Blue Team Notes

吉沃运营专员

Blue Team Notes

一些对蓝队工作有用的技巧

https://github.com/Purp1eW0lf/Blue-Team-Notes

• Shell Style
• Windows
  
  • OS Queries
  • Account Queries
  • Service Queries
  • Network Queries
  • Remoting Queries
  • Firewall Queries
  • SMB Queries
  • Process Queries
  • Recurring Task Queries
  • File Queries
  • Registry Queries
  • Driver Queries
  • DLL Queries
  • AV Queries
  • Log Queries
  • Powershell Tips
    
• Linux
  
  • Bash History
  • Grep and Ack
  • Processes and Networks
  • Files
  • Bash Tips
    
• MacOS
• Malware
  
  • Rapid Malware Analysis
  • Unquarantine Malware
  • Process Monitor
  • Hash Check Malware
  • Decoding Powershell
    
• SOC
  
  • Sigma Converter
  • SOC Prime
    
• Honeypots
  
  • Basic Honeypots
    
• Network Traffic
  
  • Capture Traffic
  • TShark
  • Extracting Stuff
  • PCAP Analysis IRL
    
• Digital Forensics
  
  • Volatility
  • Quick Forensics
  • Chainsaw
  • Browser History
  • Which logs to pull in an incident
  • USBs