Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions defensive-security/dfir/malware-analysis/cheatsheet.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,15 +28,15 @@ layout:

### Table of Contents

1. [Analysis Workflow Overview](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#analysis-workflow-overview)
2. [Lab Setup & Safety](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#lab-setup--safety)
3. [Static Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#static-analysis)
4. [Dynamic Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#dynamic-analysis)
5. [Memory Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#memory-analysis)
6. [Network Analysis](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#network-analysis)
7. [Malware Type-Specific Workflows](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#malware-type-specific-workflows)
8. [Tool Reference Guide](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#tool-reference-guide)
9. [IOC Extraction & Reporting](https://claude.ai/chat/e1d5f7be-4bac-451f-8c28-60be45ba3edc#ioc-extraction--reporting)
1. [Analysis Workflow Overview](#analysis-workflow-overview)
2. [Lab Setup & Safety](#lab-setup--safety)
3. [Static Analysis](#static-analysis)
4. [Dynamic Analysis](#dynamic-analysis)
5. [Memory Analysis](#memory-analysis)
6. [Network Analysis](#network-analysis)
7. [Malware Type-Specific Workflows](#malware-type-specific-workflows)
8. [Tool Reference Guide](#tool-reference-guide)
9. [IOC Extraction & Reporting](#ioc-extraction--reporting)

***

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,16 @@

### 📚 Table of Contents

1. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework)
2. [Account Usage Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#account-usage-investigation)
3. [Lateral Movement Detection](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#lateral-movement-detection)
4. [Persistence Mechanisms](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#persistence-mechanisms)
5. [Privilege Escalation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#privilege-escalation)
6. [PowerShell & WMI Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#powershell--wmi-analysis)
7. [Malware Execution Evidence](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#malware-execution-evidence)
8. [Event Log Collection](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#event-log-collection)
9. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference)
10. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks)
1. [Investigation Framework](#investigation-framework)
2. [Account Usage Investigation](#account-usage-investigation)
3. [Lateral Movement Detection](#lateral-movement-detection)
4. [Persistence Mechanisms](#persistence-mechanisms)
5. [Privilege Escalation](#privilege-escalation)
6. [PowerShell & WMI Analysis](#powershell--wmi-analysis)
7. [Malware Execution Evidence](#malware-execution-evidence)
8. [Event Log Collection](#event-log-collection)
9. [Tool Reference](#tool-reference)
10. [Investigation Playbooks](#investigation-playbooks)

***

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,16 @@

### 📚 Table of Contents

1. [Artifact Priority Matrix](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#artifact-priority-matrix)
2. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework)
3. [MRU Artifacts Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#mru-artifacts-analysis)
4. [Recent Files Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#recent-files-analysis)
5. [LNK Files Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#lnk-files-analysis)
6. [Office Artifacts Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#office-artifacts-analysis)
7. [Deleted Items Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#deleted-items-investigation)
8. [Search and Navigation History](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#search-and-navigation-history)
9. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks)
10. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference)
1. [Artifact Priority Matrix](#artifact-priority-matrix)
2. [Investigation Framework](#investigation-framework)
3. [MRU Artifacts Analysis](#mru-artifacts-analysis)
4. [Recent Files Analysis](#recent-files-analysis)
5. [LNK Files Analysis](#lnk-files-analysis)
6. [Office Artifacts Analysis](#office-artifacts-analysis)
7. [Deleted Items Investigation](#deleted-items-investigation)
8. [Search and Navigation History](#search-and-navigation-history)
9. [Investigation Playbooks](#investigation-playbooks)
10. [Tool Reference](#tool-reference)

***

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,15 @@

### 📚 Table of Contents

1. [Investigation Framework](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-framework)
2. [Browser History Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#browser-history-analysis)
3. [Download History Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#download-history-analysis)
4. [Internet Explorer/Edge File Access](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#internet-exploreredge-file-access)
5. [Email Attachments Investigation](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#email-attachments-investigation)
6. [Cross-Browser Analysis](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#cross-browser-analysis)
7. [Investigation Playbooks](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#investigation-playbooks)
8. [Tool Reference](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#tool-reference)
9. [Quick Reference Cards](https://claude.ai/chat/a68948bd-1cb3-4710-bb7f-5de81727a337#quick-reference-cards)
1. [Investigation Framework](#investigation-framework)
2. [Browser History Analysis](#browser-history-analysis)
3. [Download History Analysis](#download-history-analysis)
4. [Internet Explorer/Edge File Access](#internet-exploreredge-file-access)
5. [Email Attachments Investigation](#email-attachments-investigation)
6. [Cross-Browser Analysis](#cross-browser-analysis)
7. [Investigation Playbooks](#investigation-playbooks)
8. [Tool Reference](#tool-reference)
9. [Quick Reference Cards](#quick-reference-cards)

***

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,15 @@

### Table of Contents

1. [Pre-Engagement](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#pre-engagement)
2. [Initial Enumeration](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#initial-enumeration)
3. [Credential Gathering](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#credential-gathering)
4. [Lateral Movement](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#lateral-movement)
5. [Privilege Escalation](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#privilege-escalation)
6. [Persistence](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#persistence)
7. [Domain Dominance](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#domain-dominance)
8. [Post-Exploitation](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#post-exploitation)
9. [Cleanup](https://claude.ai/chat/dbfb5a98-e7e7-4e53-9335-602d5f57afed#cleanup)
1. [Pre-Engagement](#pre-engagement)
2. [Initial Enumeration](#initial-enumeration)
3. [Credential Gathering](#credential-gathering)
4. [Lateral Movement](#lateral-movement)
5. [Privilege Escalation](#privilege-escalation)
6. [Persistence](#persistence)
7. [Domain Dominance](#domain-dominance)
8. [Post-Exploitation](#post-exploitation)
9. [Cleanup](#cleanup)

***

Expand Down
7 changes: 7 additions & 0 deletions scripts/check_editorial.py
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,13 @@ def main():
found = PATTERN.search(added)
if "—" in added or found:
issues.append((path, added[:180]))
# A public knowledge base should not link its table of contents to private AI chats.
for markdown in pathlib.Path(".").rglob("*.md"):
if ".git" in markdown.parts:
continue
body = markdown.read_text(encoding="utf-8", errors="replace")
if re.search(r"https?://(?:claude\.ai/chat|chatgpt\.com/c/|chat\.openai\.com/c/)", body, re.I):
issues.append((str(markdown), "Public page contains an AI chat-session URL"))
for path, excerpt in issues:
print(f"Editorial review required: {path}: {excerpt}")
if issues:
Expand Down
Loading