fatcousin
// case type

tech support scam

pop-up → call center → remote-access install → gift-card / wire payout. evidence is RDP / RMM tooling and the call recording / payment.

tools
12
priority
L
processing
local · in browser

start here · primary tools

ordered. work top-down. the first tool is the suggested entry point for this case type.

  1. remote desktop log clearing and gap detectordrop rdp evtx csvs · detect rdp session log gaps · identify rdp channel clearing · surface rdp session reconstruction with cleared log indicators · runs locally
  2. rdp cache parserdrop .bmc/.bin cache files · RDP8 magic or legacy BGRA tiles · thumbnail grid · hide uniform tiles · export zip · runs locally
  3. live response tool execution artifact detectordrop prefetch shimcache amcache or 4688 evtx csv · detect live response and triage collection tool execution · identify when and how live response was performed · surface kape triage collector and incident response tool artifacts · runs locally
  4. LOLBin execution burst detectordrop 4688 or sysmon evtx csv · detect living off the land binary execution · identify lolbin abuse patterns · surface unusual lolbin invocations and burst usage · runs locally
  5. browser history extractordrop a Chrome or Firefox SQLite history DB · extract URLs · visit counts · timestamps · typed URLs · export CSV · runs locally
  6. browser extension analyzerdrop Chrome or Firefox extension folder or .crx · parse manifest · permissions · background scripts · content scripts · flag dangerous permissions · export report · runs locally
  7. chrome extension analyzerdrop crx or manifest.json · permissions audit · content scripts · risk score · script patterns · runs locally
  8. powershell deobfuscatorpaste obfuscated powershell · base64 utf-16 · deflate gzip · concat replace · char arrays · multi-pass · iocs · runs locally

also useful · secondary tools

supporting and follow-up tools. surface as the investigation widens.

  1. PowerShell history clearing detectordrop powershell operational evtx csv or psreadline history file · detect cleared powershell command history · identify gaps in command execution record · surface anti-forensic powershell history manipulation · runs locally
  2. psreadline history gap and anomaly analyzerpaste or drop psreadline consolehost_history txt · detect gaps in command history · identify suspicious command sequences · surface anti-forensic commands · reconstruct powershell session timeline · runs locally
  3. windows scheduled task analyzerdrop task scheduler xml · triggers · actions · principals · suspicion score · encoded powershell decode · persistence hints · runs locally
  4. case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
// case-kit pipeline

run as a stack

skip the click-through. these presets are curated forensic pipelines you can save as a stack with one click and run on your evidence locally.

  • tech support scam — triage kit

    8 steps

    drop RDP / RMM logs + browser history → remote-access clearing detect → lolbin burst → PS deobfuscate → report

    1. 01evidence-manifest-generatorhash endpoint exports before triage
    2. 02remote-desktop-log-clearing-detectordetect RDP log clearing — common post-scam cleanup
    3. 03rdp-cache-parserparse RDP bitmap cache for remote session evidence
    4. 04live-response-tool-execution-detectordetect RMM / live-response tool execution artifacts
    5. 05lolbin-execution-burst-detectorflag lolbin execution bursts during the scam session window
    6. 06powershell-deobfuscatordeobfuscate PowerShell payloads dropped by the scammer
    7. 07browser-history-clearing-pattern-detectordetect browser history clearing after the remote session
    8. 08case-report-generatordraft a report documenting remote-access evidence + cleanup indicators
// pattern-matched

related tools

tools that the manifest-classifier flagged as plausibly useful here but that aren't in the hand-curated lists above. less editorial weight — scan, don't work top-down.

+ 9 more in this pattern match. browse the full forensics catalog via the forensics category.

ready