{"version":1,"pages":[{"id":"DbwnAnJuzoq7Cf27LWaq","title":"Introduction","pathname":"/","siteSpaceId":"sitesp_V3fPT"},{"id":"EdkL5ufxvLutawdVUOPk","title":"Windows Quick Tips","pathname":"/windows-artifacts/windows-quick-tips","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"7BZAaG6hf2jB2WnJDWBb","title":"Windows Command Line","pathname":"/windows-artifacts/windows-quick-tips/windows-command-line","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Windows Quick Tips"}]},{"id":"2GMikxIXBrEYFjuxjJ54","title":"Workstation File/Folder Locations","pathname":"/windows-artifacts/windows-quick-tips/workstation-file-folder-locations","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Windows Quick Tips"}]},{"id":"ar5fS0I8djTscR0htXfP","title":"Server File/Folder Locations","pathname":"/windows-artifacts/windows-quick-tips/server-file-folder-locations","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Windows Quick Tips"}]},{"id":"V59acu12Vkqc0oMaz2Cx","title":"Account Usage","pathname":"/windows-artifacts/account-usage","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"TlRXCGV6P1nMGzq7a54N","title":"Authentications SAM Artifacts","pathname":"/windows-artifacts/account-usage/authentications-sam-artifacts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"}]},{"id":"jKlg8NFQU8gDjjd2ML59","title":"Last Login","pathname":"/windows-artifacts/account-usage/authentications-sam-artifacts/last-login","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"Authentications SAM Artifacts"}]},{"id":"KKxUls7UPSHXKiJuyFq5","title":"Last Failed Login","pathname":"/windows-artifacts/account-usage/authentications-sam-artifacts/last-failed-login","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"Authentications SAM Artifacts"}]},{"id":"gNMdmY17eux73fX7YdKs","title":"Last Password Change","pathname":"/windows-artifacts/account-usage/authentications-sam-artifacts/last-password-change","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"Authentications SAM Artifacts"}]},{"id":"qTisreKPMSUlA5JgFR8E","title":"Authentications (Windows Event Log)","pathname":"/windows-artifacts/account-usage/authentications-windows-event-log","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"}]},{"id":"E7m38Egd7pmk24I7HdLU","title":"Logon ID","pathname":"/windows-artifacts/account-usage/authentications-windows-event-log/logon-id","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"Authentications (Windows Event Log)"}]},{"id":"b9zCloqqLwHyclEVZ4KV","title":"Group Membership","pathname":"/windows-artifacts/account-usage/group-membership","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"}]},{"id":"hzUCmrvQE0qX8Rexyv0v","title":"Event ID: 4798","pathname":"/windows-artifacts/account-usage/group-membership/event-id-4798","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"Group Membership"}]},{"id":"RFyRgoyQPbAlFX12hiPS","title":"Event ID: 4799","pathname":"/windows-artifacts/account-usage/group-membership/event-id-4799","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"Group Membership"}]},{"id":"ITuWAzmoEtzXe7CU53En","title":"RDP","pathname":"/windows-artifacts/account-usage/rdp","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"}]},{"id":"xhDlpJ1tqALN27sprBhd","title":"Source System Artifacts - Quick Reference","pathname":"/windows-artifacts/account-usage/rdp/source-system-artifacts-quick-reference","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"RDP"}]},{"id":"3qwRvnFkAh80fW76OnKU","title":"Destination System Artifacts - Quick Reference","pathname":"/windows-artifacts/account-usage/rdp/destination-system-artifacts-quick-reference","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"RDP"}]},{"id":"BFDbz0qQ6GzBeFMhmlaK","title":"SSH","pathname":"/windows-artifacts/account-usage/ssh","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"}]},{"id":"vMXWvE8RpmBu3y7wSFIA","title":"Rouge Local Accounts","pathname":"/windows-artifacts/account-usage/rouge-local-accounts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"}]},{"id":"lD521Meq2Vo6gqzJJYbm","title":"CrowdStrike Searches","pathname":"/windows-artifacts/account-usage/crowdstrike-searches","siteSpaceId":"sitesp_V3fPT","description":"","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"}]},{"id":"2t8fbXx5NSS2SySGAwIo","title":"Event Name - UserLogon","pathname":"/windows-artifacts/account-usage/crowdstrike-searches/event-name-userlogon","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"CrowdStrike Searches"}]},{"id":"P8x0mCGUygzBroWhTo92","title":"Event Name - UserLogonFailed","pathname":"/windows-artifacts/account-usage/crowdstrike-searches/event-name-userlogonfailed","siteSpaceId":"sitesp_V3fPT","description":"UserLogonFailed2 will aggregate data from Falcon and Windows ETW when available (assuming you're using a more modern Windows operating system) and UserLongFailed will rely exclusively on Falcon data.","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"CrowdStrike Searches"}]},{"id":"e784g41ddE4rkY3LOceh","title":"Event Name - UserLogonFailed2","pathname":"/windows-artifacts/account-usage/crowdstrike-searches/event-name-userlogonfailed2","siteSpaceId":"sitesp_V3fPT","description":"UserLogonFailed2 will aggregate data from Falcon and Windows ETW when available (assuming you're using a more modern Windows operating system) and UserLongFailed will rely exclusively on Falcon data.","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"CrowdStrike Searches"}]},{"id":"TFhaJsuMcGYXCojaNCD5","title":"Event Name - SsoApplicationAccess","pathname":"/windows-artifacts/account-usage/crowdstrike-searches/event-name-ssoapplicationaccess","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Account Usage"},{"label":"CrowdStrike Searches"}]},{"id":"POuBt04rOVgHT5Ye1gfQ","title":"Browser Usage","pathname":"/windows-artifacts/browser-usage","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"Qu0qs2XyYFNZFUmS4TQl","title":"History & Downloads","pathname":"/windows-artifacts/browser-usage/history-and-downloads","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"jhcmw801PVaRGQCLtZ8o","title":"Viewing History Files - DB Browser","pathname":"/windows-artifacts/browser-usage/history-and-downloads/viewing-history-files-db-browser","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"},{"label":"History & Downloads"}]},{"id":"o1tfH3X7OpouPjIfyK81","title":"Transition Types","pathname":"/windows-artifacts/browser-usage/history-and-downloads/transition-types","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"},{"label":"History & Downloads"}]},{"id":"CYDPXiwrW57kVlTrGRZN","title":"Auto-Complete Data","pathname":"/windows-artifacts/browser-usage/auto-complete-data","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"QdyCLAQXjaeSRNreecJR","title":"Bookmarks","pathname":"/windows-artifacts/browser-usage/bookmarks","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"zrC1RGgVua9vfAGBtvdh","title":"Browser Preferences","pathname":"/windows-artifacts/browser-usage/browser-preferences","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"hiYDtN0EwhBCm5xp1eld","title":"Cache","pathname":"/windows-artifacts/browser-usage/cache","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"fVe5qtlb9YHxeOCkweje","title":"Cookies","pathname":"/windows-artifacts/browser-usage/cookies","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"h6nCdaRiReLqg58xFvJl","title":"Extensions","pathname":"/windows-artifacts/browser-usage/extensions","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"sLy4ZK6oA6Ra1DxL1Q0X","title":"Super Cookies (HTML5 Web Storage)","pathname":"/windows-artifacts/browser-usage/super-cookies-html5-web-storage","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"tR3PZxnT8aPkhFhucSIV","title":"Media History","pathname":"/windows-artifacts/browser-usage/media-history","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"mb582TzScMgqum9wi3Eh","title":"Private Browsing","pathname":"/windows-artifacts/browser-usage/private-browsing","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"sYHQmQVUfDor3WxCtApV","title":"Session Restore","pathname":"/windows-artifacts/browser-usage/session-restore","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"HstcyLyqYYHcskf1mjqd","title":"Stored Credentials","pathname":"/windows-artifacts/browser-usage/stored-credentials","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"GyxAKwWUleVirhHwL67m","title":"Suggested/Frequent Sites","pathname":"/windows-artifacts/browser-usage/suggested-frequent-sites","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"fIqdDDdXAw65qQStUjqU","title":"DB Browser Queries","pathname":"/windows-artifacts/browser-usage/db-browser-queries","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"0vtqlI2fBFJyoWhHv0WY","title":"Firefox","pathname":"/windows-artifacts/browser-usage/db-browser-queries/firefox","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"},{"label":"DB Browser Queries"}]},{"id":"UwJTWRh0SGBLB0Uq53XN","title":"Chrome","pathname":"/windows-artifacts/browser-usage/db-browser-queries/chrome","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"},{"label":"DB Browser Queries"}]},{"id":"SAVADIAcZEAlyEJxtjWe","title":"Media History","pathname":"/windows-artifacts/browser-usage/db-browser-queries/media-history","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"},{"label":"DB Browser Queries"}]},{"id":"WewewKrzx17vSroLOgx1","title":"PowerShell Scripts","pathname":"/windows-artifacts/browser-usage/powershell-scripts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"}]},{"id":"jlQvwWcLZL9j0kHkiIzM","title":"Browser Extension Finder","pathname":"/windows-artifacts/browser-usage/powershell-scripts/browser-extension-finder","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"},{"label":"PowerShell Scripts"}]},{"id":"us6zYT3GZ54YkZrwXXsl","title":"Browser History Finder","pathname":"/windows-artifacts/browser-usage/powershell-scripts/browser-history-finder","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Browser Usage"},{"label":"PowerShell Scripts"}]},{"id":"EfC4rzhwTg9vLL7P47OZ","title":"Processes","pathname":"/windows-artifacts/processes","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"P8pXWy3mgV2iMLKkLelZ","title":"at.exe","pathname":"/windows-artifacts/processes/at.exe","siteSpaceId":"sitesp_V3fPT","description":"Superseded by schtasks.exe in later versions of Windows, understanding at.exe remains relevant for analyzing older systems.","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"FaYdHjycz6UqFNkaUnzu","title":"explorer.exe","pathname":"/windows-artifacts/processes/explorer.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"O5a6EsoqKJ1kAzzXCYCN","title":"lsass.exe","pathname":"/windows-artifacts/processes/lsass.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"FKZkX5LhXIWHJA99XdzN","title":"lsaiso.exe","pathname":"/windows-artifacts/processes/lsaiso.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"4BRiCkoAtvBOa2ENaAq2","title":"PuTTy.exe","pathname":"/windows-artifacts/processes/putty.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"vegNoRrKgoLO9Fv9A5X1","title":"X11 Forwarding","pathname":"/windows-artifacts/processes/putty.exe/x11-forwarding","siteSpaceId":"sitesp_V3fPT","description":"","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"},{"label":"PuTTy.exe"}]},{"id":"Edp3irDtHNKIZ5ipYWUS","title":"runtimebroker.exe","pathname":"/windows-artifacts/processes/runtimebroker.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"bZZIsaQvpjiI0BI0pN33","title":"services.exe","pathname":"/windows-artifacts/processes/services.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"NJvsULy51Q2z3MCunHQF","title":"smss.exe","pathname":"/windows-artifacts/processes/smss.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"ZhSqqhQDBPeJG4rzuJDN","title":"System","pathname":"/windows-artifacts/processes/system","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"V2r4kVfnpKOO549iXchs","title":"svchost.exe","pathname":"/windows-artifacts/processes/svchost.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"KsWsWfkBUlTle64WpPti","title":"Services","pathname":"/windows-artifacts/processes/svchost.exe/services","siteSpaceId":"sitesp_V3fPT","description":"Common services seen running under svchost.exe","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"},{"label":"svchost.exe"}]},{"id":"jV0FJn6qQPe8uS4qKAib","title":"winlogon.exe","pathname":"/windows-artifacts/processes/winlogon.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"V2PzkyFC78u32pEIG2dU","title":"wininit.exe","pathname":"/windows-artifacts/processes/wininit.exe","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Processes"}]},{"id":"vdN2wolSTZ8ZND6S6RwV","title":"Cloud Storage","pathname":"/windows-artifacts/cloud-storage","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"tdlEpWurhxuqkOgBoYKj","title":"Deleted File or File Knowledge","pathname":"/windows-artifacts/deleted-file-or-file-knowledge","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"zgPp1F3qXbHDE8vcBXrn","title":"WordWheelQuery (Win 7+)","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/wordwheelquery-win-7+","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"WHMl25pHFzZHYwvhW5OO","title":"ACMRU (Win XP)","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/acmru-win-xp","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"zfIXicZyrz305k7P9wMm","title":"Internet Explorer file:///","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/internet-explorer-file","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"9YZZiqmF40usxu4pyOYX","title":"Last Visited MRU","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/last-visited-mru","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"Z60sJ1Mhlb2FAMZGNlCu","title":"Thumbs.db (Win XP)","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/thumbs.db-win-xp","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"sCd8cWBD0pTX9RV3zkzM","title":"Thumbcache","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/thumbcache","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"5zxznRHiHoH1ei9fOmAi","title":"Recycle Bin","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/recycle-bin","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"DEg8ggUtMdMSYeIEq2Y2","title":"User Typed Paths","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/user-typed-paths","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"HGUZvDpJZ13Vk2KqagSd","title":"Windows Search Database","pathname":"/windows-artifacts/deleted-file-or-file-knowledge/windows-search-database","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Deleted File or File Knowledge"}]},{"id":"FCmmpKxj0Kzxxk86T1fR","title":"File Download","pathname":"/windows-artifacts/file-download","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"kibTQTmcIGYnDhmiPU3t","title":"Zone.Identifier","pathname":"/windows-artifacts/file-download/zone.identifier","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"}]},{"id":"RD5cLwiSBqRwriY6fnxQ","title":"Open/Save Most Recently Used (MRU)","pathname":"/windows-artifacts/file-download/open-save-most-recently-used-mru","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"}]},{"id":"UTe33PnuiFxjpwMT4aF0","title":"Email","pathname":"/windows-artifacts/file-download/email","siteSpaceId":"sitesp_V3fPT","description":"","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"}]},{"id":"JjSj6L9dYCPtZc25dvch","title":"Drive By Downloads","pathname":"/windows-artifacts/file-download/drive-by-downloads","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"}]},{"id":"oIdzQaWhKKjtglGyzDpm","title":"Malvertising","pathname":"/windows-artifacts/file-download/drive-by-downloads/malvertising","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"},{"label":"Drive By Downloads"}]},{"id":"gake5FCG18FQD52ltkuS","title":"Web Browsing","pathname":"/windows-artifacts/file-download/web-browsing","siteSpaceId":"sitesp_V3fPT","description":"Some MacOS included in here as well","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"}]},{"id":"SijTxzW8brN18CvhjOcZ","title":"Cache Files","pathname":"/windows-artifacts/file-download/web-browsing/cache-files","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"},{"label":"Web Browsing"}]},{"id":"GN9oha9R9zyvLEqIT7nP","title":"CrowdStrike Searches","pathname":"/windows-artifacts/file-download/crowdstrike-searches","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"}]},{"id":"x66n5U4bA8EaLz1KjIxQ","title":"MoTW","pathname":"/windows-artifacts/file-download/crowdstrike-searches/motw","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"File Download"},{"label":"CrowdStrike Searches"}]},{"id":"I95Sv8dGgF5mOyraKGgP","title":"Folder/File Opening/Creation","pathname":"/windows-artifacts/folder-file-opening-creation","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"fAZXdGrGoEuzvw2XJyzd","title":"Recent Files","pathname":"/windows-artifacts/folder-file-opening-creation/recent-files","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"0rqWmcg0d9G7pGAWXpD9","title":"Office Recent Files","pathname":"/windows-artifacts/folder-file-opening-creation/office-recent-files","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"gUnPrn0GxycC9mvvDKZL","title":"Shell Bags","pathname":"/windows-artifacts/folder-file-opening-creation/shell-bags","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"0t3aofRYVL3uX88NysxD","title":".lnk Files","pathname":"/windows-artifacts/folder-file-opening-creation/.lnk-files","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"VyW6H1AWNmCEbzCbPuXB","title":"Jump Lists","pathname":"/windows-artifacts/folder-file-opening-creation/jump-lists","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"ZsZp5WAbxt6fZVMl920O","title":"AppIDs","pathname":"/windows-artifacts/folder-file-opening-creation/jump-lists/appids","siteSpaceId":"sitesp_V3fPT","description":"https://github.com/EricZimmerman/JumpList/blob/master/JumpList/Resources/AppIDs.txt","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"},{"label":"Jump Lists"}]},{"id":"lWWj16Fw4QmLvwJeSS5c","title":"Prefetch","pathname":"/windows-artifacts/folder-file-opening-creation/prefetch","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"kDezsrmVasutCa6mJlmJ","title":"Index.dat file://","pathname":"/windows-artifacts/folder-file-opening-creation/index.dat-file","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"G9O7XEuhHuCtgUYRVjXG","title":"PowerShell Scripts","pathname":"/windows-artifacts/folder-file-opening-creation/powershell-scripts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"Ng44sThC1EiEzufbOICW","title":".lnk Files","pathname":"/windows-artifacts/folder-file-opening-creation/powershell-scripts/.lnk-files","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"},{"label":"PowerShell Scripts"}]},{"id":"YNtmmzpdWMcvGZQWX6w9","title":"PCA (Program Compatibility Assistant)","pathname":"/windows-artifacts/folder-file-opening-creation/pca-program-compatibility-assistant","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Folder/File Opening/Creation"}]},{"id":"efU3BXkECcOXXCgZ84BI","title":"Persistence","pathname":"/windows-artifacts/persistence","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"cYXXTtf5tuF9XFi9YPTE","title":"Registry","pathname":"/windows-artifacts/persistence/registry","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"}]},{"id":"7ntNOSkSaKAOZZ5ShwW1","title":"NTUSER.DAT & HKU\\SID","pathname":"/windows-artifacts/persistence/registry/ntuser.dat-and-hku-sid","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"gxK7MH5lJei3EG8w8UoB","title":"Run and Run Once","pathname":"/windows-artifacts/persistence/registry/run-and-run-once","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"pjYiPODg0rSNnWoRqnUS","title":"Shell Folders and UserInit Key","pathname":"/windows-artifacts/persistence/registry/shell-folders-and-userinit-key","siteSpaceId":"sitesp_V3fPT","description":"Registry keys like Shell Folders and UserInit are integral to Windows operating systems, impacting user environments and the login process","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"aqOL7pjJI1bFVzuKFdWB","title":"Services","pathname":"/windows-artifacts/persistence/registry/services","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"Y1UVZ01H2gGJAsIIj5Js","title":"Logon Scripts","pathname":"/windows-artifacts/persistence/registry/logon-scripts","siteSpaceId":"sitesp_V3fPT","description":"Logon scripts offer a way for administrators to automate tasks that should occur each time a user logs on to a Windows system.","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"CoPaaxTG6K7Bp0lb3dv8","title":"Office Add-ins","pathname":"/windows-artifacts/persistence/registry/office-add-ins","siteSpaceId":"sitesp_V3fPT","description":"Office Add-ins provide enhanced functionality and customization for Microsoft Office applications, enabling users to tailor their experience with additional features.","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"YA6zw1Jq5pDnwk044tve","title":"Winlogon Shell","pathname":"/windows-artifacts/persistence/registry/winlogon-shell","siteSpaceId":"sitesp_V3fPT","description":"his key's default and legitimate value is meant to launch the Windows Explorer, providing the standard desktop environment.","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"GMDORqm2vkNLIaydIzHj","title":"Image File Execution Options (IFEO)","pathname":"/windows-artifacts/persistence/registry/image-file-execution-options-ifeo","siteSpaceId":"sitesp_V3fPT","description":"IFEO allows for the configuration of certain behaviors when specified executables are launched, including attaching a debugger or modifying certain execution parameters.","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"CWGGCmjr5rWIJA4iePQg","title":"AppInit_DLLs","pathname":"/windows-artifacts/persistence/registry/appinit_dlls","siteSpaceId":"sitesp_V3fPT","description":"The AppInit_DLLs registry key provides a mechanism for specifying one or more DLLs to be loaded into all processes that use the User32.dll.","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"QOxPoediB7ne1UtcxqZG","title":"Scheduled Tasks","pathname":"/windows-artifacts/persistence/registry/scheduled-tasks","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Registry"}]},{"id":"bBbad3LYWd2ZCg88skzG","title":"Scheduled Tasks","pathname":"/windows-artifacts/persistence/scheduled-tasks","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"}]},{"id":"O6wYDMnM7LLQhYk2DANp","title":"Scheduled Task Destination System Artifacts","pathname":"/windows-artifacts/persistence/scheduled-tasks/scheduled-task-destination-system-artifacts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Scheduled Tasks"}]},{"id":"KKB0f0p3iJ8yGC11cHka","title":"Scheduled Task Source System Artifacts","pathname":"/windows-artifacts/persistence/scheduled-tasks/scheduled-task-source-system-artifacts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"Scheduled Tasks"}]},{"id":"cj1KxzupXXykhuqPIoAH","title":"Startup","pathname":"/windows-artifacts/persistence/startup","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"}]},{"id":"MT5zOx2ZEefA4TnUM7iT","title":"Tool: AutoRuns","pathname":"/windows-artifacts/persistence/tool-autoruns","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"}]},{"id":"jVsz8ROu8bZ3sP970wwO","title":"Accounts","pathname":"/windows-artifacts/persistence/accounts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"}]},{"id":"wikCIvNJXjrfUJrBY0vt","title":"WMI Event Consumers","pathname":"/windows-artifacts/persistence/wmi-event-consumers","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"}]},{"id":"UvWa0vHDgV7l53OhG9hx","title":"WMI: Source System Artifacts","pathname":"/windows-artifacts/persistence/wmi-event-consumers/wmi-source-system-artifacts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"WMI Event Consumers"}]},{"id":"MLNZf2ZID5XyHU0XMZy9","title":"WMI: Destination System Artifacts","pathname":"/windows-artifacts/persistence/wmi-event-consumers/wmi-destination-system-artifacts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"WMI Event Consumers"}]},{"id":"rMweM06t50Iu1gVKPPCs","title":"WMI: PowerShell Analysis","pathname":"/windows-artifacts/persistence/wmi-event-consumers/wmi-powershell-analysis","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"WMI Event Consumers"}]},{"id":"NQBtIvxYUR2hUNnVXPlT","title":"PowerShell Scripts","pathname":"/windows-artifacts/persistence/powershell-scripts","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"}]},{"id":"zfHvOENkNPDKCAmvFYD6","title":"Startup Programs","pathname":"/windows-artifacts/persistence/powershell-scripts/startup-programs","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"PowerShell Scripts"}]},{"id":"DYE2dnG8OBfWCyRaKIcx","title":"CrowdStrike Searches","pathname":"/windows-artifacts/persistence/crowdstrike-searches","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"}]},{"id":"HWMvSJGUfq69lzLXGNXT","title":"Files Written to Startup Folder","pathname":"/windows-artifacts/persistence/crowdstrike-searches/files-written-to-startup-folder","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"CrowdStrike Searches"}]},{"id":"OS6Gk7eSYpF3V2rmQZQ7","title":"Files Written to Startup Folder from the Internet","pathname":"/windows-artifacts/persistence/crowdstrike-searches/files-written-to-startup-folder-from-the-internet","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"CrowdStrike Searches"}]},{"id":"gBvBySgcmOE1SmWpB5uN","title":"Local Account Creation/Deletion","pathname":"/windows-artifacts/persistence/crowdstrike-searches/local-account-creation-deletion","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"CrowdStrike Searches"}]},{"id":"lSekNyl5vypFnUOo9L0k","title":"Azure Account Creation/Deletion","pathname":"/windows-artifacts/persistence/crowdstrike-searches/azure-account-creation-deletion","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"CrowdStrike Searches"}]},{"id":"kEg96nZRpJeQu8nD7E8H","title":"Scheduled Tasks","pathname":"/windows-artifacts/persistence/crowdstrike-searches/scheduled-tasks","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Persistence"},{"label":"CrowdStrike Searches"}]},{"id":"9xB8JY5FGiHD2sVLCppK","title":"Physical Location","pathname":"/windows-artifacts/physical-location","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"xcXRqNkyp7xndCM9zGsi","title":"Time zone","pathname":"/windows-artifacts/physical-location/time-zone","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Physical Location"}]},{"id":"j2CedfKfUz4VRcEde0F3","title":"Wireless SSID","pathname":"/windows-artifacts/physical-location/wireless-ssid","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Physical Location"}]},{"id":"0000anczejOtYdd1jJxB","title":"Network History (Vista/Win7–11)","pathname":"/windows-artifacts/physical-location/network-history-vista-win7-11","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Physical Location"}]},{"id":"Fq1RpH9ggxxg0wXtw45j","title":"Cookies","pathname":"/windows-artifacts/physical-location/cookies","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Physical Location"}]},{"id":"Bh7p6hA2JoVbRUgFr2hg","title":"Browser Search Terms","pathname":"/windows-artifacts/physical-location/browser-search-terms","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Physical Location"}]},{"id":"RoRrIOStY0hVDsAMlClE","title":"Program Execution","pathname":"/windows-artifacts/program-execution","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"qwW9mOe6os9OzA1udBSd","title":"Prefetch","pathname":"/windows-artifacts/program-execution/prefetch","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"ud1Q534Bln6La8cAocD0","title":"Decoding Prefetch Files with Eric Zimmerman's PECmd Tool","pathname":"/windows-artifacts/program-execution/prefetch/decoding-prefetch-files-with-eric-zimmermans-pecmd-tool","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"},{"label":"Prefetch"}]},{"id":"1QNqebUijPAZZUHZRZvb","title":"BAM/DAM","pathname":"/windows-artifacts/program-execution/bam-dam","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"2kLDc3BWMFKdx6b3eAP1","title":"CapabilityAccessManager","pathname":"/windows-artifacts/program-execution/capabilityaccessmanager","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"RJ48bO4HErllCp35edQe","title":"UserAssist","pathname":"/windows-artifacts/program-execution/userassist","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"212kFBDM5TvQDtWZ9gBo","title":"Last Visited MRU","pathname":"/windows-artifacts/program-execution/last-visited-mru","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"L6IM0HJbZ2TH4Neqx62a","title":"RunMRU","pathname":"/windows-artifacts/program-execution/runmru","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"555kENDT2E4wfOJiSuRg","title":"MUI Cache","pathname":"/windows-artifacts/program-execution/mui-cache","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"G7Z8DTF6WQFI9CdKhTe3","title":"ShimCache","pathname":"/windows-artifacts/program-execution/shimcache","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"Jfpu9CUWJaHyKEB7fpaI","title":"Amcache","pathname":"/windows-artifacts/program-execution/amcache","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"HDnFvIb9uOQefGzgb2GJ","title":"Jump Lists","pathname":"/windows-artifacts/program-execution/jump-lists","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Program Execution"}]},{"id":"SrhNlbjBIWsAemjt7eRz","title":"Shadow Copies","pathname":"/windows-artifacts/shadow-copies","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"suNU91I4hKKgASPtxDbg","title":"VSC Permissions","pathname":"/windows-artifacts/shadow-copies/vsc-permissions","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Shadow Copies"}]},{"id":"OAyrX9aeJQdy3JQeKKGF","title":"Event ID 8193: Volume Shadow Copy Service Error","pathname":"/windows-artifacts/shadow-copies/event-id-8193-volume-shadow-copy-service-error","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Shadow Copies"}]},{"id":"w4gVDSYdkW74azbum86M","title":"USB Usage","pathname":"/windows-artifacts/usb-usage","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"ph5CFEBzgiBLRzf4goX6","title":"Key Identification","pathname":"/windows-artifacts/usb-usage/key-identification","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"USB Usage"}]},{"id":"uPyz1i1QgejOWyCgsKoT","title":"Drive Letter and Volume Name","pathname":"/windows-artifacts/usb-usage/drive-letter-and-volume-name","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"USB Usage"}]},{"id":"t0lMM7WsK0aUaZ5VVG74","title":"Connection Timestamps","pathname":"/windows-artifacts/usb-usage/connection-timestamps","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"USB Usage"}]},{"id":"HSaDTiFUjVuhbAw8sRO1","title":"User","pathname":"/windows-artifacts/usb-usage/user","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"USB Usage"}]},{"id":"wBM7C1ALEo2EEcsUwAab","title":"Volume Name","pathname":"/windows-artifacts/usb-usage/volume-name","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"USB Usage"}]},{"id":"IZNkuHtX4isr3IzhK0dT","title":"Plug & Play Event Log","pathname":"/windows-artifacts/usb-usage/plug-and-play-event-log","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"USB Usage"}]},{"id":"43IhMpEqdl6VmKWFhfWj","title":"Windows Services","pathname":"/windows-artifacts/windows-services","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"IxbMerPKYlTmkYGkBl1U","title":"DoSvc (Delivery Optimization)","pathname":"/windows-artifacts/windows-services/dosvc-delivery-optimization","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Windows Services"}]},{"id":"m0MNdbCRLcQHe16lM6ij","title":"System Information","pathname":"/windows-artifacts/system-information","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"9ehCuaYtAKFWPpNPCfPR","title":"Event IDs","pathname":"/windows-artifacts/event-ids","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"}]},{"id":"I7eeGK3ln0ysqyphPEUM","title":"Security","pathname":"/windows-artifacts/event-ids/security","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"}]},{"id":"kq69Lgy7qt12gVLETSWX","title":"Authentication / Account","pathname":"/windows-artifacts/event-ids/security/authentication-account","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"}]},{"id":"PKtVYz7xWQ781hxKxAtg","title":"4624 - Authentication Success","pathname":"/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"sYSZwrlghM5FAaKVHO53","title":"Logon Types","pathname":"/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success/logon-types","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"},{"label":"4624 - Authentication Success"}]},{"id":"WYkluttUQW84jCsh1UY3","title":"4625 - Authentication Failure","pathname":"/windows-artifacts/event-ids/security/authentication-account/4625-authentication-failure","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"06LoSNE8rH5pZR5RefhH","title":"SubStatus Codes","pathname":"/windows-artifacts/event-ids/security/authentication-account/4625-authentication-failure/substatus-codes","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"},{"label":"4625 - Authentication Failure"}]},{"id":"Zx9Lslz8x1fQVQc06zFk","title":"4634 - Account Logoff","pathname":"/windows-artifacts/event-ids/security/authentication-account/4634-account-logoff","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"uzCGjbsOU9CBlpHa0H2D","title":"4648 - Explicit Credentials Success","pathname":"/windows-artifacts/event-ids/security/authentication-account/4648-explicit-credentials-success","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"rfPwmnQI3WLyk5mzdCAe","title":"4672 - Special Privileges","pathname":"/windows-artifacts/event-ids/security/authentication-account/4672-special-privileges","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"AdwBYqkmio9xG3Q2iMuj","title":"4720 - Account Creation","pathname":"/windows-artifacts/event-ids/security/authentication-account/4720-account-creation","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"9f9VdVCCnkwCKACsXQJO","title":"4722 - Account Enabled","pathname":"/windows-artifacts/event-ids/security/authentication-account/4722-account-enabled","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4722","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"D3ZbJoT7K41uWV8qKzF3","title":"4732 - Addition to Local Group","pathname":"/windows-artifacts/event-ids/security/authentication-account/4732-addition-to-local-group","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"XcOFSrbYdXcaKHEDOF94","title":"4738 - Account Changed","pathname":"/windows-artifacts/event-ids/security/authentication-account/4738-account-changed","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"bAgKHAKnZIAF0PuMpsgG","title":"4776 - Kerberos Authentication Attempt","pathname":"/windows-artifacts/event-ids/security/authentication-account/4776-kerberos-authentication-attempt","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"uWEASNKrStmYS9oNDKuf","title":"Substatus Codes","pathname":"/windows-artifacts/event-ids/security/authentication-account/4776-kerberos-authentication-attempt/substatus-codes","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"},{"label":"4776 - Kerberos Authentication Attempt"}]},{"id":"pzJaf7DQ5qBEC8kaHZxa","title":"4771 - Kerberos Failure","pathname":"/windows-artifacts/event-ids/security/authentication-account/4771-kerberos-failure","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"1UETN74e6Hq81hwrafmW","title":"4768","pathname":"/windows-artifacts/event-ids/security/authentication-account/4768","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"Authentication / Account"}]},{"id":"1bAPcpP6vgfhzuFsg1S5","title":"File System","pathname":"/windows-artifacts/event-ids/security/file-system","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"}]},{"id":"EtR9bWjMMReK6vaemgZa","title":"1006","pathname":"/windows-artifacts/event-ids/security/file-system/1006","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"File System"}]},{"id":"hyd1E6IZjvmyDPjAoctF","title":"4688 - Process Created","pathname":"/windows-artifacts/event-ids/security/file-system/4688-process-created","siteSpaceId":"sitesp_V3fPT","description":"https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"File System"}]},{"id":"qIzY1Wtok83AHCTqCbI0","title":"4663","pathname":"/windows-artifacts/event-ids/security/file-system/4663","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"File System"}]},{"id":"QT1qznOcDILbhQtoGOqH","title":"4656","pathname":"/windows-artifacts/event-ids/security/file-system/4656","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"File System"}]},{"id":"ZIqwpqm9zGd4JsYpOoa4","title":"6416","pathname":"/windows-artifacts/event-ids/security/file-system/6416","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"File System"}]},{"id":"CFKSXI7pXJSwF8IhQzj8","title":"20001","pathname":"/windows-artifacts/event-ids/security/file-system/20001","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"File System"}]},{"id":"kDn1gJopyktThBpdsAJ3","title":"20003","pathname":"/windows-artifacts/event-ids/security/file-system/20003","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows Artifacts"},{"label":"Event IDs"},{"label":"Security"},{"label":"File System"}]},{"id":"y9OUXXPeueRXlII4w3kz","title":"Initial Access","pathname":"/windows-dfir-and-mittr/initial-access","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"aGP5YWfoXqboDxFVmihT","title":"Content Injection","pathname":"/windows-dfir-and-mittr/initial-access/content-injection","siteSpaceId":"sitesp_V3fPT","description":"","breadcrumbs":[{"label":"Windows DFIR & MITTR"},{"label":"Initial Access"}]},{"id":"rjW9kHsz68NvU85sCt3g","title":"Drive-by Compromise","pathname":"/windows-dfir-and-mittr/initial-access/drive-by-compromise","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"},{"label":"Initial Access"}]},{"id":"CjtWdMsQpoiT0v7D8wb9","title":"Watering Hole Attack","pathname":"/windows-dfir-and-mittr/initial-access/drive-by-compromise/watering-hole-attack","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"},{"label":"Initial Access"},{"label":"Drive-by Compromise"}]},{"id":"corqQxcLGHLStLqHVeXc","title":"Microsoft Files (Payload Execution)","pathname":"/windows-dfir-and-mittr/initial-access/drive-by-compromise/microsoft-files-payload-execution","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"},{"label":"Initial Access"},{"label":"Drive-by Compromise"}]},{"id":"arympIaV0X1AbyMpEMao","title":"Exploit Delivery","pathname":"/windows-dfir-and-mittr/initial-access/drive-by-compromise/exploit-delivery","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"},{"label":"Initial Access"},{"label":"Drive-by Compromise"}]},{"id":"kf6IaVhD7lyZK4cN4eUs","title":"Viewing Browser History Files","pathname":"/windows-dfir-and-mittr/initial-access/drive-by-compromise/viewing-browser-history-files","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"},{"label":"Initial Access"},{"label":"Drive-by Compromise"}]},{"id":"SoegRYDR9VeVbho3IqPq","title":"Phishing","pathname":"/windows-dfir-and-mittr/initial-access/phishing","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"},{"label":"Initial Access"}]},{"id":"HyPsaRFirGZusbKbS6xP","title":"Execution","pathname":"/windows-dfir-and-mittr/execution","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"pOvl9E3fXqZOTHL0QxSe","title":"Persistence","pathname":"/windows-dfir-and-mittr/persistence","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"JSA5AS91dFLJ1cUhDLO2","title":"Privilege Escalation","pathname":"/windows-dfir-and-mittr/privilege-escalation","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"RFZ3HMM5zi6ksMPi5eVx","title":"Defense Evasion","pathname":"/windows-dfir-and-mittr/defense-evasion","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"K4Bm8u7ozTzAgsVnQdA7","title":"Credential Access","pathname":"/windows-dfir-and-mittr/credential-access","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"1BF74rgatkH8I2dmWrTG","title":"Logon ID","pathname":"/windows-dfir-and-mittr/credential-access/logon-id","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"},{"label":"Credential Access"}]},{"id":"iWSb5pPq6eyuy4eIBRLX","title":"Discovery","pathname":"/windows-dfir-and-mittr/discovery","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"6eKJ6vHNSGU4zlG97vx0","title":"Lateral Movement","pathname":"/windows-dfir-and-mittr/lateral-movement","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"CRoRlDswSnduGKuV0509","title":"Collection","pathname":"/windows-dfir-and-mittr/collection","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"HRlleRlqGS85g33wEGLO","title":"Command and Control","pathname":"/windows-dfir-and-mittr/command-and-control","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"foNin8TVqQmP33gCO7Cn","title":"Exfiltration","pathname":"/windows-dfir-and-mittr/exfiltration","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"HM370ltYAZMj6mhp9TGq","title":"Impact","pathname":"/windows-dfir-and-mittr/impact","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"Windows DFIR & MITTR"}]},{"id":"DOmDvpRsyZEZO9UtxjOe","title":"Cached Credentials","pathname":"/soc-related/cached-credentials","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"SOC Related"}]},{"id":"JUwPVh0n7Y4SFS2NIwCh","title":"Domain Controller Password Spraying","pathname":"/soc-related/domain-controller-password-spraying","siteSpaceId":"sitesp_V3fPT","breadcrumbs":[{"label":"SOC Related"}]}]}