mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-26 06:10:57 +03:00
51 lines
1.1 KiB
Markdown
51 lines
1.1 KiB
Markdown
# Endpoint Forensics Investigation Template
|
|
|
|
## Case Information
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Case ID | |
|
|
| Incident Type | |
|
|
| Target Endpoint | |
|
|
| Investigation Date | |
|
|
| Lead Investigator | |
|
|
|
|
## Evidence Inventory
|
|
|
|
| Evidence ID | Type | Source | Hash (SHA256) | Collection Time | Collected By |
|
|
|-------------|------|--------|---------------|-----------------|-------------|
|
|
| | Memory dump | | | | |
|
|
| | Disk image | | | | |
|
|
| | Volatile data | | | | |
|
|
|
|
## Chain of Custody
|
|
|
|
| Date/Time | Action | From | To | Notes |
|
|
|-----------|--------|------|-----|-------|
|
|
| | Collected | Endpoint | Evidence storage | |
|
|
|
|
## Findings Summary
|
|
|
|
| Finding | ATT&CK Technique | Evidence | Confidence |
|
|
|---------|------------------|----------|------------|
|
|
| Initial access | | | |
|
|
| Persistence | | | |
|
|
| Lateral movement | | | |
|
|
| Data access | | | |
|
|
|
|
## IOCs Extracted
|
|
|
|
| Type | Value | Context |
|
|
|------|-------|---------|
|
|
| SHA256 | | |
|
|
| IP | | |
|
|
| Domain | | |
|
|
| File path | | |
|
|
|
|
## Sign-Off
|
|
|
|
| Role | Name | Date |
|
|
|------|------|------|
|
|
| Lead Investigator | | |
|
|
| IR Manager | | |
|