Response Playbooks

As part of an active incident or proactive threat hunting, analyzes NTFS artifacts ($MFT, journal, Prefetch, ShimCache, Amcache) offline or on a triage collection to reconstruct attacker activity and tool usage on a timeline.

Systematic removal of attacker persistence mechanisms (service, task, registry run-key, WMI, startup).