// dfir vocabulary
forensics jargon glossary
the words that mean specific things in dfir. 45 terms with plain definitions and cross-links to playbooks and tools where they show up. no upload. no account. runs locally. don't trust us, verify it.
A
- Amcache
- a database of recently run programs with their identifiers
B
- beaconing
- regular check-in communication with an attacker's server
- bootkit
- malware that loads before the operating system starts
C
- C2
- command and control — communication with an attacker's server
- carved
- recovered data that was previously deleted
- CLSID
- a unique identifier for a Windows software component
- COM
- a Windows mechanism for programs to interact with each other
D
E
- EDR
- endpoint detection software that monitors computers for threats
- ELF
- the standard file format for Linux programs
- EVTX
- Windows event log files
- exfiltration
- unauthorized removal of data from a system
H
- hash
- a unique mathematical fingerprint of a file
- hibernation file
- a file that captures a snapshot of the computer's memory when it enters sleep mode
I
- IOC
- an indicator of compromise — a clue linked to malicious activity
K
- Kerberos
- the Windows system for proving user identity on a network
L
- lateral movement
- moving from one computer to another inside a network
- LSASS
- the Windows process that stores login credentials
M
- MachO
- the standard file format for macOS programs
- MD5
- a type of digital fingerprint used to verify file integrity
- metadata
- hidden information embedded within files
- MFT
- the file system's master index
- ntfs alternate data stream deep analyzer
- timestamp cluster anomaly detector
- artifact absence anomaly scoring detector
- browser cache clearing burst detector
- browser crash report artifact and suppression detector
- browser download history correlator
- browser extension removal burst detector
- browser profile deletion artifact detector
N
- NTFS
- the Windows file system format
- NTLM
- an older Windows method for proving user identity
P
- pagefile
- temporary disk space used when the computer's memory is full
- PDB
- a debug file that can reveal where a program was built
- PE
- the standard file format for Windows programs
- binary provenance & build metadata analyzer
- code signing certificate analyzer
- compile time timezone analyzer
- PE compile timestamp vs filesystem timestamp conflict detector
- binary compiler and language identifier
- dll injection detector
- dotnet assembly inspector
- environmental keying and sandbox evasion detector
- persistence
- methods attackers use to maintain access after reboot
- prefetch
- performance files that record program execution
- amcache vs prefetch conflict detector
- anti-forensic tool signature scanner
- anti-forensic tool identifier
- artifact absence anomaly scoring detector
- counter-investigation behavioral pattern detector
- credential harvesting tool artifact detector
- disk imaging and acquisition tool execution detector
- evidence of evidence deletion detector
- privilege escalation
- gaining higher-level access than originally granted
- linux auditd log deep analyzer
- aws cloudtrail forensic deep analyzer
- aws cloudtrail log forensic analyzer
- cnapp workload privilege escalation detector
- database privilege escalation detector
- handle table manipulation detector
- k8s runtime privilege escalation detector
- kubernetes privilege escalation detector
R
- ransomware
- malicious software that encrypts files and demands payment
- registry
- Windows's central settings database
- file artifacts vertical
- Windows Activity History collection suppression detector
- aircraft tail number history tracer
- anti-forensic tool identifier
- antimalware real-time protection disable detector
- AppLocker and WDAC policy disable detector
- artifact absence anomaly scoring detector
- azure container registry audit forensic analyzer
- rootkit
- malware designed to hide its presence on a system
S
- sandbox
- an isolated environment used to safely examine suspicious files
- SHA-256
- a stronger type of digital fingerprint used to verify file integrity
- ShimCache
- Windows's record of programs that were run
- anti-forensic tool signature scanner
- AppCompatCache / ShimCache gap analyzer
- appcompat cache timeline
- artifact absence anomaly scoring detector
- bam and dam entry absence detector
- counter-investigation behavioral pattern detector
- disk imaging and acquisition tool execution detector
- evidence of evidence deletion detector
- SIEM
- a system that collects and analyzes security logs
- SRUM
- Windows's detailed record of application resource usage
T
- timestomp
- deliberately changing file dates to hide activity
- TTP
- tactics, techniques, and procedures used by an attacker
U
- UserAssist
- a hidden registry record of programs used by the user
V
- volatile memory
- the computer's temporary working memory that is lost when power is removed