Andreas Hunkeler

This issue is the place for discussing your inputs regarding the card design and layout. Do you have inputs and improvements for the current design? Would you change it? Let's...

This issue is the place for discussing your inputs regarding the cards. Do you have new ideas for scenarios and activities? Would you rephrase existing cards? Let's discuss card related...

This issue is the place for discussing your inputs regarding the game play and the proposed rules. Do the rules work for you? Or would you change them? Let's discuss...

Please fill in this template: - [x] Use a meaningful title for the pull request. Include the name of the resource added. _Tool and section mentioned._ - [x] Add a...

Would you mind renaming the evidence collection sections, so the are grouped together or merge them at all? Other categories don't use the split for the OS. Currently we have...

Add WindowsIndexSearch parsing using ESEDatabaseView

12

## Description Add WindowsIndexSearch parsing using ESEDatabaseView. Currently, we collect the Windows Index Search DB through !BasicCollection but lack a module to parse it. One way is to use the...

Add modification-of-exefile-shell-open-key.md

1

Add first detection of the exefile shell open key to the repo. See also https://twitter.com/swisscom_csirt/status/1461686311769759745 for a short description. It is currently used by Lokibot for persistence. Sneaky! Once in...

Improve wording in readme

1

Only fixes some small typos and wording issues after reading the readme.