Tag Info

New answers tagged

3

It is possible when Windows logs the login event in the event viewer, it takes the login time from the system clock set. So a user could adjust the time and date then log back into the system which would log the event using the changed time/date, then then clock could be adjusted back to the correct time/date. this would show the last login as anything the ...


1

You've already listed some resources so I will add another that is not a tool per-se, but a write up on how the different browsers are storing data. The write up contains a minimal python script that should help get you started. As for Safari, pre version 6.0 the credentials were only base64 encoded so it was easier to get data then. The difference with ...


1

The answer all depends on the rootkit and how it operated. There WILL BE remnants, but whether they are visible, encrypted, mangled, etc., are another story. Since you have a memory image, you can analyze it with Volatility, carve out data from the dmp with psdispscan if you can detect the anomaly from the memory. You could also use scalpel to do this but ...


2

You are wrong. It still shows up in the event logs and the computer knows if it is an RDP session. You can see that there is an active RDP connection if you have the right tools up as well. What you are talking about isn't an "invisible user", it's a service user, and it is an intentionally designed feature of Windows, not a security hole. You just ...



Top 50 recent answers are included