Investigation Scenario 🔎

You’ve discovered a Windows system with screenshots of the user’s desktop in the %appdata%\ScreenShot\ directory.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Comments

Posting Rules

  • Be respectful to others
  • No spam or self-promotion
  • Stay on topic
  • Follow Bluesky's terms of service