# FaresMorcy

## FaresMorcy

- [Whoami](https://faresbltagy.gitbook.io/footprintinglabs/whoami.md)
- [Labs](https://faresbltagy.gitbook.io/footprintinglabs/labs.md)
- [Footprinting Labs](https://faresbltagy.gitbook.io/footprintinglabs/footprinting-labs.md)
- [Lab - Easy](https://faresbltagy.gitbook.io/footprintinglabs/footprinting-labs/lab-easy.md): Greetings, esteemed colleagues. Our focus today entails the systematic resolution of the Footprinting labs outlined within the comprehensive curriculum of the 'HTB Academy Penetration Testing Course'.
- [Lab - Medium](https://faresbltagy.gitbook.io/footprintinglabs/footprinting-labs/lab-medium.md): Greetings, all. Today, we're delving into the Medium-level Footprinting Walkthrough lab within the HTB Academy Penetration Testing Course. Our objective? Acquire the password for the user "HTB."
- [Lab - Hard](https://faresbltagy.gitbook.io/footprintinglabs/footprinting-labs/lab-hard.md): Hello everyone, today we're diving into the Hard-level Footprinting Walkthrough lab in the HTB Academy Penetration Testing Course. Our goal? Obtain the password for the user "HTB."
- [Shells & Payloads  ](https://faresbltagy.gitbook.io/footprintinglabs/shells-and-payloads.md)
- [The Live Engagement](https://faresbltagy.gitbook.io/footprintinglabs/shells-and-payloads/the-live-engagement.md): Greetings all! Today, we'll tackle the "Shells & Payloads" module challenge. We'll be targeting three hosts in this challenge. Let's begin our exploration.
- [Password Attacks](https://faresbltagy.gitbook.io/footprintinglabs/password-attacks.md)
- [Lab - Easy](https://faresbltagy.gitbook.io/footprintinglabs/password-attacks/lab-easy.md): Hello, everyone. Today, we will be exploring the Medium-level Password Attacks Walkthrough lab from the HTB Academy Penetration Testing Course. Our goal is to obtain the contents of flag.txt in /root
- [Lab - Medium](https://faresbltagy.gitbook.io/footprintinglabs/password-attacks/lab-medium.md)
- [Lab - Hard](https://faresbltagy.gitbook.io/footprintinglabs/password-attacks/lab-hard.md)
- [Active Directory Enumeration & Attacks](https://faresbltagy.gitbook.io/footprintinglabs/active-directory-enumeration-and-attacks.md)
- [Active Directory Enumeration & Attacks](https://faresbltagy.gitbook.io/footprintinglabs/active-directory-enumeration-and-attacks/active-directory-enumeration-and-attacks.md)
- [AD Enumeration & Attacks - Skills Assessment Part I](https://faresbltagy.gitbook.io/footprintinglabs/active-directory-enumeration-and-attacks/ad-enumeration-and-attacks-skills-assessment-part-i.md)
- [AD Enumeration & Attacks - Skills Assessment Part II](https://faresbltagy.gitbook.io/footprintinglabs/active-directory-enumeration-and-attacks/ad-enumeration-and-attacks-skills-assessment-part-ii.md)
- [SOC Hackthebox Notes & Labs](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs.md): I have completed the SOC Analyst Path from HackTheBox Academy, and these are my notes from this amazing course. I hope they will be beneficial.
- [Security Monitoring & SIEM Fundamentals Module](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/security-monitoring-and-siem-fundamentals-module.md)
- [Windows Event Logs & Finding Evil Module](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-event-logs-and-finding-evil-module.md)
- [Introduction to Threat Hunting & Hunting With Elastic Module](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/introduction-to-threat-hunting-and-hunting-with-elastic-module.md)
- [Understanding Log Sources & Investigating with Splunk Module](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/understanding-log-sources-and-investigating-with-splunk-module.md)
- [Introduction To Splunk & SPL](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/understanding-log-sources-and-investigating-with-splunk-module/introduction-to-splunk-and-spl.md)
- [Using Splunk Applications](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/understanding-log-sources-and-investigating-with-splunk-module/using-splunk-applications.md)
- [Intrusion Detection With Splunk (Real-world Scenario)](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/understanding-log-sources-and-investigating-with-splunk-module/intrusion-detection-with-splunk-real-world-scenario.md)
- [Detecting Attacker Behavior With Splunk Based On TTPs](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/understanding-log-sources-and-investigating-with-splunk-module/detecting-attacker-behavior-with-splunk-based-on-ttps.md)
- [Detecting Attacker Behavior With Splunk Based On Analytics](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/understanding-log-sources-and-investigating-with-splunk-module/detecting-attacker-behavior-with-splunk-based-on-analytics.md)
- [Skills Assessment](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/understanding-log-sources-and-investigating-with-splunk-module/skills-assessment.md)
- [Windows Attacks & Defense](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense.md)
- [Kerberoasting](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/kerberoasting.md)
- [AS-REProasting](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/as-reproasting.md)
- [GPP Passwords](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/gpp-passwords.md)
- [GPO Permissions/GPO Files](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/gpo-permissions-gpo-files.md)
- [Credentials in Shares](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/credentials-in-shares.md)
- [Credentials in Object Properties](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/credentials-in-object-properties.md)
- [DCSync](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/dcsync.md)
- [Golden Ticket](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/golden-ticket.md)
- [Kerberos Constrained Delegation](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/kerberos-constrained-delegation.md)
- [Print Spooler & NTLM Relaying](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/print-spooler-and-ntlm-relaying.md)
- [Coercing Attacks & Unconstrained Delegation](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/coercing-attacks-and-unconstrained-delegation.md)
- [Object ACLs](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/object-acls.md)
- [PKI - ESC1](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/pki-esc1.md)
- [Skills Assessment](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/windows-attacks-and-defense/skills-assessment.md)
- [Intro to Network Traffic Analysis Module](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/intro-to-network-traffic-analysis-module.md)
- [YARA & Sigma for SOC Analysts Module](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module.md)
- [Developing YARA Rules](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module/developing-yara-rules.md)
- [Hunting Evil with YARA (Windows Edition)](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module/hunting-evil-with-yara-windows-edition.md)
- [Hunting Evil with YARA (Linux Edition)](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module/hunting-evil-with-yara-linux-edition.md)
- [Sigma and Sigma Rules](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module/sigma-and-sigma-rules.md)
- [Developing Sigma Rules](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module/developing-sigma-rules.md)
- [Hunting Evil with Sigma (Chainsaw Edition)](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module/hunting-evil-with-sigma-chainsaw-edition.md)
- [Hunting Evil with Sigma (Splunk Edition)](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module/hunting-evil-with-sigma-splunk-edition.md)
- [Skills Assessment](https://faresbltagy.gitbook.io/footprintinglabs/soc-hackthebox-notes-and-labs/yara-and-sigma-for-soc-analysts-module/skills-assessment.md)
- [Malicious Document Analysis - HTB Notes](https://faresbltagy.gitbook.io/footprintinglabs/malicious-document-analysis-htb-notes.md)
- [Introduction](https://faresbltagy.gitbook.io/footprintinglabs/malicious-document-analysis-htb-notes/introduction.md)
- [PDF Analysis](https://faresbltagy.gitbook.io/footprintinglabs/malicious-document-analysis-htb-notes/pdf-analysis.md)
- [Office Files Analysis](https://faresbltagy.gitbook.io/footprintinglabs/malicious-document-analysis-htb-notes/office-files-analysis.md)
- [Excel Macro Analysis](https://faresbltagy.gitbook.io/footprintinglabs/malicious-document-analysis-htb-notes/excel-macro-analysis.md)
- [RTF  Documents Analysis](https://faresbltagy.gitbook.io/footprintinglabs/malicious-document-analysis-htb-notes/rtf-documents-analysis.md)
- [Build Home Lab - SOC Automation](https://faresbltagy.gitbook.io/footprintinglabs/build-home-lab-soc-automation.md)
- [Install & configure Sysmon for deep Windows event logging](https://faresbltagy.gitbook.io/footprintinglabs/build-home-lab-soc-automation/install-and-configure-sysmon-for-deep-windows-event-logging.md)
- [Set up Wazuh & TheHive for threat detection & case management](https://faresbltagy.gitbook.io/footprintinglabs/build-home-lab-soc-automation/set-up-wazuh-and-thehive-for-threat-detection-and-case-management.md)
- [Execute Mimikatz & create detection rules in Wazuh](https://faresbltagy.gitbook.io/footprintinglabs/build-home-lab-soc-automation/execute-mimikatz-and-create-detection-rules-in-wazuh.md)
- [Automate everything with Shuffle](https://faresbltagy.gitbook.io/footprintinglabs/build-home-lab-soc-automation/automate-everything-with-shuffle.md)
- [Response to SSH Attack Using Shuffle, Wazuh, and TheHive](https://faresbltagy.gitbook.io/footprintinglabs/build-home-lab-soc-automation/response-to-ssh-attack-using-shuffle-wazuh-and-thehive.md)
- [Home Lab (Attack & Defense Scenarios)](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios.md)
- [Linux Attack Scenario](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/linux-attack-scenario.md)
- [Home Lab (Lumma Stealer)](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/home-lab-lumma-stealer.md)
- [Pass-the-Hash Attack & Defense](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/pass-the-hash-attack-and-defense.md)
- [Scheduled Task  Attack & Defense](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/scheduled-task-attack-and-defense.md)
- [Kerberoasting Attack & Defense](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/kerberoasting-attack-and-defense.md)
- [Kerberos Constrained Delegation](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/kerberos-constrained-delegation.md)
- [Password Spraying Attack & Defense](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/password-spraying-attack-and-defense.md)
- [Golden Ticket Attack & Defense](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/golden-ticket-attack-and-defense.md)
- [AS-REProasting Attack & Defense](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/as-reproasting-attack-and-defense.md)
- [DCSync Attack & Defense](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/dcsync-attack-and-defense.md)
- [Home Lab (FIN7 (Carbanak Group) – Point of Sale (POS) Attack on Hospitality Chains)](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/home-lab-fin7-carbanak-group-point-of-sale-pos-attack-on-hospitality-chains.md)
- [Home Lab (Active Directory Scenarios)](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios.md)
- [AD Scenario 1](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1.md)
- [Setup](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/setup.md)
- [Lab Setup](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/lab-setup.md)
- [The Attack](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/the-attack.md)
- [The Investigation](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/the-investigation.md)
- [Nitrogen](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen.md)
- [Lab Setup](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/lab-setup.md)
- [The Attack](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/the-attack.md)
- [Nitrogen](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/nitrogen.md)
- [Lab206](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/lab206.md)
- [Netx-Support](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/netx-support.md)
- [LunarSpider - Investigation Report](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/lunarspider-investigation-report.md)
- [LunarSpiderw](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/lunarspiderw.md)
- [LunarSpider-Final](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/lunarspider-final.md)
- [BlacksuitBrach-Walkthrough](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/blacksuitbrach-walkthrough.md)
- [ResourcePacks](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/resourcepacks.md)
- [Threat Hunting Lab](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/threat-hunting-lab.md)
- [DFIR Lab](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/dfir-lab.md)
- [Lab 200](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/lab-200.md)
- [Lab 198](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-active-directory-scenarios/ad-scenario-1/nitrogen/lab-198.md)
- [DFIR Notes](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes.md)
- [Linking User Actions to Files / Folders](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/linking-user-actions-to-files-folders.md)
- [Object Access Logging: Monitoring File/Folder Activity](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/linking-user-actions-to-files-folders/object-access-logging-monitoring-file-folder-activity.md)
- [Windows MRULists: Tracking User's Recent Actions](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/linking-user-actions-to-files-folders/windows-mrulists-tracking-users-recent-actions.md)
- [Shellbags: Investigating User Folder Activity](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/linking-user-actions-to-files-folders/shellbags-investigating-user-folder-activity.md)
- [Windows LNK Files: Analysis and Attributes](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/linking-user-actions-to-files-folders/windows-lnk-files-analysis-and-attributes.md)
- [Exploring JumpLists: Files, Associations, and Interactions](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/linking-user-actions-to-files-folders/exploring-jumplists-files-associations-and-interactions.md)
- [CC Notes](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/cc-notes.md)
- [Detecting USB Device Intrusions](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/detecting-usb-device-intrusions.md)
- [Connected Devices Forensics: Exploring Registry](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/detecting-usb-device-intrusions/connected-devices-forensics-exploring-registry.md)
- [Device Connection History: setupapi.dev.log](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/detecting-usb-device-intrusions/device-connection-history-setupapi.dev.log.md)
- [Connected Devices: Event Logs Analysis](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/detecting-usb-device-intrusions/connected-devices-event-logs-analysis.md)
- [User Device Access: Correlating GUIDs and Artifacts](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/detecting-usb-device-intrusions/user-device-access-correlating-guids-and-artifacts.md)
- [Automating USB Forensics: Tools and Techniques](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/detecting-usb-device-intrusions/automating-usb-forensics-tools-and-techniques.md)
- [Detecting USB Device Intrusion: Wrapping up](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/detecting-usb-device-intrusions/detecting-usb-device-intrusion-wrapping-up.md)
- [Analyzing Installed Applications](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-installed-applications.md)
- [Installed Microsoft Store Applications Database Exploration](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-installed-applications/installed-microsoft-store-applications-database-exploration.md)
- [Exploring Installed Applications in the Registry](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-installed-applications/exploring-installed-applications-in-the-registry.md)
- [Windows Event Logs: Tracking Application Installation](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-installed-applications/windows-event-logs-tracking-application-installation.md)
- [Analyzing Execution Activities](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities.md)
- [Windows Services: Configuration, Timeline, and Events](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/windows-services-configuration-timeline-and-events.md)
- [Windows Timeline: Analyzing User Activities and Applications](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/windows-timeline-analyzing-user-activities-and-applications.md)
- [Persistent Malware: Examining Autorun Applications](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/persistent-malware-examining-autorun-applications.md)
- [UserAssist Registry Key: Program Usage Insights](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/userassist-registry-key-program-usage-insights.md)
- [Exploring ShimCache: Uncovering Application Compatibility Insights](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/exploring-shimcache-uncovering-application-compatibility-insights.md)
- [AmCache.hve: Tracking Installed Programs and History](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/amcache.hve-tracking-installed-programs-and-history.md)
- [Windows BAM Registry Key: Background Activity Monitoring](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/windows-bam-registry-key-background-activity-monitoring.md)
- [Windows Prefetch Analysis](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/windows-prefetch-analysis.md)
- [Windows SRUM: Tracking System Resource Usage](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/windows-srum-tracking-system-resource-usage.md)
- [Microsoft Office Dialog Alerts Log](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/microsoft-office-dialog-alerts-log.md)
- [Analysis of Windows Scheduled Tasks](https://faresbltagy.gitbook.io/footprintinglabs/dfir-notes/analyzing-execution-activities/analysis-of-windows-scheduled-tasks.md)
- [Labs](https://faresbltagy.gitbook.io/footprintinglabs/labs-1.md)
- [Lab 205](https://faresbltagy.gitbook.io/footprintinglabs/labs-1/lab-205.md)
- [Lab 207](https://faresbltagy.gitbook.io/footprintinglabs/labs-1/lab-207.md)
- [Investigation Lab](https://faresbltagy.gitbook.io/footprintinglabs/labs-1/investigation-lab.md)
- [Lab 210](https://faresbltagy.gitbook.io/footprintinglabs/labs-1/lab-210.md)
- [AD](https://faresbltagy.gitbook.io/footprintinglabs/ad.md)
- [Lesson1: AD Authentication Protocols - Technical Deep Dive](https://faresbltagy.gitbook.io/footprintinglabs/ad/lesson1-ad-authentication-protocols-technical-deep-dive.md)
- [Analyzing AD Authentication Traffic](https://faresbltagy.gitbook.io/footprintinglabs/ad/analyzing-ad-authentication-traffic.md)
- [AD Trust Relationships and Cross-Forest Authentication](https://faresbltagy.gitbook.io/footprintinglabs/ad/ad-trust-relationships-and-cross-forest-authentication.md)
- [Lab2](https://faresbltagy.gitbook.io/footprintinglabs/ad/lab2.md)
- [Lab 3: Analyzing Azure AD External Identity and Trust Security](https://faresbltagy.gitbook.io/footprintinglabs/ad/lab-3-analyzing-azure-ad-external-identity-and-trust-security.md)
- [Silver Saml](https://faresbltagy.gitbook.io/footprintinglabs/ad/silver-saml.md)
- [Azure Pwned Lab](https://faresbltagy.gitbook.io/footprintinglabs/azure-pwned-lab.md)
- [Phished for Initial Access](https://faresbltagy.gitbook.io/footprintinglabs/azure-pwned-lab/phished-for-initial-access.md)
- [Page 2](https://faresbltagy.gitbook.io/footprintinglabs/azure-pwned-lab/page-2.md)
- [Abuse Azure Logic App Automation](https://faresbltagy.gitbook.io/footprintinglabs/azure-pwned-lab/abuse-azure-logic-app-automation.md)
- [CRTO](https://faresbltagy.gitbook.io/footprintinglabs/crto.md)
- [Malware Essentials](https://faresbltagy.gitbook.io/footprintinglabs/crto/malware-essentials.md)
- [Defense Evasion](https://faresbltagy.gitbook.io/footprintinglabs/crto/defense-evasion.md)
- [Compiled Artifacts](https://faresbltagy.gitbook.io/footprintinglabs/crto/defense-evasion/compiled-artifacts.md)
- [Build ELK Lab](https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab.md)
- [Configure Elasticsearch and Kibana setup in ubuntu](https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab/configure-elasticsearch-and-kibana-setup-in-ubuntu.md)
- [Configure Fluent-Bit to send logs to ELK](https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab/configure-fluent-bit-to-send-logs-to-elk.md)
- [Set up Winlogbeat & Filebeat for log collection](https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab/set-up-winlogbeat-and-filebeat-for-log-collection.md)
- [Send Logs from Winlogbeat through Logstash to ELK](https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab/send-logs-from-winlogbeat-through-logstash-to-elk.md)
- [Enable Windows Audit Policy & Winlogbeat](https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab/enable-windows-audit-policy-and-winlogbeat.md)
- [Elasticsearch API and Ingestion Pipeline](https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab/elasticsearch-api-and-ingestion-pipeline.md)
- [CARTE EXAM REPORT](https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab/carte-exam-report.md)
- [CyberDefenders](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders.md)
- [XXE Infiltration Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/xxe-infiltration-lab.md)
- [PacketDetective Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/packetdetective-lab.md)
- [Yellow RAT Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/yellow-rat-lab.md)
- [PsExec Hunt Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/psexec-hunt-lab.md)
- [T1594 Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/t1594-lab.md)
- [RetailBreach Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/retailbreach-lab.md)
- [DanaBot Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/danabot-lab.md)
- [RCEMiner Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/rceminer-lab.md)
- [OpenWire Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/openwire-lab.md)
- [BlueSky Ransomware Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/bluesky-ransomware-lab.md)
- [Openfire Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/openfire-lab.md)
- [Boss Of The SOC v1 Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/boss-of-the-soc-v1-lab.md)
- [GoldenSpray Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/goldenspray-lab.md)
- [Midnight RDP Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/midnight-rdp-lab.md)
- [REvil Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/revil-lab.md)
- [ShadowRoast Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/shadowroast-lab.md)
- [SolarDisruption Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/solardisruption-lab.md)
- [Kerberoasted Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/kerberoasted-lab.md)
- [T1197 Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/t1197-lab.md)
- [Amadey Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/amadey-lab.md)
- [Malware Traffic Analysis 1 Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/malware-traffic-analysis-1-lab.md)
- [TeamCity Exploit Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/teamcity-exploit-lab.md)
- [Insider Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/insider-lab.md)
- [Volatility Traces Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/volatility-traces-lab.md)
- [FalconEye Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/falconeye-lab.md)
- [GitTheGate Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/gitthegate-lab.md)
- [Trident Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/trident-lab.md)
- [NerisBot Lab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/nerisbot-lab.md)
- [SpoofGrab](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/spoofgrab.md)
- [TryHackme Rooms](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-rooms.md)
- [Investigating Windows](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-rooms/investigating-windows.md)
- [Splunk 2](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-rooms/splunk-2.md)
- [Windows Network Analysis](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-rooms/windows-network-analysis.md)
- [Powershell Scripting Fundamentals](https://faresbltagy.gitbook.io/footprintinglabs/powershell-scripting-fundamentals.md)
- [Hackthebox Rooms](https://faresbltagy.gitbook.io/footprintinglabs/hackthebox-rooms.md)
- [ Campfire-1 ](https://faresbltagy.gitbook.io/footprintinglabs/hackthebox-rooms/campfire-1.md)
- [Compromised](https://faresbltagy.gitbook.io/footprintinglabs/hackthebox-rooms/compromised.md)
- [Brutus](https://faresbltagy.gitbook.io/footprintinglabs/hackthebox-rooms/brutus.md)
- [Trent](https://faresbltagy.gitbook.io/footprintinglabs/hackthebox-rooms/trent.md)
- [ CrownJewel-1 ](https://faresbltagy.gitbook.io/footprintinglabs/hackthebox-rooms/crownjewel-1.md)
- [CrewCrow](https://faresbltagy.gitbook.io/footprintinglabs/hackthebox-rooms/crewcrow.md)
- [WEInnovate  Training ](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training.md)
- [Weinnovate - Active Directory Task One](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/weinnovate-active-directory-task-one.md)
- [WEinnovate - Active Directory - Task Two](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/weinnovate-active-directory-task-two.md)
- [Build ELK Lab](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/build-elk-lab.md)
- [Configure Elasticsearch and Kibana setup in ubuntu](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/build-elk-lab/configure-elasticsearch-and-kibana-setup-in-ubuntu.md)
- [Configure Fluent-Bit to send logs to ELK](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/build-elk-lab/configure-fluent-bit-to-send-logs-to-elk.md)
- [Set up Winlogbeat & Filebeat for log collection](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/build-elk-lab/set-up-winlogbeat-and-filebeat-for-log-collection.md)
- [Send Logs from Winlogbeat through Logstash to ELK](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/build-elk-lab/send-logs-from-winlogbeat-through-logstash-to-elk.md)
- [Enable Windows Audit Policy & Winlogbeat](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/build-elk-lab/enable-windows-audit-policy-and-winlogbeat.md)
- [Elasticsearch API and Ingestion Pipeline](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/build-elk-lab/elasticsearch-api-and-ingestion-pipeline.md)
- [SOAR](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/soar.md)
- [Send Alerts To Email & Telegram Bot](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/soar/send-alerts-to-email-and-telegram-bot.md)
- [Integrate Tines with ELK](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/soar/integrate-tines-with-elk.md)
- [Scenario 1: FTP Exploitation & Data Exfiltration](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/soar/scenario-1-ftp-exploitation-and-data-exfiltration.md)
- [SOC Practical Assessment](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/soc-practical-assessment.md)
- [Boss of the SOC V1 - Web Defacement](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/boss-of-the-soc-v1-web-defacement.md)
- [Lumma C2](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/lumma-c2.md)
- [Investigating Windows Scenario](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/investigating-windows-scenario.md)
- [Network Analysis](https://faresbltagy.gitbook.io/footprintinglabs/weinnovate-training/network-analysis.md)
- [TryHackme SOC 1](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1.md)
- [TShark](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/tshark.md)
- [TShark: The Basics](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/tshark/tshark-the-basics.md)
- [TShark: CLI Wireshark Features](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/tshark/tshark-cli-wireshark-features.md)
- [TShark Challenge I: Teamwork](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/tshark/tshark-challenge-i-teamwork.md)
- [TShark Challenge II: Directory](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/tshark/tshark-challenge-ii-directory.md)
- [Tempest](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/tempest.md): This room aims to introduce the process of analysing endpoint and network logs from a compromised asset. Given the artefacts, we will aim to uncover the incident from the Tempest machine. In this scen
- [Boogeyman 1](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/boogeyman-1.md): In this room, you will be tasked to analyse the Tactics, Techniques, and Procedures (TTPs) executed by a threat group, from obtaining initial access until achieving its objective.
- [Boogeyman 2](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/boogeyman-2.md): After having a severe attack from the Boogeyman, Quick Logistics LLC improved its security defences. However, the Boogeyman returns with new and improved tactics, techniques and procedures.
- [Boogeyman 3](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-1/boogeyman-3.md)
- [TryHackme SOC 2](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2.md)
- [ Advanced Splunk](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/advanced-splunk.md)
- [Splunk: Exploring SPL](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/advanced-splunk/splunk-exploring-spl.md)
- [Splunk: Setting up a SOC Lab](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/advanced-splunk/splunk-setting-up-a-soc-lab.md)
- [Splunk: Dashboards and Reports](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/advanced-splunk/splunk-dashboards-and-reports.md)
- [Splunk: Data Manipulation](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/advanced-splunk/splunk-data-manipulation.md)
- [Fixit](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/advanced-splunk/fixit.md)
- [Advanced ELK](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/advanced-elk.md)
- [Slingshot](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/advanced-elk/slingshot.md)
- [Threat Hunting](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/threat-hunting.md)
- [Threat Hunting: Foothold](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/threat-hunting/threat-hunting-foothold.md)
- [Threat Hunting: Pivoting](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/threat-hunting/threat-hunting-pivoting.md)
- [Threat Hunting: Endgame](https://faresbltagy.gitbook.io/footprintinglabs/tryhackme-soc-2/threat-hunting/threat-hunting-endgame.md)
- [Lab Simulation Tricks](https://faresbltagy.gitbook.io/footprintinglabs/lab-simulation-tricks.md)
- [CRTE](https://faresbltagy.gitbook.io/footprintinglabs/lab-simulation-tricks/crte.md)
- [LO 2](https://faresbltagy.gitbook.io/footprintinglabs/lab-simulation-tricks/crte/lo-2.md)
- [Notes for Labs](https://faresbltagy.gitbook.io/footprintinglabs/notes-for-labs.md)
- [Malware Development](https://faresbltagy.gitbook.io/footprintinglabs/malware-development.md)
- [BOF - Lab 4](https://faresbltagy.gitbook.io/footprintinglabs/malware-development/bof-lab-4.md)
- [Azure](https://faresbltagy.gitbook.io/footprintinglabs/azure.md)
- [Initial Access](https://faresbltagy.gitbook.io/footprintinglabs/azure/initial-access.md)
- [Credential Theft](https://faresbltagy.gitbook.io/footprintinglabs/azure/credential-theft.md)
- [Persistence](https://faresbltagy.gitbook.io/footprintinglabs/azure/persistence.md)
- [CARTP](https://faresbltagy.gitbook.io/footprintinglabs/cartp.md)
- [Recon](https://faresbltagy.gitbook.io/footprintinglabs/cartp/recon.md)
- [Token](https://faresbltagy.gitbook.io/footprintinglabs/cartp/token.md)
- [Automated Enumeration](https://faresbltagy.gitbook.io/footprintinglabs/cartp/automated-enumeration.md)
- [Initial Access](https://faresbltagy.gitbook.io/footprintinglabs/cartp/initial-access.md)
- [CARTE](https://faresbltagy.gitbook.io/footprintinglabs/carte.md)
- [Red Team Notes](https://faresbltagy.gitbook.io/footprintinglabs/red-team-notes.md)
- [Cobalt Strike](https://faresbltagy.gitbook.io/footprintinglabs/cobalt-strike.md)
- [DLL Injection](https://faresbltagy.gitbook.io/footprintinglabs/dll-injection.md)
- [Malware Analysis](https://faresbltagy.gitbook.io/footprintinglabs/malware-analysis.md)
- [Session 2](https://faresbltagy.gitbook.io/footprintinglabs/malware-analysis/session-2.md)
- [AD Notes](https://faresbltagy.gitbook.io/footprintinglabs/ad-notes.md)
- [Page 1](https://faresbltagy.gitbook.io/footprintinglabs/ad-notes/page-1.md)
- [Code](https://faresbltagy.gitbook.io/footprintinglabs/ad-notes/code.md)
- [Pivoting Notes](https://faresbltagy.gitbook.io/footprintinglabs/pivoting-notes.md)
- [13Cubed](https://faresbltagy.gitbook.io/footprintinglabs/13cubed.md)
- [ Introduction to Windows Forensics ](https://faresbltagy.gitbook.io/footprintinglabs/13cubed/introduction-to-windows-forensics.md)
- [ Windows SRUM Forensics ](https://faresbltagy.gitbook.io/footprintinglabs/13cubed/windows-srum-forensics.md)
- [Windows MACB Timestamps (NTFS Forensics)](https://faresbltagy.gitbook.io/footprintinglabs/13cubed/windows-macb-timestamps-ntfs-forensics.md)
- [Windows NTFS Index Attributes ($I30 Files)](https://faresbltagy.gitbook.io/footprintinglabs/13cubed/windows-ntfs-index-attributes-usdi30-files.md)
- [LNK Files and Jump Lists](https://faresbltagy.gitbook.io/footprintinglabs/13cubed/lnk-files-and-jump-lists.md)
- [ShellBags ](https://faresbltagy.gitbook.io/footprintinglabs/13cubed/shellbags.md)
- [Notes](https://faresbltagy.gitbook.io/footprintinglabs/13cubed/notes.md)
- [Python Excercise](https://faresbltagy.gitbook.io/footprintinglabs/python-excercise.md)
- [Sans SEC505 ](https://faresbltagy.gitbook.io/footprintinglabs/sans-sec505.md)
- [Book One](https://faresbltagy.gitbook.io/footprintinglabs/sans-sec505/book-one.md)
- [The Object-Oriented Command Shell](https://faresbltagy.gitbook.io/footprintinglabs/sans-sec505/book-one/the-object-oriented-command-shell.md)
- [Jobs](https://faresbltagy.gitbook.io/footprintinglabs/jobs.md)
- [Scenario Three](https://faresbltagy.gitbook.io/footprintinglabs/scenario-three.md)
- [Practical Malware Analysis](https://faresbltagy.gitbook.io/footprintinglabs/practical-malware-analysis.md)
- [Chapter 1](https://faresbltagy.gitbook.io/footprintinglabs/practical-malware-analysis/chapter-1.md)
- [Chapter 3](https://faresbltagy.gitbook.io/footprintinglabs/practical-malware-analysis/chapter-3.md)
- [Investigate Linux Scenario](https://faresbltagy.gitbook.io/footprintinglabs/investigate-linux-scenario.md)
- [Network Security](https://faresbltagy.gitbook.io/footprintinglabs/network-security.md)
- [SANS SEC487](https://faresbltagy.gitbook.io/footprintinglabs/sans-sec487.md)
- [Book One](https://faresbltagy.gitbook.io/footprintinglabs/sans-sec487/book-one.md)
- [Detailed Analysis of Cobalt Strike and LockBit Ransomware Attack](https://faresbltagy.gitbook.io/footprintinglabs/detailed-analysis-of-cobalt-strike-and-lockbit-ransomware-attack.md)
- [Windows Forensics](https://faresbltagy.gitbook.io/footprintinglabs/windows-forensics.md)
- [Collecting Volatile Data](https://faresbltagy.gitbook.io/footprintinglabs/windows-forensics/collecting-volatile-data.md)
- [Creating File System Images](https://faresbltagy.gitbook.io/footprintinglabs/windows-forensics/creating-file-system-images.md)
- [Qradar](https://faresbltagy.gitbook.io/footprintinglabs/qradar.md)
- [Elastic Stack](https://faresbltagy.gitbook.io/footprintinglabs/elastic-stack.md)
- [Splunk](https://faresbltagy.gitbook.io/footprintinglabs/splunk.md)
- [Fortigate Firewall](https://faresbltagy.gitbook.io/footprintinglabs/fortigate-firewall.md)
- [Digital Forensics](https://faresbltagy.gitbook.io/footprintinglabs/digital-forensics.md)
- [Overthewire](https://faresbltagy.gitbook.io/footprintinglabs/overthewire.md)
- [Linux](https://faresbltagy.gitbook.io/footprintinglabs/linux.md)
- [Notes](https://faresbltagy.gitbook.io/footprintinglabs/notes.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on a page URL with the `ask` query parameter:
```
GET https://faresbltagy.gitbook.io/footprintinglabs/whoami.md?ask=<question>
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.