10 lines
274 B
Markdown
10 lines
274 B
Markdown
# 取证分诊顺序
|
||
|
||
1. 保全与哈希
|
||
2. 内存急症(进程、网络、注入)
|
||
3. 持久化与执行痕迹
|
||
4. 横向与账号异常
|
||
5. 外联 IOC
|
||
6. 报告与修复建议
|
||
|
||
输出模板字段:Time | Host | Artifact | Finding | Confidence | Evidence path |