🖥️
Windows DFIR
search
⌘Ctrlk
🖥️
Windows DFIR
  • Introduction
  • Windows Artifacts
    • Windows Quick Tips
    • Account Usage
    • Browser Usage
      • History & Downloads
      • Auto-Complete Data
      • Bookmarks
      • Browser Preferences
      • Cache
      • Cookies
      • Extensions
      • Super Cookies (HTML5 Web Storage)
      • Media History
      • Private Browsing
      • Session Restore
      • Stored Credentials
      • Suggested/Frequent Sites
      • DB Browser Queries
      • PowerShell Scripts
    • Processes
    • Cloud Storage
    • Deleted File or File Knowledge
    • File Download
    • Folder/File Opening/Creation
    • Persistence
    • Physical Location
    • Program Execution
    • Shadow Copies
    • USB Usage
    • Windows Services
    • System Information
    • Event IDs
  • Windows DFIR & MITTR
    • Initial Access
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
    • Discovery
    • Lateral Movement
    • Collection
    • Command and Control
    • Exfiltration
    • Impact
  • SOC Related
    • Cached Credentials
    • Domain Controller Password Spraying
gitbookPowered by GitBook
Page cover
block-quoteOn this pagechevron-down
  1. Windows Artifacts

Browser Usage

History & Downloadschevron-rightAuto-Complete Datachevron-rightBookmarkschevron-rightBrowser Preferenceschevron-rightCachechevron-rightCookieschevron-rightExtensionschevron-rightSuper Cookies (HTML5 Web Storage)chevron-rightMedia Historychevron-rightPrivate Browsingchevron-rightSession Restorechevron-rightStored Credentialschevron-rightSuggested/Frequent Siteschevron-rightDB Browser Querieschevron-rightPowerShell Scriptschevron-right
PreviousEvent Name - SsoApplicationAccesschevron-leftNextHistory & Downloadschevron-right

Last updated 1 year ago