Trace Suite

BEACONFind what is calling home on a timer LOGONFind which account went somewhere new HOMOGLYPHSee what a domain actually is DGAFind generated domain names in a DNS log WIRERead a packet capture without uploading it PLUGGEDSee which USB drives were plugged into a Windows PC SWEEPRead an Nmap scan, and see what changed since the last one SENTRYRead a server log and flag brute force, scanning and attacks PIVOTMap an attack surface and find the privilege-escalation paths

SHORTCUTRead the target, dates and origin machine from a Windows .lnk RECYCLEList what a Windows Recycle Bin deleted, from where and when SPECIMENTake a suspicious Windows program apart without running it MFTRead an NTFS $MFT and catch files whose dates were rewritten PREFETCHRead a Windows .pf: what ran, when and what it loaded

YARAWrite and test YARA detection rules against a file MITREMap observed behaviour to MITRE ATT&CK techniques PARCELExtract and package indicators of compromise to share TRAWLRun strings over a file and pull the IOCs out, grouped and counted

SHADOWDate a photograph from the shadows in it BASERATEWork out how many of these alerts are real TIMESTOMPFind files whose dates were rewritten ENTROPYMeasure what a file is made of

TDOAWork out where a sound came from ORIGINWhere a blood spatter came from