Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/standards.md

@@ -0,0 +1,59 @@
+# Standards and References - EZ Tools Windows Forensics
+
+## Industry Standards
+
+### NIST SP 800-86 - Guide to Integrating Forensic Techniques
+- Framework for collecting, examining, and analyzing digital evidence
+- Defines procedures for forensic acquisition and chain of custody
+- EZ Tools align with NIST evidence handling and analysis guidelines
+
+### ISO/IEC 27037 - Digital Evidence Collection
+- International standard for identification, collection, acquisition, and preservation
+- KAPE collection follows ISO 27037 acquisition methodology
+- Timeline Explorer output supports ISO-compliant reporting
+
+### SWGDE Best Practices for Computer Forensics
+- Scientific Working Group on Digital Evidence guidelines
+- Defines validation requirements for forensic tools
+- EZ Tools undergo community-driven validation testing
+
+## Tool References
+
+### EZ Tools Suite Components
+| Tool | Version | Purpose |
+|------|---------|---------|
+| KAPE | 1.3+ | Artifact collection and processing orchestration |
+| MFTECmd | 1.2+ | NTFS Master File Table parser |
+| PECmd | 1.5+ | Windows Prefetch file parser |
+| RECmd | 2.0+ | Registry hive parser with batch processing |
+| EvtxECmd | 1.5+ | Windows Event Log parser with maps |
+| LECmd | 1.5+ | LNK shortcut file parser |
+| JLECmd | 1.5+ | Jump List parser |
+| SBECmd | 2.0+ | Shellbag parser |
+| Timeline Explorer | 2.0+ | CSV analysis and visualization |
+| Registry Explorer | 2.0+ | GUI registry hive viewer |
+| ShellBags Explorer | 2.0+ | GUI shellbag viewer |
+| AmcacheParser | 1.5+ | Amcache.hve parser |
+| AppCompatCacheParser | 1.5+ | ShimCache parser |
+| WxTCmd | 1.0+ | Windows Timeline database parser |
+| RBCmd | 1.5+ | Recycle Bin artifact parser |
+| bstrings | 1.5+ | Binary string extraction |
+
+### SANS Training Courses
+- FOR500: Windows Forensic Analysis
+- FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
+- FOR498: Battlefield Forensics & Data Acquisition
+- FOR610: Reverse-Engineering Malware
+
+### MITRE ATT&CK Relevance
+- T1070 - Indicator Removal: Timestomping detection via MFT analysis
+- T1547 - Boot or Logon Autostart Execution: Registry persistence detection
+- T1053 - Scheduled Task/Job: Task scheduler artifact analysis
+- T1059 - Command and Scripting Interpreter: Prefetch execution evidence
+- T1021 - Remote Services: Lateral movement via event log analysis
+
+## Official Resources
+- Eric Zimmerman's GitHub: https://ericzimmerman.github.io/
+- KAPE GitHub Targets/Modules: https://github.com/EricZimmerman/KapeFiles
+- EZ Tools Changelog: https://ericzimmerman.github.io/#!index.md
+- SANS DFIR Blog: https://www.sans.org/blog/?focus-area=digital-forensics

skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/workflows.md

@@ -0,0 +1,98 @@
+# Workflows - EZ Tools Windows Forensic Analysis
+
+## Workflow 1: Full Triage Collection and Processing
+
+```
+Step 1: Mount forensic image as read-only drive (E:)
+    |
+Step 2: Run KAPE with KapeTriage target
+    |-- Collects: $MFT, $J, Registry, Event Logs, Prefetch, LNK, Jump Lists
+    |
+Step 3: Run KAPE with !EZParser module
+    |-- Processes all collected artifacts with appropriate EZ Tools
+    |
+Step 4: Open CSV outputs in Timeline Explorer
+    |-- Sort by timestamp, filter by artifact type
+    |
+Step 5: Build investigation timeline
+    |-- Cross-reference MFT, Event Logs, Prefetch, Registry
+    |
+Step 6: Document findings and export filtered results
+```
+
+## Workflow 2: Timestomping Detection
+
+```
+Step 1: Parse $MFT with MFTECmd
+    |
+Step 2: Open MFT CSV in Timeline Explorer
+    |
+Step 3: Compare $SI timestamps (Created0x10) vs $FN timestamps (Created0x30)
+    |-- Flag entries where Created0x10 < Created0x30
+    |-- Flag entries where all four $SI timestamps are identical
+    |
+Step 4: Cross-reference flagged files with USN Journal entries
+    |
+Step 5: Verify with event log correlation (process creation, file access)
+```
+
+## Workflow 3: Program Execution Timeline
+
+```
+Step 1: Parse Prefetch with PECmd
+    |
+Step 2: Parse Amcache.hve with AmcacheParser
+    |
+Step 3: Parse ShimCache with AppCompatCacheParser
+    |
+Step 4: Parse UserAssist from NTUSER.DAT with RECmd
+    |
+Step 5: Merge and correlate execution timestamps
+    |-- Prefetch: Run count + last 8 execution times
+    |-- Amcache: First execution + SHA1 hash
+    |-- ShimCache: Last modified time (execution indicator)
+    |-- UserAssist: GUI program execution tracking
+    |
+Step 6: Build execution timeline in Timeline Explorer
+```
+
+## Workflow 4: Lateral Movement Investigation
+
+```
+Step 1: Parse Security.evtx with EvtxECmd
+    |-- Filter Event ID 4624 (Logon Type 3, 10)
+    |-- Filter Event ID 4625 (Failed logons)
+    |
+Step 2: Parse TerminalServices event logs
+    |-- Microsoft-Windows-TerminalServices-LocalSessionManager
+    |-- Microsoft-Windows-TerminalServices-RDPClient
+    |
+Step 3: Correlate with registry RDP MRU entries
+    |-- NTUSER.DAT\Software\Microsoft\Terminal Server Client\Servers
+    |
+Step 4: Analyze LNK files for network path access
+    |
+Step 5: Review scheduled task creation from event logs
+    |
+Step 6: Map lateral movement path across systems
+```
+
+## Workflow 5: USB Device Investigation
+
+```
+Step 1: Parse SYSTEM hive with RECmd
+    |-- SYSTEM\CurrentControlSet\Enum\USBSTOR
+    |-- SYSTEM\CurrentControlSet\Enum\USB
+    |-- SYSTEM\MountedDevices
+    |
+Step 2: Parse NTUSER.DAT with RECmd
+    |-- MountPoints2 for user-level device associations
+    |
+Step 3: Parse setupapi.dev.log for device installation timestamps
+    |
+Step 4: Analyze LNK files referencing removable drive letters
+    |
+Step 5: Check Shellbags for folder browsing on USB devices
+    |
+Step 6: Correlate with Event Logs (Microsoft-Windows-Partition/Diagnostic)
+```