DFIR

Investigate security incidents by analyzing event logs, network captures, and filesystem artifacts. Detect and reconstruct AD attack chains.

Techniques

Domain	Key Capabilities
Windows Event Logs	EVTX parsing, Event ID correlation, logon tracking, privilege enumeration
Network Forensics	PCAP analysis, NTLM extraction, LLMNR/NBT-NS poisoning detection, relay identification
Filesystem Forensics	MFT parsing, Prefetch analysis, VSS artifact recovery, Linux persistence, timeline reconstruction
AD Attack Detection	Kerberoasting, AS-REP roasting, NTDS dump, NTLM relay, credential theft
Memory Forensics	Volatility3 analysis: process trees, file extraction, SID resolution, command lines
Hash Analysis	NTLMv2 hash construction from pcap, offline cracking validation