🖥️
Windows DFIR
⌘Ctrlk
🖥️
Windows DFIR
  • Introduction
    • Windows Quick Tips
    • Account Usage
    • Browser Usage
    • Processes
    • Cloud Storage
    • Deleted File or File Knowledge
    • File Download
    • Folder/File Opening/Creation
    • Persistence
      • Registry
      • Scheduled Tasks
      • Startup
      • Tool: AutoRuns
      • Accounts
      • WMI Event Consumers
      • PowerShell Scripts
      • CrowdStrike Searches
        • Files Written to Startup Folder
        • Files Written to Startup Folder from the Internet
        • Local Account Creation/Deletion
        • Azure Account Creation/Deletion
        • Scheduled Tasks
    • Physical Location
    • Program Execution
    • Shadow Copies
    • USB Usage
    • Windows Services
    • System Information
    • Event IDs
    • Initial Access
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
    • Discovery
    • Lateral Movement
    • Collection
    • Command and Control
    • Exfiltration
    • Impact
    • Cached Credentials
    • Domain Controller Password Spraying
Powered by GitBook
For the complete documentation index, see llms.txt. This page is also available as Markdown.
  1. Windows Artifacts
  2. Persistence

CrowdStrike Searches

Files Written to Startup FolderFiles Written to Startup Folder from the InternetLocal Account Creation/DeletionAzure Account Creation/DeletionScheduled Tasks
PreviousStartup ProgramsNextFiles Written to Startup Folder

Last updated 2 years ago