Files
reverse-skills-max/reverse-skill-repo/skills/digital-forensics/references/forensics-triage.md

10 lines
274 B
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# 取证分诊顺序
1. 保全与哈希
2. 内存急症(进程、网络、注入)
3. 持久化与执行痕迹
4. 横向与账号异常
5. 外联 IOC
6. 报告与修复建议
输出模板字段:Time | Host | Artifact | Finding | Confidence | Evidence path