $MFT | grep -E '^__[0-9]{10}' # The unix timestamp in the filename = approximate execution start time ``` --- ## PowerShell History as Timeline **Location:** `C:\Users\<user>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt` PSReadLine writes commands incrementally.

Tool passed security scan

Context Poisoning

Resource Abuse

Tool passed security scan

Risky tool definition detected

Risky tool definition detected