Results for “antiforgery”

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.

Configure email security gateways like Microsoft Defender, Proofpoint, and Mimecast to detect and block targeted spearphishing attacks using impersonation protection, URL detonation, and attachment sandboxing.

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades, abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM.

Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.