# Análisis forense

- Realizar dump cada cierto tiempo para ver en qué trabaja el usuario
- Analizar dump
- Qué hace el usuario?
- Más evidencias de dónde accede
- Realizar dump de Notepad y otros programas
- Extraer images de dmp

## Crear un fichero de volcado de memoria de un proceso de forma gráfica
https://www.jesusninoc.com/2016/10/14/crear-un-fichero-de-volcado-de-memoria-de-un-proceso-de-forma-grafica/

## Crear un fichero de volcado de memoria de un proceso
https://www.jesusninoc.com/2016/03/04/crear-un-fichero-de-volcado-de-memoria-de-un-proceso/

## Extract all the jpgs found in chrome.dmp (dump file)
https://www.jesusninoc.com/2016/10/15/extract-all-the-jpgs-found-in-chrome-dmp-dump-file/

## mysqldump: A Database Backup Program
https://www.jesusninoc.com/2014/11/25/mysqldump-database-backup-program/

## Other links

* http://ins3cure.blogspot.com.es/2012/08/extract-images-from-process-memory-dumps.html
* http://www.dfrws.org/2006/challenge/submission.shtml
* http://www.techipick.com/forensics-memdump-extractor

# Volcado de memoria de procesos

## Crear un fichero de volcado de memoria de un proceso
https://www.jesusninoc.com/2016/03/04/crear-un-fichero-de-volcado-de-memoria-de-un-proceso/
## Crear un fichero de volcado de memoria de un proceso y detectar DLL
https://www.jesusninoc.com/2017/10/22/crear-un-fichero-de-volcado-de-memoria-de-un-proceso-y-detectar-dll/

# mimikatz
mimikatz is a tool I've made to learn C and make somes experiments with Windows security.
It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.

https://github.com/gentilkiwi/mimikatz

## Mimikatz on Windows 10
https://astr0baby.wordpress.com/2018/01/30/running-latest-x64-mimikatz-on-windows-10/

# Cargar en memoria y ejecutar un payload de ejecución de comandos arbitrarios en PowerShell
https://www.jesusninoc.com/2017/02/16/cargar-en-memoria-y-ejecutar-un-payload-de-ejecucion-de-comandos-arbitrarios-en-powershell/

# Converting PowerShell to Batch
http://community.idera.com/powershell/powertips/b/tips/posts/converting-powershell-to-batch

# Formas de descargar y ejecutar ficheros desde un servidor en PowerShell
https://www.jesusninoc.com/2016/11/15/formas-de-descargar-y-ejecutar-ficheros-desde-un-servidor-en-powershell/

# Bypasses UAC by abusing the App Path key for control.exe (only tested on Windows 10)
https://www.jesusninoc.com/2017/03/22/bypasses-uac-by-abusing-the-app-path-key-for-control-exe-only-tested-on-windows-10/

# Generate-Macro
This Powershell script will generate a malicious Microsoft Office document with a specified payload and persistence method.
https://github.com/enigma0x3/Generate-Macro
