Posts tagged "triage"

• What is DFIR triage? (glossary)

  Triage is the fast pass that decides whether a host is worth a full investigation. Amcache is one of the cheapest, most productive artefacts in the triage kit.

  2026-05-24

• Hunting commodity malware with Amcache

  An Amcache-first triage playbook for commodity malware on Windows. The filters that surface attacker tooling, the pivots that confirm execution, and the cross-host queries that scope the incident.

  2026-05-24