For508 Index Verified -

: Print your index twice: once sorted alphabetically by keyword and once sorted by tool or concept category [11].

| Command (Vol 3) | Purpose | |-----------------|---------| | windows.pslist | List processes (can hide rootkits). | | windows.psscan | Find unlinked/dead processes. | | windows.cmdline | Command line arguments (TTPs). | | windows.netscan | Network connections, listening ports. | | windows.malfind | Detect injected code (PAGE_EXECUTE_READWRITE). | | windows.hollowprocesses | Detect process hollowing. | | windows.modscan | Loaded kernel drivers (rootkits). | | windows.handles | Open file handles, mutexes, registry keys. | for508 index

$MFT structure, Resident vs. Non-resident data, and journaling. : Print your index twice: once sorted alphabetically