Name		Name	Last commit message	Last commit date
parent directory ..
DFWorkflow.assets		DFWorkflow.assets
EmotingMaldoc.Pictures		EmotingMaldoc.Pictures
WMI_research		WMI_research
active_directory		active_directory
gpo_script		gpo_script
DFWorkflow.md		DFWorkflow.md
EmotingMaldoc.md		EmotingMaldoc.md
GRIMMCon0x2.md		GRIMMCon0x2.md
README.md		README.md
SpectreOps_Keberoasting.md		SpectreOps_Keberoasting.md
USB_info.md		USB_info.md
Windows_Beginnings.md		Windows_Beginnings.md
myWindowsForensicsCheatSheet.xlsx		myWindowsForensicsCheatSheet.xlsx
speech.md		speech.md
windowsplus.sh		windowsplus.sh

README.md

Windows Forensics

My Notes: Windows Beginnings (Easy to check registry locations)
My Windows Forensics Cheat Sheet - artifacts and traige order
Active Directory
Kerberoasting (SpectreOps 4/8/20)
My USB Info
The Windows Tools and Artifacts: "The Definative Compendium" and DB of Windows Artifacts Github LINK
5/22/20 Magnet Forensics: Emoting Over Emotet and Maldoc - Lots of step-by-steps using tools to analyze different types of malicious docs. Check out Malwareoverview, Didier Stevens' Blog and Tools Suite, and Lazy Office Analyzer.
5/28/20 Magnet Forensics: Creating a Digital Forensic Workflow to Combat Data Exfiltration - Unique look on DF investigation. USB (Case 3) and Final Workflow are the highlights.
9/2020 GRIMMCon0x2: How to Build a SOC
System.Speech PowerShell idea

Tools and Scripts

Practice Drives

Virtualization Hints

From VMware to Vbox: ovftool “C:\Users\NAME\Documents\Virtual Machines\Windows 7 x64\Windows 7 x64.vmx” C:\Users\NAME\export.ovf