# Blue Team

- [CDSA](/mynotes/certifications-and-notes/blue-team/cdsa.md)
- [Security Monitoring & SIEM Fundamentals](/mynotes/certifications-and-notes/blue-team/cdsa/security-monitoring-and-siem-fundamentals.md)
- [Failed Logon Attempts (All Users)](/mynotes/certifications-and-notes/blue-team/cdsa/security-monitoring-and-siem-fundamentals/failed-logon-attempts-all-users.md)
- [Failed Logon Attempts (Disabled Users)](/mynotes/certifications-and-notes/blue-team/cdsa/security-monitoring-and-siem-fundamentals/failed-logon-attempts-disabled-users.md)
- [Successful RDP Logon Related To Service Accounts](/mynotes/certifications-and-notes/blue-team/cdsa/security-monitoring-and-siem-fundamentals/successful-rdp-logon-related-to-service-accounts.md)
- [Users Added Or Removed From A Local Group (Within A Specific Timeframe)](/mynotes/certifications-and-notes/blue-team/cdsa/security-monitoring-and-siem-fundamentals/users-added-or-removed-from-a-local-group-within-a-specific-timeframe.md)
- [Windows Event Logs & Finding Evil](/mynotes/certifications-and-notes/blue-team/cdsa/windows-event-logs-and-finding-evil.md)
- [Analyzing Evil With Sysmon & Event Logs](/mynotes/certifications-and-notes/blue-team/cdsa/windows-event-logs-and-finding-evil/analyzing-evil-with-sysmon-and-event-logs.md)
- [Event Tracing for Windows (ETW)](/mynotes/certifications-and-notes/blue-team/cdsa/windows-event-logs-and-finding-evil/event-tracing-for-windows-etw.md)
- [Tapping Into ETW](/mynotes/certifications-and-notes/blue-team/cdsa/windows-event-logs-and-finding-evil/tapping-into-etw.md)
- [Get-WinEvent](/mynotes/certifications-and-notes/blue-team/cdsa/windows-event-logs-and-finding-evil/get-winevent.md)
- [Skills Assessment](/mynotes/certifications-and-notes/blue-team/cdsa/windows-event-logs-and-finding-evil/skills-assessment.md)
- [Event IDs Components](/mynotes/certifications-and-notes/blue-team/cdsa/windows-event-logs-and-finding-evil/event-ids-components.md)
- [Introduction to Threat Hunting & Hunting With Elastic](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-threat-hunting-and-hunting-with-elastic.md)
- [Stuxbot Threat Intel Report](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-threat-hunting-and-hunting-with-elastic/stuxbot-threat-intel-report.md)
- [Skills Assessment](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-threat-hunting-and-hunting-with-elastic/skills-assessment.md)
- [Understanding Log Sources & Investigating with Splunk](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk.md)
- [Core SPL Commands](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/core-spl-commands.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/core-spl-commands/question.md)
- [Using Splunk Applications](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/using-splunk-applications.md)
- [Intrusion Detection With Splunk](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/intrusion-detection-with-splunk.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/intrusion-detection-with-splunk/question.md)
- [Sysmon EventCode](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/sysmon-eventcode.md)
- [Detecting Attacker Behavior With TTPs](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/detecting-attacker-behavior-with-ttps.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/detecting-attacker-behavior-with-ttps/question.md)
- [Detecting Attacker Behavior With Analytics](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/detecting-attacker-behavior-with-analytics.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/detecting-attacker-behavior-with-analytics/question.md)
- [Skills Assessment](/mynotes/certifications-and-notes/blue-team/cdsa/understanding-log-sources-and-investigating-with-splunk/skills-assessment.md)
- [Windows Attacks & Defense](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense.md)
- [Kerberoasting](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/kerberoasting.md)
- [AS-REProasting](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/as-reproasting.md)
- [GPP Passwords](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/gpp-passwords.md)
- [GPO Permissions/GPO Files](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/gpo-permissions-gpo-files.md)
- [Credentials in Shares](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/credentials-in-shares.md)
- [Credentials in Object Properties](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/credentials-in-object-properties.md)
- [DCSync](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/dcsync.md)
- [Golden Ticket](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/golden-ticket.md)
- [Kerberos Constrained Delegation](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/kerberos-constrained-delegation.md)
- [Print Spooler & NTLM Relaying](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/print-spooler-and-ntlm-relaying.md)
- [Coercing Attacks & Unconstrained Delegation](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/coercing-attacks-and-unconstrained-delegation.md)
- [Object ACLs](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/object-acls.md)
- [PKI - ESC1](/mynotes/certifications-and-notes/blue-team/cdsa/windows-attacks-and-defense/pki-esc1.md)
- [Intro to Network Traffic Analysis](/mynotes/certifications-and-notes/blue-team/cdsa/intro-to-network-traffic-analysis.md)
- [Tcpdump Fundamentals](/mynotes/certifications-and-notes/blue-team/cdsa/intro-to-network-traffic-analysis/tcpdump-fundamentals.md)
- [Tcpdump Packet Filtering](/mynotes/certifications-and-notes/blue-team/cdsa/intro-to-network-traffic-analysis/tcpdump-packet-filtering.md)
- [Interrogating Network Traffic With Capture and Display Filters](/mynotes/certifications-and-notes/blue-team/cdsa/intro-to-network-traffic-analysis/interrogating-network-traffic-with-capture-and-display-filters.md)
- [Wireshark Advanced Usage](/mynotes/certifications-and-notes/blue-team/cdsa/intro-to-network-traffic-analysis/wireshark-advanced-usage.md)
- [Packet Inception, Dissecting Network Traffic With Wireshark](/mynotes/certifications-and-notes/blue-team/cdsa/intro-to-network-traffic-analysis/packet-inception-dissecting-network-traffic-with-wireshark.md)
- [Decrypting RDP connections](/mynotes/certifications-and-notes/blue-team/cdsa/intro-to-network-traffic-analysis/decrypting-rdp-connections.md)
- [Intermediate Network Traffic Analysis](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis.md)
- [ARP Spoofing & Abnormality Detection](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/arp-spoofing-and-abnormality-detection.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/arp-spoofing-and-abnormality-detection/question.md)
- [ARP Scanning & Denial-of-Service](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/arp-scanning-and-denial-of-service.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/arp-scanning-and-denial-of-service/question.md)
- [802.11 Denial of Service](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/802.11-denial-of-service.md)
- [Rogue Access Point & Evil-Twin Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/rogue-access-point-and-evil-twin-attacks.md)
- [Fragmentation Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/fragmentation-attacks.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/fragmentation-attacks/question.md)
- [IP Source & Destination Spoofing Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/ip-source-and-destination-spoofing-attacks.md)
- [IP Time-to-Live Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/ip-time-to-live-attacks.md)
- [TCP Handshake Abnormalities](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/tcp-handshake-abnormalities.md)
- [TCP Connection Resets & Hijacking](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/tcp-connection-resets-and-hijacking.md)
- [ICMP Tunneling](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/icmp-tunneling.md)
- [HTTP/HTTPs Service Enumeration](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/http-https-service-enumeration.md)
- [Strange HTTP Headers](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/strange-http-headers.md)
- [Cross-Site Scripting (XSS) & Code Injection Detection](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/cross-site-scripting-xss-and-code-injection-detection.md)
- [SSL Renegotiation Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/ssl-renegotiation-attacks.md)
- [Peculiar DNS Traffic](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/peculiar-dns-traffic.md)
- [Strange Telnet & UDP Connections](/mynotes/certifications-and-notes/blue-team/cdsa/intermediate-network-traffic-analysis/strange-telnet-and-udp-connections.md)
- [Working with IDS/IPS](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips.md)
- [Suricata FundamentalsP](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/suricata-fundamentalsp.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/suricata-fundamentalsp/question.md)
- [Suricata Rule Development Part 1](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/suricata-rule-development-part-1.md)
- [Suricata Rule Development Part 2 (Encrypted Traffic)](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/suricata-rule-development-part-2-encrypted-traffic.md)
- [Snort Fundamentals](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/snort-fundamentals.md)
- [Snort Rule Development](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/snort-rule-development.md)
- [Zeek Fundamentals](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/zeek-fundamentals.md)
- [Intrusion Detection With Zeek](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/intrusion-detection-with-zeek.md)
- [Skills Assessment - Suricata](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/skills-assessment-suricata.md)
- [Skills Assessment - Snort](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/skills-assessment-snort.md)
- [Skills Assessment - Zeek](/mynotes/certifications-and-notes/blue-team/cdsa/working-with-ids-ips/skills-assessment-zeek.md)
- [Introduction to Malware Analysis](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis.md)
- [Introduction To Malware & Malware Analysis](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/introduction-to-malware-and-malware-analysis.md)
- [Windows Internals](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/windows-internals.md)
- [Static Analysis On Linux](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/static-analysis-on-linux.md)
- [Static Analysis On Windows](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/static-analysis-on-windows.md)
- [Dynamic Analysis](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/dynamic-analysis.md)
- [Code Analysis](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/code-analysis.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/code-analysis/question.md)
- [Debugging](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/debugging.md)
- [Creating Detection Rules](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-malware-analysis/creating-detection-rules.md)
- [YARA & Sigma for SOC Analysts](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts.md)
- [YARA and YARA Rules](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/yara-and-yara-rules.md)
- [Developing YARA Rules](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/developing-yara-rules.md)
- [Hunting Evil with YARA (Windows Edition)](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/hunting-evil-with-yara-windows-edition.md)
- [Hunting Evil with YARA (Linux Edition)](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/hunting-evil-with-yara-linux-edition.md)
- [Hunting Evil with YARA (Web Edition)](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/hunting-evil-with-yara-web-edition.md)
- [Sigma and Sigma Rules](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/sigma-and-sigma-rules.md)
- [Developing Sigma Rules](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/developing-sigma-rules.md)
- [Hunting Evil with Sigma (Chainsaw Edition)](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/hunting-evil-with-sigma-chainsaw-edition.md)
- [Hunting Evil with Sigma (Splunk Edition)](/mynotes/certifications-and-notes/blue-team/cdsa/yara-and-sigma-for-soc-analysts/hunting-evil-with-sigma-splunk-edition.md)
- [Introduction to Digital Forensics](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-digital-forensics.md)
- [Evidence Acquisition Techniques & Tools](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-digital-forensics/evidence-acquisition-techniques-and-tools.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-digital-forensics/evidence-acquisition-techniques-and-tools/question.md)
- [Memory Forensics](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-digital-forensics/memory-forensics.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-digital-forensics/memory-forensics/question.md)
- [Disk Forensics](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-digital-forensics/disk-forensics.md)
- [Rapid Triage Examination & Analysis Tools](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-digital-forensics/rapid-triage-examination-and-analysis-tools.md)
- [Practical Digital Forensics Scenario](/mynotes/certifications-and-notes/blue-team/cdsa/introduction-to-digital-forensics/practical-digital-forensics-scenario.md)
- [Detecting Windows Attacks with Splunk](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk.md)
- [Detecting Common User/Domain Recon](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-common-user-domain-recon.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-common-user-domain-recon/question.md)
- [Detecting Password Spraying](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-password-spraying.md)
- [Detecting Responder-like Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-responder-like-attacks.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-responder-like-attacks/question.md)
- [Detecting Kerberoasting/AS-REProasting](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-kerberoasting-as-reproasting.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-kerberoasting-as-reproasting/question.md)
- [Detecting Pass-the-Hash](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-pass-the-hash.md)
- [Question](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-pass-the-hash/question.md)
- [Detecting Pass-the-Ticket](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-pass-the-ticket.md)
- [Detecting Overpass-the-Hash](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-overpass-the-hash.md)
- [Detecting Golden Tickets/Silver Tickets](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-golden-tickets-silver-tickets.md)
- [Detecting Unconstrained Delegation/Constrained Delegation Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-unconstrained-delegation-constrained-delegation-attacks.md)
- [Detecting DCSync/DCShadow](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-dcsync-dcshadow.md)
- [Creating Custom Splunk Applications](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/creating-custom-splunk-applications.md)
- [Detecting RDP Brute Force Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-rdp-brute-force-attacks.md)
- [Detecting Beaconing Malware](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-beaconing-malware.md)
- [Detecting Nmap Port Scanning](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-nmap-port-scanning.md)
- [Detecting Kerberos Brute Force Attacks](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-kerberos-brute-force-attacks.md)
- [Detecting Kerberoasting](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-kerberoasting.md)
- [Detecting Golden Tickets](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-golden-tickets.md)
- [Detecting Cobalt Strike's PSExec](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-cobalt-strikes-psexec.md)
- [Detecting Zerologon](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-zerologon.md)
- [Detecting Exfiltration (HTTP)](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-exfiltration-http.md)
- [Detecting Exfiltration (DNS)](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-exfiltration-dns.md)
- [Detecting Ransomware](/mynotes/certifications-and-notes/blue-team/cdsa/detecting-windows-attacks-with-splunk/detecting-ransomware.md)
- [DFIR](/mynotes/certifications-and-notes/blue-team/dfir.md)
- [Introduction to Digital Forensics](/mynotes/certifications-and-notes/blue-team/dfir/introduction-to-digital-forensics.md)
- [Investigating Windows Endpoints](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints.md)
- [Windows Event Logs](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/windows-event-logs.md)
- [Fundamentals](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/windows-event-logs/fundamentals.md)
- [Event Logs Cheat Sheet](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/windows-event-logs/event-logs-cheat-sheet.md)
- [The Registry](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/the-registry.md)
- [NTUSER.DAT](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/the-registry/ntuser.dat.md)
- [UsrClass.dat & ShellBags](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/the-registry/usrclass.dat-and-shellbags.md)
- [USB Forensics](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/the-registry/usb-forensics.md)
- [Evidence of Execution](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/evidence-of-execution.md)
- [Prefetch](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/evidence-of-execution/prefetch.md)
- [Shimcache](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/evidence-of-execution/shimcache.md)
- [AmCache](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/evidence-of-execution/amcache.md)
- [MUICache](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/evidence-of-execution/muicache.md)
- [UserAssist](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/evidence-of-execution/userassist.md)
- [SRUM](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/evidence-of-execution/srum.md)
- [Persistence and Lateral Movement](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/persistence-and-lateral-movement.md)
- [Services and Scheduled](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/persistence-and-lateral-movement/services-and-scheduled.md)
- [LSASS, NTDS.dit & WDigest](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/persistence-and-lateral-movement/lsass-ntds.dit-and-wdigest.md)
- [SMB, RDP, WMI, PsExec & UAL](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/persistence-and-lateral-movement/smb-rdp-wmi-psexec-and-ual.md)
- [Anatomy of NTFS](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/anatomy-of-ntfs.md)
- [Metafiles, MFT, Journaling, ADS](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/anatomy-of-ntfs/metafiles-mft-journaling-ads.md)
- [MACB Timestamps](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/anatomy-of-ntfs/macb-timestamps.md)
- [Parsing the MFT and USN Journal](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/anatomy-of-ntfs/parsing-the-mft-and-usn-journal.md)
- [File Deletion and Recovery](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/file-deletion-and-recovery.md)
- [Recycle Bin](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/file-deletion-and-recovery/recycle-bin.md)
- [LNK Files and Jump Lists](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/lnk-files-and-jump-lists.md)
- [LNK Files](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/lnk-files-and-jump-lists/lnk-files.md)
- [Jump Lists](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/lnk-files-and-jump-lists/jump-lists.md)
- [User Behavior Forensics](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/user-behavior-forensics.md)
- [Shellbags](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/user-behavior-forensics/shellbags.md)
- [UserAssist](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/user-behavior-forensics/userassist.md)
- [Search History in File explorer](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/user-behavior-forensics/search-history-in-file-explorer.md)
- [JumpLists](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-endpoints/user-behavior-forensics/jumplists.md)
- [Investigating Windows Memory](/mynotes/certifications-and-notes/blue-team/dfir/investigating-windows-memory.md)
- [Investigating Linux Devices](/mynotes/certifications-and-notes/blue-team/dfir/investigating-linux-devices.md)
- [MacOS Forensics](/mynotes/certifications-and-notes/blue-team/dfir/macos-forensics.md)
