diff --git a/defensive-security/dfir/malware-analysis/cheatsheet.md b/defensive-security/dfir/malware-analysis/cheatsheet.md index 9fe5af4..9162c5a 100644 --- a/defensive-security/dfir/malware-analysis/cheatsheet.md +++ b/defensive-security/dfir/malware-analysis/cheatsheet.md @@ -28,15 +28,15 @@ layout: ### Table of Contents -1. [Analysis Workflow Overview](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#analysis-workflow-overview) -2. [Lab Setup & Safety](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#lab-setup--safety) -3. [Static Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#static-analysis) -4. [Dynamic Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#dynamic-analysis) -5. [Memory Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#memory-analysis) -6. [Network Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#network-analysis) -7. [Malware Type-Specific Workflows](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#malware-type-specific-workflows) -8. [Tool Reference Guide](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#tool-reference-guide) -9. [IOC Extraction & Reporting](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#ioc-extraction--reporting) +1. [Analysis Workflow Overview](#analysis-workflow-overview) +2. [Lab Setup & Safety](#lab-setup--safety) +3. [Static Analysis](#static-analysis) +4. [Dynamic Analysis](#dynamic-analysis) +5. [Memory Analysis](#memory-analysis) +6. [Network Analysis](#network-analysis) +7. [Malware Type-Specific Workflows](#malware-type-specific-workflows) +8. [Tool Reference Guide](#tool-reference-guide) +9. [IOC Extraction & Reporting](#ioc-extraction--reporting) *** diff --git a/defensive-security/dfir/window-forensics/enhanced-windows-event-log-investigation-guide.md b/defensive-security/dfir/window-forensics/enhanced-windows-event-log-investigation-guide.md index 3b1e36d..90e9c17 100644 --- a/defensive-security/dfir/window-forensics/enhanced-windows-event-log-investigation-guide.md +++ b/defensive-security/dfir/window-forensics/enhanced-windows-event-log-investigation-guide.md @@ -6,16 +6,16 @@ ### 📚 Table of Contents -1. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework) -2. [Account Usage Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#account-usage-investigation) -3. [Lateral Movement Detection](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#lateral-movement-detection) -4. [Persistence Mechanisms](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#persistence-mechanisms) -5. [Privilege Escalation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#privilege-escalation) -6. [PowerShell & WMI Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#powershell--wmi-analysis) -7. [Malware Execution Evidence](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#malware-execution-evidence) -8. [Event Log Collection](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#event-log-collection) -9. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference) -10. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks) +1. [Investigation Framework](#investigation-framework) +2. [Account Usage Investigation](#account-usage-investigation) +3. [Lateral Movement Detection](#lateral-movement-detection) +4. [Persistence Mechanisms](#persistence-mechanisms) +5. [Privilege Escalation](#privilege-escalation) +6. [PowerShell & WMI Analysis](#powershell--wmi-analysis) +7. [Malware Execution Evidence](#malware-execution-evidence) +8. [Event Log Collection](#event-log-collection) +9. [Tool Reference](#tool-reference) +10. [Investigation Playbooks](#investigation-playbooks) *** diff --git a/defensive-security/dfir/window-forensics/file-and-folder-access-investigation-guide.md b/defensive-security/dfir/window-forensics/file-and-folder-access-investigation-guide.md index d2d76fd..7d34600 100644 --- a/defensive-security/dfir/window-forensics/file-and-folder-access-investigation-guide.md +++ b/defensive-security/dfir/window-forensics/file-and-folder-access-investigation-guide.md @@ -6,16 +6,16 @@ ### 📚 Table of Contents -1. [Artifact Priority Matrix](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#artifact-priority-matrix) -2. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework) -3. [MRU Artifacts Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#mru-artifacts-analysis) -4. [Recent Files Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#recent-files-analysis) -5. [LNK Files Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#lnk-files-analysis) -6. [Office Artifacts Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#office-artifacts-analysis) -7. [Deleted Items Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#deleted-items-investigation) -8. [Search and Navigation History](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#search-and-navigation-history) -9. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks) -10. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference) +1. [Artifact Priority Matrix](#artifact-priority-matrix) +2. [Investigation Framework](#investigation-framework) +3. [MRU Artifacts Analysis](#mru-artifacts-analysis) +4. [Recent Files Analysis](#recent-files-analysis) +5. [LNK Files Analysis](#lnk-files-analysis) +6. [Office Artifacts Analysis](#office-artifacts-analysis) +7. [Deleted Items Investigation](#deleted-items-investigation) +8. [Search and Navigation History](#search-and-navigation-history) +9. [Investigation Playbooks](#investigation-playbooks) +10. [Tool Reference](#tool-reference) *** diff --git a/defensive-security/dfir/window-forensics/file-download-and-browser-activity-investigation-guide.md b/defensive-security/dfir/window-forensics/file-download-and-browser-activity-investigation-guide.md index 9a599c7..834bb22 100644 --- a/defensive-security/dfir/window-forensics/file-download-and-browser-activity-investigation-guide.md +++ b/defensive-security/dfir/window-forensics/file-download-and-browser-activity-investigation-guide.md @@ -6,15 +6,15 @@ ### 📚 Table of Contents -1. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework) -2. [Browser History Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#browser-history-analysis) -3. [Download History Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#download-history-analysis) -4. [Internet Explorer/Edge File Access](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#internet-exploreredge-file-access) -5. [Email Attachments Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#email-attachments-investigation) -6. [Cross-Browser Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#cross-browser-analysis) -7. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks) -8. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference) -9. [Quick Reference Cards](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#quick-reference-cards) +1. [Investigation Framework](#investigation-framework) +2. [Browser History Analysis](#browser-history-analysis) +3. [Download History Analysis](#download-history-analysis) +4. [Internet Explorer/Edge File Access](#internet-exploreredge-file-access) +5. [Email Attachments Investigation](#email-attachments-investigation) +6. [Cross-Browser Analysis](#cross-browser-analysis) +7. [Investigation Playbooks](#investigation-playbooks) +8. [Tool Reference](#tool-reference) +9. [Quick Reference Cards](#quick-reference-cards) *** diff --git a/offensive-security/hacking/exploitation-and-lateral-movement/active-directory-pentesting-workflow-and-cheatsheet.md b/offensive-security/hacking/exploitation-and-lateral-movement/active-directory-pentesting-workflow-and-cheatsheet.md index a31c8d5..4278d4a 100644 --- a/offensive-security/hacking/exploitation-and-lateral-movement/active-directory-pentesting-workflow-and-cheatsheet.md +++ b/offensive-security/hacking/exploitation-and-lateral-movement/active-directory-pentesting-workflow-and-cheatsheet.md @@ -2,15 +2,15 @@ ### Table of Contents -1. [Pre-Engagement](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#pre-engagement) -2. [Initial Enumeration](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#initial-enumeration) -3. [Credential Gathering](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#credential-gathering) -4. [Lateral Movement](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#lateral-movement) -5. [Privilege Escalation](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#privilege-escalation) -6. [Persistence](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#persistence) -7. [Domain Dominance](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#domain-dominance) -8. [Post-Exploitation](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#post-exploitation) -9. [Cleanup](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#cleanup) +1. [Pre-Engagement](#pre-engagement) +2. [Initial Enumeration](#initial-enumeration) +3. [Credential Gathering](#credential-gathering) +4. [Lateral Movement](#lateral-movement) +5. [Privilege Escalation](#privilege-escalation) +6. [Persistence](#persistence) +7. [Domain Dominance](#domain-dominance) +8. [Post-Exploitation](#post-exploitation) +9. [Cleanup](#cleanup) *** diff --git a/scripts/check_editorial.py b/scripts/check_editorial.py index 8b267af..5730b18 100644 --- a/scripts/check_editorial.py +++ b/scripts/check_editorial.py @@ -41,6 +41,13 @@ def main(): found = PATTERN.search(added) if "—" in added or found: issues.append((path, added[:180])) + # A public knowledge base should not link its table of contents to private AI chats. + for markdown in pathlib.Path(".").rglob("*.md"): + if ".git" in markdown.parts: + continue + body = markdown.read_text(encoding="utf-8", errors="replace") + if re.search(r"https?://(?:claude\.ai/chat|chatgpt\.com/c/|chat\.openai\.com/c/)", body, re.I): + issues.append((str(markdown), "Public page contains an AI chat-session URL")) for path, excerpt in issues: print(f"Editorial review required: {path}: {excerpt}") if issues: