phishingemail-securityemail-headers+8
How to Analyze Phishing Email Headers: A Complete Guide for SOC Analysts
Apr 11, 202610 min read
A practical walkthrough of digital forensics investigation steps for SOC analysts — covering detection, containment, eradication, recovery, and reporting based on the NIST SP 800-61 framework.
Understanding the critical role of Windows event logs in DFIR work and why proper logging configuration is no longer optional in modern enterprise environments.
Memory acquisition involves preserving volatile RAM contents to non-volatile storage for forensic analysis. Success depends on careful execution to prevent corruption and data loss from background processes or system reboots.
A deep dive into the binary XML format used by modern Windows Event Logging, covering the .evtx file structure, storage locations, remote collection architecture, and the common fields analysts encounter in every Event ID.