From 5cc543231c8e1af012a83155c12be590a0c34825 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:08:21 +0100 Subject: [PATCH 1/6] docs: remove AI chat session links from public reference contents --- .../dfir/malware-analysis/cheatsheet.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/defensive-security/dfir/malware-analysis/cheatsheet.md b/defensive-security/dfir/malware-analysis/cheatsheet.md index 9fe5af4..9162c5a 100644 --- a/defensive-security/dfir/malware-analysis/cheatsheet.md +++ b/defensive-security/dfir/malware-analysis/cheatsheet.md @@ -28,15 +28,15 @@ layout: ### Table of Contents -1. [Analysis Workflow Overview](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#analysis-workflow-overview) -2. [Lab Setup & Safety](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#lab-setup--safety) -3. [Static Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#static-analysis) -4. [Dynamic Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#dynamic-analysis) -5. [Memory Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#memory-analysis) -6. [Network Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#network-analysis) -7. [Malware Type-Specific Workflows](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#malware-type-specific-workflows) -8. [Tool Reference Guide](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#tool-reference-guide) -9. [IOC Extraction & Reporting](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#ioc-extraction--reporting) +1. [Analysis Workflow Overview](#analysis-workflow-overview) +2. [Lab Setup & Safety](#lab-setup--safety) +3. [Static Analysis](#static-analysis) +4. [Dynamic Analysis](#dynamic-analysis) +5. [Memory Analysis](#memory-analysis) +6. [Network Analysis](#network-analysis) +7. [Malware Type-Specific Workflows](#malware-type-specific-workflows) +8. [Tool Reference Guide](#tool-reference-guide) +9. [IOC Extraction & Reporting](#ioc-extraction--reporting) *** From 09e0fc45240c4bf6e1dd5223fcebea7c3fbe2516 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:08:24 +0100 Subject: [PATCH 2/6] docs: remove AI chat session links from public reference contents --- ...e-and-folder-access-investigation-guide.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/defensive-security/dfir/window-forensics/file-and-folder-access-investigation-guide.md b/defensive-security/dfir/window-forensics/file-and-folder-access-investigation-guide.md index d2d76fd..7d34600 100644 --- a/defensive-security/dfir/window-forensics/file-and-folder-access-investigation-guide.md +++ b/defensive-security/dfir/window-forensics/file-and-folder-access-investigation-guide.md @@ -6,16 +6,16 @@ ### 📚 Table of Contents -1. [Artifact Priority Matrix](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#artifact-priority-matrix) -2. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework) -3. [MRU Artifacts Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#mru-artifacts-analysis) -4. [Recent Files Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#recent-files-analysis) -5. [LNK Files Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#lnk-files-analysis) -6. [Office Artifacts Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#office-artifacts-analysis) -7. [Deleted Items Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#deleted-items-investigation) -8. [Search and Navigation History](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#search-and-navigation-history) -9. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks) -10. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference) +1. [Artifact Priority Matrix](#artifact-priority-matrix) +2. [Investigation Framework](#investigation-framework) +3. [MRU Artifacts Analysis](#mru-artifacts-analysis) +4. [Recent Files Analysis](#recent-files-analysis) +5. [LNK Files Analysis](#lnk-files-analysis) +6. [Office Artifacts Analysis](#office-artifacts-analysis) +7. [Deleted Items Investigation](#deleted-items-investigation) +8. [Search and Navigation History](#search-and-navigation-history) +9. [Investigation Playbooks](#investigation-playbooks) +10. [Tool Reference](#tool-reference) *** From 5d5537d2b8592610ee05cb391cec8861e98e139b Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:08:28 +0100 Subject: [PATCH 3/6] docs: remove AI chat session links from public reference contents --- ...d-windows-event-log-investigation-guide.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/defensive-security/dfir/window-forensics/enhanced-windows-event-log-investigation-guide.md b/defensive-security/dfir/window-forensics/enhanced-windows-event-log-investigation-guide.md index 3b1e36d..90e9c17 100644 --- a/defensive-security/dfir/window-forensics/enhanced-windows-event-log-investigation-guide.md +++ b/defensive-security/dfir/window-forensics/enhanced-windows-event-log-investigation-guide.md @@ -6,16 +6,16 @@ ### 📚 Table of Contents -1. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework) -2. [Account Usage Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#account-usage-investigation) -3. [Lateral Movement Detection](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#lateral-movement-detection) -4. [Persistence Mechanisms](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#persistence-mechanisms) -5. [Privilege Escalation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#privilege-escalation) -6. [PowerShell & WMI Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#powershell--wmi-analysis) -7. [Malware Execution Evidence](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#malware-execution-evidence) -8. [Event Log Collection](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#event-log-collection) -9. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference) -10. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks) +1. [Investigation Framework](#investigation-framework) +2. [Account Usage Investigation](#account-usage-investigation) +3. [Lateral Movement Detection](#lateral-movement-detection) +4. [Persistence Mechanisms](#persistence-mechanisms) +5. [Privilege Escalation](#privilege-escalation) +6. [PowerShell & WMI Analysis](#powershell--wmi-analysis) +7. [Malware Execution Evidence](#malware-execution-evidence) +8. [Event Log Collection](#event-log-collection) +9. [Tool Reference](#tool-reference) +10. [Investigation Playbooks](#investigation-playbooks) *** From 1f098c21457a48fffb8b2808b05a6988daef2f79 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:08:31 +0100 Subject: [PATCH 4/6] docs: remove AI chat session links from public reference contents --- ...and-browser-activity-investigation-guide.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/defensive-security/dfir/window-forensics/file-download-and-browser-activity-investigation-guide.md b/defensive-security/dfir/window-forensics/file-download-and-browser-activity-investigation-guide.md index 9a599c7..834bb22 100644 --- a/defensive-security/dfir/window-forensics/file-download-and-browser-activity-investigation-guide.md +++ b/defensive-security/dfir/window-forensics/file-download-and-browser-activity-investigation-guide.md @@ -6,15 +6,15 @@ ### 📚 Table of Contents -1. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework) -2. [Browser History Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#browser-history-analysis) -3. [Download History Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#download-history-analysis) -4. [Internet Explorer/Edge File Access](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#internet-exploreredge-file-access) -5. [Email Attachments Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#email-attachments-investigation) -6. [Cross-Browser Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#cross-browser-analysis) -7. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks) -8. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference) -9. [Quick Reference Cards](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#quick-reference-cards) +1. [Investigation Framework](#investigation-framework) +2. [Browser History Analysis](#browser-history-analysis) +3. [Download History Analysis](#download-history-analysis) +4. [Internet Explorer/Edge File Access](#internet-exploreredge-file-access) +5. [Email Attachments Investigation](#email-attachments-investigation) +6. [Cross-Browser Analysis](#cross-browser-analysis) +7. [Investigation Playbooks](#investigation-playbooks) +8. [Tool Reference](#tool-reference) +9. [Quick Reference Cards](#quick-reference-cards) *** From e44e1e502ae4b772347623a528c046d0e7c8f94c Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:08:35 +0100 Subject: [PATCH 5/6] docs: remove AI chat session links from public reference contents --- ...ctory-pentesting-workflow-and-cheatsheet.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/offensive-security/hacking/exploitation-and-lateral-movement/active-directory-pentesting-workflow-and-cheatsheet.md b/offensive-security/hacking/exploitation-and-lateral-movement/active-directory-pentesting-workflow-and-cheatsheet.md index a31c8d5..4278d4a 100644 --- a/offensive-security/hacking/exploitation-and-lateral-movement/active-directory-pentesting-workflow-and-cheatsheet.md +++ b/offensive-security/hacking/exploitation-and-lateral-movement/active-directory-pentesting-workflow-and-cheatsheet.md @@ -2,15 +2,15 @@ ### Table of Contents -1. [Pre-Engagement](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#pre-engagement) -2. [Initial Enumeration](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#initial-enumeration) -3. [Credential Gathering](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#credential-gathering) -4. [Lateral Movement](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#lateral-movement) -5. [Privilege Escalation](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#privilege-escalation) -6. [Persistence](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#persistence) -7. [Domain Dominance](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#domain-dominance) -8. [Post-Exploitation](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#post-exploitation) -9. [Cleanup](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#cleanup) +1. [Pre-Engagement](#pre-engagement) +2. [Initial Enumeration](#initial-enumeration) +3. [Credential Gathering](#credential-gathering) +4. [Lateral Movement](#lateral-movement) +5. [Privilege Escalation](#privilege-escalation) +6. [Persistence](#persistence) +7. [Domain Dominance](#domain-dominance) +8. [Post-Exploitation](#post-exploitation) +9. [Cleanup](#cleanup) *** From 600895614ff98688acd597a7f55d7716ab9c6cea Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:08:56 +0100 Subject: [PATCH 6/6] ci: reject AI chat-session links in public documentation --- scripts/check_editorial.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/scripts/check_editorial.py b/scripts/check_editorial.py index 8b267af..5730b18 100644 --- a/scripts/check_editorial.py +++ b/scripts/check_editorial.py @@ -41,6 +41,13 @@ def main(): found = PATTERN.search(added) if "—" in added or found: issues.append((path, added[:180])) + # A public knowledge base should not link its table of contents to private AI chats. + for markdown in pathlib.Path(".").rglob("*.md"): + if ".git" in markdown.parts: + continue + body = markdown.read_text(encoding="utf-8", errors="replace") + if re.search(r"https?://(?:claude\.ai/chat|chatgpt\.com/c/|chat\.openai\.com/c/)", body, re.I): + issues.append((str(markdown), "Public page contains an AI chat-session URL")) for path, excerpt in issues: print(f"Editorial review required: {path}: {excerpt}") if issues: