tag :: Client Artifact

• Admin.Client.Uninstall
• Admin.Client.UpdateClientConfig
• Admin.Client.Upgrade.Debian
• Admin.Client.Upgrade.RedHat
• Admin.Client.Upgrade.Windows
• Custom.Linux.SudoUsers
• Demo.Plugins.GUI
• Elastic.EventLogs.Sysmon
• Generic.Applications.Chrome.SessionStorage
• Generic.Applications.Office.Keywords
• Generic.Client.CleanupTemp
• Generic.Client.DiskSpace
• Generic.Client.DiskUsage
• Generic.Client.Info
• Generic.Client.LocalLogsRetrieve
• Generic.Client.Profile
• Generic.Client.Rekey
• Generic.Client.Trace
• Generic.Client.VQL
• Generic.Collectors.File
• Generic.Collectors.SQLECmd
• Generic.Detection.HashHunter
• Generic.Detection.Yara.Glob
• Generic.Detection.Yara.Zip
• Generic.Forensic.Carving.URLs
• Generic.Forensic.LocalHashes.Glob
• Generic.Forensic.LocalHashes.Init
• Generic.Forensic.LocalHashes.Query
• Generic.Forensic.SQLiteHunter
• Generic.Forensic.Timeline
• Generic.Network.InterfaceAddresses
• Generic.System.EfiSignatures
• Generic.System.HostsFile
• Generic.System.ProcessSiblings
• Generic.System.Pstree
• Generic.Utils.FetchBinary
• Linux.Applications.Chrome.Extensions
• Linux.Applications.Chrome.Extensions.Upload
• Linux.Applications.Docker.Info
• Linux.Applications.Docker.Version
• Linux.Debian.AptSources
• Linux.Debian.Packages
• Linux.Detection.AnomalousFiles
• Linux.Detection.Yara.Process
• Linux.Forensics.Journal
• Linux.KapeFiles.CollectFromDirectory
• Linux.Mounts
• Linux.Network.Netstat
• Linux.Network.NetstatEnriched
• Linux.Network.PacketCapture
• Linux.OSQuery.Generic
• Linux.Proc.Arp
• Linux.Proc.Modules
• Linux.Remediation.Quarantine
• Linux.RHEL.Packages
• Linux.Search.FileFinder
• Linux.Ssh.AuthorizedKeys
• Linux.Ssh.KnownHosts
• Linux.Ssh.PrivateKeys
• Linux.SuSE.Packages
• Linux.Sys.ACPITables
• Linux.Sys.BashHistory
• Linux.Sys.BashShell
• Linux.Sys.CPUTime
• Linux.Sys.Crontab
• Linux.Sys.Groups
• Linux.Sys.LastUserLogin
• Linux.Sys.LogGrep
• Linux.Sys.LogHunter
• Linux.Sys.Maps
• Linux.Sys.Pslist
• Linux.Sys.Services
• Linux.Sys.SUID
• Linux.Sys.Users
• Linux.Syslog.SSHLogin
• Linux.Triage.ProcessMemory
• Linux.Users.InteractiveUsers
• Linux.Users.RootUsers
• Linux.Utils.InstallDeb
• MacOS.Applications.Chrome.History
• MacOS.Applications.MRU
• MacOS.Detection.Autoruns
• MacOS.Detection.InstallHistory
• MacOS.Forensics.AppleDoubleZip
• MacOS.Forensics.FSEvents
• MacOS.Network.Netstat
• MacOS.Network.PacketCapture
• MacOS.OSQuery.Generic
• MacOS.Search.FileFinder
• MacOS.System.Dock
• MacOS.System.Packages
• MacOS.System.Plist
• MacOS.System.QuarantineEvents
• MacOS.System.TCC
• MacOS.System.TimeMachine
• MacOS.System.Users
• MacOS.System.Wifi
• Network.ExternalIpAddress
• Server.Enrichment.GeoIP
• Server.Enrichment.GeoIPISP
• Server.Internal.ToolDependencies
• Server.Utils.DeleteFavoriteFlow
• Server.Utils.ReIndex
• Server.Utils.SaveFavoriteFlow
• System.VFS.DownloadFile
• System.VFS.ListDirectory
• Triage.Collection.Upload
• Triage.Collection.UploadTable
• Windows.ActiveDirectory.BloodHound
• Windows.Analysis.EvidenceOfDownload
• Windows.Analysis.EvidenceOfExecution
• Windows.Application.Firefox.Downloads
• Windows.Applications.ChocolateyPackages
• Windows.Applications.Chrome.Cookies
• Windows.Applications.Chrome.Extensions
• Windows.Applications.Chrome.History
• Windows.Applications.Edge.Favicons
• Windows.Applications.Edge.History
• Windows.Applications.Firefox.Downloads
• Windows.Applications.Firefox.History
• Windows.Applications.IISLogs
• Windows.Applications.MegaSync
• Windows.Applications.NirsoftBrowserViewer
• Windows.Applications.OfficeMacros
• Windows.Applications.SBECmd
• Windows.Applications.TeamViewer.Incoming
• Windows.Attack.ParentProcess
• Windows.Attack.Prefetch
• Windows.Attack.UnexpectedImagePath
• Windows.Carving.CobaltStrike
• Windows.Carving.USN
• Windows.Carving.USNFiles
• Windows.Collectors.File
• Windows.Collectors.VSS
• Windows.Detection.Amcache
• Windows.Detection.BinaryHunter
• Windows.Detection.BinaryRename
• Windows.Detection.CryptnetUrlCache
• Windows.Detection.EnvironmentVariables
• Windows.Detection.ForwardedImports
• Windows.Detection.Impersonation
• Windows.Detection.Mutants
• Windows.Detection.TemplateInjection
• Windows.Detection.Yara.Device
• Windows.Detection.Yara.NTFS
• Windows.Detection.Yara.PhysicalMemory
• Windows.Detection.Yara.Process
• Windows.Detection.Yara.UEFI
• Windows.ETW.DotNetRundown
• Windows.ETW.ViewSessions
• Windows.EventLogs.AlternateLogon
• Windows.EventLogs.Cleared
• Windows.EventLogs.DHCP
• Windows.EventLogs.Evtx
• Windows.EventLogs.EvtxHunter
• Windows.EventLogs.ExplicitLogon
• Windows.EventLogs.Kerbroasting
• Windows.EventLogs.Modifications
• Windows.EventLogs.PowershellModule
• Windows.EventLogs.PowershellScriptblock
• Windows.EventLogs.RDPAuth
• Windows.EventLogs.ScheduledTasks
• Windows.EventLogs.ServiceCreationComspec
• Windows.EventLogs.Symantec
• Windows.EventLogs.Telerik
• Windows.Forensics.Bam
• Windows.Forensics.BulkExtractor
• Windows.Forensics.CertUtil
• Windows.Forensics.FilenameSearch
• Windows.Forensics.JumpLists
• Windows.Forensics.Lnk
• Windows.Forensics.PartitionTable
• Windows.Forensics.Prefetch
• Windows.Forensics.ProcessInfo
• Windows.Forensics.RDPCache
• Windows.Forensics.RecentApps
• Windows.Forensics.RecycleBin
• Windows.Forensics.SAM
• Windows.Forensics.Shellbags
• Windows.Forensics.SolarwindsSunburst
• Windows.Forensics.SRUM
• Windows.Forensics.Timeline
• Windows.Forensics.UEFI
• Windows.Forensics.UserAccessLogs
• Windows.Forensics.Usn
• Windows.KapeFiles.Remapping
• Windows.KapeFiles.Targets
• Windows.Memory.Acquisition
• Windows.Memory.Intezer
• Windows.Memory.PEDump
• Windows.Memory.ProcessDump
• Windows.Memory.ProcessInfo
• Windows.Network.ArpCache
• Windows.Network.InterfaceAddresses
• Windows.Network.ListeningPorts
• Windows.Network.Netstat
• Windows.Network.NetstatEnriched
• Windows.Network.PacketCapture
• Windows.NTFS.ADSHunter
• Windows.NTFS.ExtendedAttributes
• Windows.NTFS.I30
• Windows.NTFS.MFT
• Windows.NTFS.Recover
• Windows.OSQuery.Generic
• Windows.Packs.LateralMovement
• Windows.Packs.Persistence
• Windows.Persistence.Debug
• Windows.Persistence.PermanentWMIEvents
• Windows.Persistence.PowershellProfile
• Windows.Persistence.PowershellRegistry
• Windows.Persistence.Wow64cpu
• Windows.Registry.AppCompatCache
• Windows.Registry.BackupRestore
• Windows.Registry.EnabledMacro
• Windows.Registry.EnableUnsafeClientMailRules
• Windows.Registry.MountPoints2
• Windows.Registry.NTUser
• Windows.Registry.NTUser.Upload
• Windows.Registry.PortProxy
• Windows.Registry.PuttyHostKeys
• Windows.Registry.RDP
• Windows.Registry.RecentDocs
• Windows.Registry.Sysinternals.Eulacheck
• Windows.Registry.UserAssist
• Windows.Registry.WDigest
• Windows.Remediation.Quarantine
• Windows.Remediation.ScheduledTasks
• Windows.Remediation.Sinkhole
• Windows.Search.FileFinder
• Windows.Search.SMBFileFinder
• Windows.Search.VSS
• Windows.Search.Yara
• Windows.Sigma.EventLogs
• Windows.Sys.AllUsers
• Windows.Sys.AppcompatShims
• Windows.Sys.CertificateAuthorities
• Windows.Sys.DiskInfo
• Windows.Sys.Drivers
• Windows.Sys.FirewallRules
• Windows.Sys.Interfaces
• Windows.Sys.PhysicalMemoryRanges
• Windows.Sys.Programs
• Windows.Sys.StartupItems
• Windows.Sys.Users
• Windows.Sysinternals.Autoruns
• Windows.Sysinternals.SysmonInstall
• Windows.System.Amcache
• Windows.System.AuditPolicy
• Windows.System.CatFiles
• Windows.System.CmdShell
• Windows.System.CriticalServices
• Windows.System.DLLs
• Windows.System.DNSCache
• Windows.System.DomainRole
• Windows.System.Handles
• Windows.System.HostsFile
• Windows.System.LocalAdmins
• Windows.System.PowerShell
• Windows.System.Powershell.ModuleAnalysisCache
• Windows.System.Powershell.PSReadline
• Windows.System.Pslist
• Windows.System.RootCAStore
• Windows.System.Services
• Windows.System.Shares
• Windows.System.Signers
• Windows.System.SVCHost
• Windows.System.TaskScheduler
• Windows.System.UntrustedBinaries
• Windows.System.VAD
• Windows.System.VBScript
• Windows.System.WMIQuery
• Windows.Timeline.MFT
• Windows.Timeline.Prefetch
• Windows.Timeline.Registry.RunMRU
• Windows.Triage.ProcessMemory
• Windows.Triage.SDS