https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/index.html对各类取证检查结果（系统进程、日志、端口、文件、浏览器、凭据等）的深度分析与入侵判断方法。Hugozh-CNWed, 01 Jul 2026 18:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Windows%E4%BA%8B%E4%BB%B6%E6%97%A5%E5%BF%97%E7%8B%A9%E7%8C%8E%E4%B8%8E%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8%E6%BA%AF%E6%BA%90/index.htmlThu, 11 Jun 2026 12:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Windows%E4%BA%8B%E4%BB%B6%E6%97%A5%E5%BF%97%E7%8B%A9%E7%8C%8E%E4%B8%8E%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8%E6%BA%AF%E6%BA%90/index.html深入解析Windows EVTX日志机制，结合Sysmon探讨如何从海量日志中精准狩猎横向移动（PtH、PsExec、WMI）与权限维持痕迹。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%9A%90%E8%94%BDC2%E6%B5%81%E9%87%8F%E5%88%86%E6%9E%90%E4%B8%8ETLS%E9%9A%A7%E9%81%93%E5%89%A5%E7%A6%BB/index.htmlThu, 11 Jun 2026 13:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%9A%90%E8%94%BDC2%E6%B5%81%E9%87%8F%E5%88%86%E6%9E%90%E4%B8%8ETLS%E9%9A%A7%E9%81%93%E5%89%A5%E7%A6%BB/index.html深度剖析现代APT隐蔽C2通信机制，探讨心跳特征（Beaconing）、JA3指纹识别，以及如何在应急响应中剥离和解密TLS加密隧道。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%8B%92%E7%B4%A2%E7%97%85%E6%AF%92%E4%B8%8E%E5%90%8E%E9%97%A8%E9%80%86%E5%90%91%E5%88%86%E6%9E%90%E5%9F%BA%E7%A1%80/index.htmlThu, 11 Jun 2026 09:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%8B%92%E7%B4%A2%E7%97%85%E6%AF%92%E4%B8%8E%E5%90%8E%E9%97%A8%E9%80%86%E5%90%91%E5%88%86%E6%9E%90%E5%9F%BA%E7%A1%80/index.html应急响应中的恶意代码逆向工程。从静态分析到动态调试，深度剖析勒索病毒的加密逻辑、系统破坏行为以及后门程序的网络通信基因。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Linux%E6%97%A5%E5%BF%97%E6%97%B6%E9%97%B4%E7%BA%BF%E5%88%86%E6%9E%90%E4%B8%8ESSH%E5%85%A5%E4%BE%B5%E6%BA%AF%E6%BA%90/index.htmlMon, 15 Jun 2026 10:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Linux%E6%97%A5%E5%BF%97%E6%97%B6%E9%97%B4%E7%BA%BF%E5%88%86%E6%9E%90%E4%B8%8ESSH%E5%85%A5%E4%BE%B5%E6%BA%AF%E6%BA%90/index.html围绕 auth.log、secure、wtmp、bash_history 与 Web 日志，构建 Linux 主机入侵后的时间线分析方法，定位爆破、成功登录、提权与横向移动痕迹。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E8%87%AA%E5%90%AF%E5%8A%A8%E9%A1%B9%E8%AE%A1%E5%88%92%E4%BB%BB%E5%8A%A1%E4%B8%8E%E6%9C%8D%E5%8A%A1%E6%8C%81%E4%B9%85%E5%8C%96%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 11:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E8%87%AA%E5%90%AF%E5%8A%A8%E9%A1%B9%E8%AE%A1%E5%88%92%E4%BB%BB%E5%8A%A1%E4%B8%8E%E6%9C%8D%E5%8A%A1%E6%8C%81%E4%B9%85%E5%8C%96%E5%88%86%E6%9E%90/index.html从 Windows Run 键、计划任务、系统服务到 Linux systemd、cron、rc.local，系统梳理入侵后常见持久化方式及其取证分析思路。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%91%BD%E4%BB%A4%E8%A1%8C%E5%8E%86%E5%8F%B2%E5%8F%96%E8%AF%81%E4%B8%8E%E6%94%BB%E5%87%BB%E8%80%85%E8%A1%8C%E4%B8%BA%E8%BF%98%E5%8E%9F/index.htmlMon, 15 Jun 2026 12:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%91%BD%E4%BB%A4%E8%A1%8C%E5%8E%86%E5%8F%B2%E5%8F%96%E8%AF%81%E4%B8%8E%E6%94%BB%E5%87%BB%E8%80%85%E8%A1%8C%E4%B8%BA%E8%BF%98%E5%8E%9F/index.html围绕 bash_history、zsh_history、PowerShell 历史、ConsoleHost 与 doskey 等证据，分析如何在应急响应中恢复攻击者的操作链并识别清痕行为。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%8F%E8%A7%88%E5%99%A8%E7%97%95%E8%BF%B9%E4%B8%8E%E4%B8%8B%E8%BD%BD%E6%89%A7%E8%A1%8C%E9%93%BE%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 13:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%8F%E8%A7%88%E5%99%A8%E7%97%95%E8%BF%B9%E4%B8%8E%E4%B8%8B%E8%BD%BD%E6%89%A7%E8%A1%8C%E9%93%BE%E5%88%86%E6%9E%90/index.html从浏览器历史、下载记录、缓存、TypedURLs 与本地文件落地痕迹出发，分析钓鱼、下载执行与后续落地的完整攻击链。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/WebShell%E8%90%BD%E5%9C%B0%E4%B8%8E%E6%96%87%E4%BB%B6%E6%97%B6%E9%97%B4%E7%BA%BF%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 14:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/WebShell%E8%90%BD%E5%9C%B0%E4%B8%8E%E6%96%87%E4%BB%B6%E6%97%B6%E9%97%B4%E7%BA%BF%E5%88%86%E6%9E%90/index.html围绕 WebShell 文件落地、访问日志、文件时间戳、执行链与二次下载行为，分析如何判断 WebShell 是入口、驻留点还是横向跳板。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%95%B0%E6%8D%AE%E5%BA%93%E7%97%95%E8%BF%B9%E4%B8%8E%E5%87%AD%E6%8D%AE%E6%B3%84%E9%9C%B2%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 15:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%95%B0%E6%8D%AE%E5%BA%93%E7%97%95%E8%BF%B9%E4%B8%8E%E5%87%AD%E6%8D%AE%E6%B3%84%E9%9C%B2%E5%88%86%E6%9E%90/index.html围绕数据库服务、监听端口、配置文件、客户端历史与导出痕迹，分析攻击者如何获取、滥用和外传数据库凭据及业务数据。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%86%85%E7%BD%91%E6%A8%AA%E5%90%91%E7%97%95%E8%BF%B9%E4%B8%8E%E8%B7%B3%E6%9D%BF%E6%9C%BA%E8%A1%8C%E4%B8%BA%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 16:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%86%85%E7%BD%91%E6%A8%AA%E5%90%91%E7%97%95%E8%BF%B9%E4%B8%8E%E8%B7%B3%E6%9D%BF%E6%9C%BA%E8%A1%8C%E4%B8%BA%E5%88%86%E6%9E%90/index.html结合系统用户、共享、端口连接、服务与登录日志，分析攻击者在内网中的横向移动路径，以及被控主机是否已被用作跳板机。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%82%AE%E4%BB%B6%E7%97%95%E8%BF%B9%E4%B8%8E%E9%92%93%E9%B1%BC%E6%8A%95%E9%80%92%E9%93%BE%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 17:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%82%AE%E4%BB%B6%E7%97%95%E8%BF%B9%E4%B8%8E%E9%92%93%E9%B1%BC%E6%8A%95%E9%80%92%E9%93%BE%E5%88%86%E6%9E%90/index.html围绕邮件日志、投递轨迹、附件与链接痕迹、终端访问记录和下载执行行为，分析钓鱼邮件如何完成从投递到主机失陷的闭环。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%97%A5%E5%BF%97%E6%B8%85%E7%90%86%E4%B8%8E%E5%8F%8D%E5%8F%96%E8%AF%81%E7%97%95%E8%BF%B9%E8%AF%86%E5%88%AB/index.htmlMon, 15 Jun 2026 18:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%97%A5%E5%BF%97%E6%B8%85%E7%90%86%E4%B8%8E%E5%8F%8D%E5%8F%96%E8%AF%81%E7%97%95%E8%BF%B9%E8%AF%86%E5%88%AB/index.html围绕 Windows 事件日志、Linux 系统日志、命令历史与文件时间线，分析攻击者如何清理痕迹，以及蓝队如何识别日志断层与反取证行为。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%B3%BB%E7%BB%9F%E6%97%A5%E5%BF%97%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E8%AF%81%E6%8D%AE%E5%BC%BA%E5%BA%A6%E5%88%86%E5%B1%82%E4%B8%8E%E4%BA%8B%E4%BB%B6%E9%93%BE%E6%9E%84%E5%BB%BA%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 20:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%B3%BB%E7%BB%9F%E6%97%A5%E5%BF%97%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E8%AF%81%E6%8D%AE%E5%BC%BA%E5%BA%A6%E5%88%86%E5%B1%82%E4%B8%8E%E4%BA%8B%E4%BB%B6%E9%93%BE%E6%9E%84%E5%BB%BA%E5%88%86%E6%9E%90/index.html围绕 0x02 系统日志检查取回的 Windows 事件日志与 Linux 系统日志，分析不同日志源、不同事件 ID 的证据强度差异，以及如何从单条日志事件构建到可交付的事件链。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%87%AD%E6%8D%AE%E6%8A%93%E5%8F%96%E4%B8%8E%E8%AE%A4%E8%AF%81%E6%9D%90%E6%96%99%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 19:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%87%AD%E6%8D%AE%E6%8A%93%E5%8F%96%E4%B8%8E%E8%AE%A4%E8%AF%81%E6%9D%90%E6%96%99%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.html围绕密码、Hash、Ticket、Cookie、SSH 私钥与浏览器保存凭据，分析攻击者如何获取和复用认证材料，并据此推动横向移动与持久控制。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%BC%82%E5%B8%B8%E7%AB%AF%E5%8F%A3%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E8%BF%9B%E7%A8%8B%E5%85%B3%E8%81%94%E5%8F%8A%E5%A4%96%E8%81%94%E7%9B%AE%E6%A0%87%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 23:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%BC%82%E5%B8%B8%E7%AB%AF%E5%8F%A3%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E8%BF%9B%E7%A8%8B%E5%85%B3%E8%81%94%E5%8F%8A%E5%A4%96%E8%81%94%E7%9B%AE%E6%A0%87%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.html围绕 0x02 异常端口查询中 netstat 命令取回的端口和连接结果，分析如何将端口状态、进程关联、外联目标组合成可定性的判断。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%A1%B5%E9%9D%A2%E7%AF%A1%E6%94%B9%E4%BA%8B%E4%BB%B6%E4%B8%AD%E7%9A%84%E6%96%87%E4%BB%B6%E5%B7%AE%E5%BC%82%E4%B8%8E%E5%8F%91%E5%B8%83%E9%93%BE%E5%9B%9E%E6%BA%AF/index.htmlMon, 15 Jun 2026 20:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%A1%B5%E9%9D%A2%E7%AF%A1%E6%94%B9%E4%BA%8B%E4%BB%B6%E4%B8%AD%E7%9A%84%E6%96%87%E4%BB%B6%E5%B7%AE%E5%BC%82%E4%B8%8E%E5%8F%91%E5%B8%83%E9%93%BE%E5%9B%9E%E6%BA%AF/index.html围绕站点文件差异、发布目录、静态资源、时间线与运维链路，分析页面篡改事件的定位方法、入口判断与影响范围回溯。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E8%BF%9C%E6%8E%A7%E6%9C%A8%E9%A9%AC%E8%90%BD%E5%9C%B0%E5%90%8E%E7%9A%84%E4%BB%A3%E7%90%86%E9%9A%A7%E9%81%93%E4%B8%8E%E5%87%BA%E7%BD%91%E9%93%BE%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 21:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E8%BF%9C%E6%8E%A7%E6%9C%A8%E9%A9%AC%E8%90%BD%E5%9C%B0%E5%90%8E%E7%9A%84%E4%BB%A3%E7%90%86%E9%9A%A7%E9%81%93%E4%B8%8E%E5%87%BA%E7%BD%91%E9%93%BE%E5%88%86%E6%9E%90/index.html围绕代理工具、隧道配置、出站连接、守护机制与回连节奏，分析远控木马落地后如何建立稳定出网链，以及蓝队如何还原其控制路径。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%91%BD%E4%BB%A4%E5%8E%86%E5%8F%B2%E5%8F%AF%E9%9D%A0%E6%80%A7%E9%AA%8C%E8%AF%81%E4%B8%8E%E5%8F%8D%E5%8F%96%E8%AF%81%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 00:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%91%BD%E4%BB%A4%E5%8E%86%E5%8F%B2%E5%8F%AF%E9%9D%A0%E6%80%A7%E9%AA%8C%E8%AF%81%E4%B8%8E%E5%8F%8D%E5%8F%96%E8%AF%81%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.html围绕 0x02 命令行历史记录取证结果，分析如何验证命令历史的可靠性、检测反取证行为、恢复被删除或篡改的历史记录。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%A4%87%E4%BB%BD%E6%96%87%E4%BB%B6%E5%8E%8B%E7%BC%A9%E5%8C%85%E4%B8%8E%E6%95%B0%E6%8D%AE%E6%89%93%E5%8C%85%E5%A4%96%E4%BC%A0%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 22:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%A4%87%E4%BB%BD%E6%96%87%E4%BB%B6%E5%8E%8B%E7%BC%A9%E5%8C%85%E4%B8%8E%E6%95%B0%E6%8D%AE%E6%89%93%E5%8C%85%E5%A4%96%E4%BC%A0%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.html围绕备份文件、压缩包、临时目录、导出文件与出站传输，分析攻击者如何整理数据、打包数据并完成外传，以及蓝队如何从文件和时间线中还原窃密过程。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%B3%BB%E7%BB%9F%E7%94%A8%E6%88%B7%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E5%BC%82%E5%B8%B8%E8%B4%A6%E6%88%B7%E5%8F%8A%E5%BD%B1%E5%AD%90%E8%B4%A6%E6%88%B7%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 01:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%B3%BB%E7%BB%9F%E7%94%A8%E6%88%B7%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E5%BC%82%E5%B8%B8%E8%B4%A6%E6%88%B7%E5%8F%8A%E5%BD%B1%E5%AD%90%E8%B4%A6%E6%88%B7%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.html围绕 0x02 系统用户审查取证结果，分析如何检测异常账户、影子账户、权限提升痕迹，以及如何将用户检查结果与登录日志交叉验证。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%9B%9E%E6%94%B6%E7%AB%99%E6%AE%8B%E7%95%99%E4%B8%8E%E5%88%A0%E9%99%A4%E6%84%8F%E5%9B%BE%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 12:30:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%9B%9E%E6%94%B6%E7%AB%99%E6%AE%8B%E7%95%99%E4%B8%8E%E5%88%A0%E9%99%A4%E6%84%8F%E5%9B%BE%E5%88%86%E6%9E%90/index.html围绕 Windows 回收站与 Linux Trash 残留，分析文件删除行为、用户归属、删除时间、原始路径以及清痕与误删之间的边界。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E4%BA%91%E4%B8%BB%E6%9C%BA%E4%B8%8E%E5%AF%B9%E8%B1%A1%E5%AD%98%E5%82%A8%E8%AE%BF%E9%97%AE%E7%97%95%E8%BF%B9%E5%88%86%E6%9E%90/index.htmlMon, 15 Jun 2026 23:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E4%BA%91%E4%B8%BB%E6%9C%BA%E4%B8%8E%E5%AF%B9%E8%B1%A1%E5%AD%98%E5%82%A8%E8%AE%BF%E9%97%AE%E7%97%95%E8%BF%B9%E5%88%86%E6%9E%90/index.html围绕云主机、对象存储、审计日志、快照导出与 IAM 身份调用，分析攻击者如何访问和带走云上数据，并给出 AWS、GCP、Azure 的现场排查命令。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%B7%B2%E5%88%A0%E9%99%A4%E6%96%87%E4%BB%B6%E6%81%A2%E5%A4%8D%E7%BB%93%E6%9E%9C%E4%B8%8E%E8%A6%86%E7%9B%96%E7%A8%8B%E5%BA%A6%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 13:20:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%B7%B2%E5%88%A0%E9%99%A4%E6%96%87%E4%BB%B6%E6%81%A2%E5%A4%8D%E7%BB%93%E6%9E%9C%E4%B8%8E%E8%A6%86%E7%9B%96%E7%A8%8B%E5%BA%A6%E5%88%86%E6%9E%90/index.html围绕文件恢复结果、未分配空间、元数据残留和覆盖程度，分析删除文件在应急中的真实含义、恢复边界与攻击链价值。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%B3%BB%E7%BB%9F%E5%85%B1%E4%BA%AB%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E6%A8%AA%E5%90%91%E6%8A%95%E9%80%81%E5%8F%8A%E6%9D%83%E9%99%90%E6%9A%B4%E9%9C%B2%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 02:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%B3%BB%E7%BB%9F%E5%85%B1%E4%BA%AB%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E6%A8%AA%E5%90%91%E6%8A%95%E9%80%81%E5%8F%8A%E6%9D%83%E9%99%90%E6%9A%B4%E9%9C%B2%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.html围绕 0x02 系统共享检查取证结果，分析如何从共享配置中判断横向投送风险和权限暴露面。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%A3%81%E7%9B%98%E9%95%9C%E5%83%8F%E5%AE%8C%E6%95%B4%E6%80%A7%E6%A0%A1%E9%AA%8C%E4%B8%8E%E9%87%87%E4%BF%A1%E8%BE%B9%E7%95%8C%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 14:05:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%A3%81%E7%9B%98%E9%95%9C%E5%83%8F%E5%AE%8C%E6%95%B4%E6%80%A7%E6%A0%A1%E9%AA%8C%E4%B8%8E%E9%87%87%E4%BF%A1%E8%BE%B9%E7%95%8C%E5%88%86%E6%9E%90/index.html围绕原始镜像、E01/AFF 元数据、哈希校验、分段文件和扇区信息，分析镜像是否可信、是否完整、哪些问题会影响证据采信。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%8F%AF%E7%96%91%E8%BF%9B%E7%A8%8B%E6%A0%91%E4%B8%8E%E7%88%B6%E5%AD%90%E8%BF%9B%E7%A8%8B%E5%BC%82%E5%B8%B8%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 00:10:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%8F%AF%E7%96%91%E8%BF%9B%E7%A8%8B%E6%A0%91%E4%B8%8E%E7%88%B6%E5%AD%90%E8%BF%9B%E7%A8%8B%E5%BC%82%E5%B8%B8%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.html围绕父子进程关系、异常祖先进程、伪装进程与执行链跳转，分析如何通过进程树快速识别下载执行、横向移动、凭据抓取与后渗透行为。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%B3%BB%E7%BB%9F%E8%BF%9B%E7%A8%8B%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E4%BC%AA%E8%A3%85%E5%8F%8ALOLBin%E6%89%A7%E8%A1%8C%E9%93%BE%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 22:20:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%B3%BB%E7%BB%9F%E8%BF%9B%E7%A8%8B%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E4%BC%AA%E8%A3%85%E5%8F%8ALOLBin%E6%89%A7%E8%A1%8C%E9%93%BE%E5%88%86%E6%9E%90/index.html围绕 ps、pstree、tasklist、/proc 等取证结果，分析如何识别伪装进程、异常父子链、LOLBin 代理执行与路径错位。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%A3%81%E7%9B%98%E6%8C%82%E8%BD%BD%E7%BB%93%E6%9E%9C%E4%B8%8E%E5%88%86%E5%8C%BA%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F%E5%BC%82%E5%B8%B8%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 14:35:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%A3%81%E7%9B%98%E6%8C%82%E8%BD%BD%E7%BB%93%E6%9E%9C%E4%B8%8E%E5%88%86%E5%8C%BA%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F%E5%BC%82%E5%B8%B8%E5%88%86%E6%9E%90/index.html围绕 mmls、fsstat、只读挂载、偏移计算和分区结构，分析镜像挂载结果是否可信、分区文件系统是否异常以及这些异常在应急中的意义。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%9C%8D%E5%8A%A1%E4%BF%A1%E6%81%AF%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8EImagePath%E5%8F%8AServiceDLL%E9%A9%BB%E7%95%99%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 22:35:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%9C%8D%E5%8A%A1%E4%BF%A1%E6%81%AF%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8EImagePath%E5%8F%8AServiceDLL%E9%A9%BB%E7%95%99%E5%88%86%E6%9E%90/index.html围绕服务信息检查结果，分析 ImagePath、ServiceDLL、svchost 共享服务、失败动作与伪装服务驻留的判断方法。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%AE%89%E5%85%A8%E7%AD%96%E7%95%A5%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E9%98%B2%E6%8A%A4%E7%BB%95%E8%BF%87%E5%8F%8A%E7%AD%96%E7%95%A5%E7%AF%A1%E6%94%B9%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 03:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%AE%89%E5%85%A8%E7%AD%96%E7%95%A5%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E9%98%B2%E6%8A%A4%E7%BB%95%E8%BF%87%E5%8F%8A%E7%AD%96%E7%95%A5%E7%AF%A1%E6%94%B9%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.html围绕 0x02 安全策略检测取证结果，分析如何从策略配置中判断防护绕过风险和策略篡改痕迹。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%87%8D%E7%82%B9%E7%9B%AE%E5%BD%95%E5%BC%82%E5%B8%B8%E6%96%87%E4%BB%B6%E4%B8%8E%E8%90%BD%E5%9C%B0%E8%BD%BD%E8%8D%B7%E5%85%B3%E8%81%94%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 15:05:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%87%8D%E7%82%B9%E7%9B%AE%E5%BD%95%E5%BC%82%E5%B8%B8%E6%96%87%E4%BB%B6%E4%B8%8E%E8%90%BD%E5%9C%B0%E8%BD%BD%E8%8D%B7%E5%85%B3%E8%81%94%E5%88%86%E6%9E%90/index.html围绕临时目录、下载目录、Prefetch、Recent、Amcache 等重点目录结果，分析异常文件是工具投放、载荷落地、中间产物还是清痕残留。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%98%A0%E5%83%8F%E5%8A%AB%E6%8C%81%E4%B8%8EIFEO%E6%8C%81%E4%B9%85%E5%8C%96%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 00:40:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%98%A0%E5%83%8F%E5%8A%AB%E6%8C%81%E4%B8%8EIFEO%E6%8C%81%E4%B9%85%E5%8C%96%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.html围绕 Image File Execution Options、Debugger、SilentProcessExit 与可访问性程序后门，分析 Windows 映像劫持持久化的创建态、运行态与清理方法。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%87%8D%E7%82%B9%E6%96%87%E4%BB%B6%E6%97%B6%E9%97%B4%E7%BA%BF%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E6%94%BB%E5%87%BB%E8%80%85%E6%93%8D%E4%BD%9C%E8%8A%82%E5%BE%8B%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 22:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%87%8D%E7%82%B9%E6%96%87%E4%BB%B6%E6%97%B6%E9%97%B4%E7%BA%BF%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E6%94%BB%E5%87%BB%E8%80%85%E6%93%8D%E4%BD%9C%E8%8A%82%E5%BE%8B%E5%88%86%E6%9E%90/index.html围绕 0x02 重点文件检查中 stat、find、forfiles 等命令取回的文件时间戳结果，分析如何通过 MACE 时间分层、时间窗聚类和跨源交叉验证，还原攻击者的操作节律和入侵时序。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%94%B5%E5%AD%90%E8%AF%81%E6%8D%AE%E9%93%BE%E8%AE%B0%E5%BD%95%E4%B8%8E%E5%88%86%E6%9E%90%E7%BB%93%E8%AE%BA%E5%8F%AF%E4%BF%A1%E5%BA%A6%E8%AF%84%E4%BC%B0/index.htmlTue, 16 Jun 2026 15:30:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%94%B5%E5%AD%90%E8%AF%81%E6%8D%AE%E9%93%BE%E8%AE%B0%E5%BD%95%E4%B8%8E%E5%88%86%E6%9E%90%E7%BB%93%E8%AE%BA%E5%8F%AF%E4%BF%A1%E5%BA%A6%E8%AF%84%E4%BC%B0/index.html围绕编号、拍照、哈希、只读、交接、日志和报告记录，分析电子证据链是否完整，以及分析结论的证据强度如何评估。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/hosts%E6%96%87%E4%BB%B6%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8EDNS%E5%8A%AB%E6%8C%81%E5%8F%8A%E5%86%85%E7%BD%91%E9%87%8D%E5%AE%9A%E5%90%91%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 04:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/hosts%E6%96%87%E4%BB%B6%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8EDNS%E5%8A%AB%E6%8C%81%E5%8F%8A%E5%86%85%E7%BD%91%E9%87%8D%E5%AE%9A%E5%90%91%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.html围绕 0x02 hosts文件检查取证结果，分析如何从hosts文件内容中判断DNS劫持、内网重定向、安全软件屏蔽等攻击行为。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Recent%E4%B8%8EPrefetch%E5%92%8CAmcache%E6%89%A7%E8%A1%8C%E7%97%95%E8%BF%B9%E4%BA%A4%E5%8F%89%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 16:10:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Recent%E4%B8%8EPrefetch%E5%92%8CAmcache%E6%89%A7%E8%A1%8C%E7%97%95%E8%BF%B9%E4%BA%A4%E5%8F%89%E5%88%86%E6%9E%90/index.html围绕 Recent、LNK、Prefetch、Amcache 等执行痕迹，分析程序是仅存在、被用户点击，还是已经真实执行，并给出交叉印证方法。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%94%A8%E6%88%B7%E6%80%81%E5%86%85%E6%A0%B8%E6%80%81%E9%92%A9%E5%AD%90%E4%B8%8EAPI%E5%8A%AB%E6%8C%81%E7%97%95%E8%BF%B9%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 01:10:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%94%A8%E6%88%B7%E6%80%81%E5%86%85%E6%A0%B8%E6%80%81%E9%92%A9%E5%AD%90%E4%B8%8EAPI%E5%8A%AB%E6%8C%81%E7%97%95%E8%BF%B9%E5%88%86%E6%9E%90/index.html围绕用户态 API Hook、AMSI/ETW Patch、IAT/Inline Hook、进程注入与内核回调可见性，分析蓝队如何从主机证据识别劫持与规避行为。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%AE%A1%E7%90%86%E5%85%B1%E4%BA%AB%E8%AE%BF%E9%97%AE%E4%B8%8E%E6%A8%AA%E5%90%91%E6%8A%95%E9%80%81%E6%89%A7%E8%A1%8C%E9%93%BE%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 16:45:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%AE%A1%E7%90%86%E5%85%B1%E4%BA%AB%E8%AE%BF%E9%97%AE%E4%B8%8E%E6%A8%AA%E5%90%91%E6%8A%95%E9%80%81%E6%89%A7%E8%A1%8C%E9%93%BE%E5%88%86%E6%9E%90/index.html围绕 ADMIN$、C$、IPC$、5140/5145、7045 等结果，分析系统共享访问是正常运维、文件投送，还是横向执行链的一部分。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%98%A0%E5%83%8F%E5%8A%AB%E6%8C%81%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8EIFEO%E5%8F%8AWinlogon%E6%8C%81%E4%B9%85%E5%8C%96%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 05:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%98%A0%E5%83%8F%E5%8A%AB%E6%8C%81%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8EIFEO%E5%8F%8AWinlogon%E6%8C%81%E4%B9%85%E5%8C%96%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.html围绕 0x02 映像劫持检查取证结果，分析如何从 IFEO 注册表键值中判断调试器劫持、SilentProcessExit 监控、Winlogon 持久化等攻击行为。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%97%B6%E9%97%B4%E5%81%8F%E7%A7%BB%E4%B8%8E%E6%97%B6%E9%92%9F%E7%AF%A1%E6%94%B9%E5%AF%B9%E4%BA%8B%E4%BB%B6%E6%97%B6%E9%97%B4%E7%BA%BF%E5%88%86%E6%9E%90%E7%9A%84%E5%BD%B1%E5%93%8D/index.htmlTue, 16 Jun 2026 17:10:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%97%B6%E9%97%B4%E5%81%8F%E7%A7%BB%E4%B8%8E%E6%97%B6%E9%92%9F%E7%AF%A1%E6%94%B9%E5%AF%B9%E4%BA%8B%E4%BB%B6%E6%97%B6%E9%97%B4%E7%BA%BF%E5%88%86%E6%9E%90%E7%9A%84%E5%BD%B1%E5%93%8D/index.html围绕系统时间偏移、时区差异、NTP异常和时钟篡改，分析事件时间线是否可信，以及怎样修正和表达结论强度。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%AE%89%E5%85%A8%E7%AD%96%E7%95%A5%E8%A2%AB%E4%BF%AE%E6%94%B9%E4%B8%8E%E9%98%B2%E6%8A%A4%E7%BB%95%E8%BF%87%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 01:40:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%AE%89%E5%85%A8%E7%AD%96%E7%95%A5%E8%A2%AB%E4%BF%AE%E6%94%B9%E4%B8%8E%E9%98%B2%E6%8A%A4%E7%BB%95%E8%BF%87%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.html围绕 Defender 排除项、实时防护关闭、策略篡改与安全产品规避，分析攻击者如何削弱防护能力，以及蓝队如何从命令、注册表和策略状态中还原事件。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%9B%91%E5%90%AC%E7%AB%AF%E5%8F%A3%E4%B8%8E%E5%87%BA%E5%85%A5%E7%AB%99%E8%BF%9E%E6%8E%A5%E8%A7%92%E8%89%B2%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 17:45:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%9B%91%E5%90%AC%E7%AB%AF%E5%8F%A3%E4%B8%8E%E5%87%BA%E5%85%A5%E7%AB%99%E8%BF%9E%E6%8E%A5%E8%A7%92%E8%89%B2%E5%88%86%E6%9E%90/index.html围绕监听端口、入站连接、出站连接和会话方向，分析主机在事件中是暴露入口、中继跳板、被控节点还是正常服务节点。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/web%E5%90%8E%E9%97%A8%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E6%9F%A5%E6%9D%80%E5%B7%A5%E5%85%B7%E5%88%A4%E5%AE%9A%E5%B7%AE%E5%BC%82%E5%8F%8A%E8%AF%AF%E6%8A%A5%E6%BC%8F%E6%8A%A5%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 06:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/web%E5%90%8E%E9%97%A8%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E6%9F%A5%E6%9D%80%E5%B7%A5%E5%85%B7%E5%88%A4%E5%AE%9A%E5%B7%AE%E5%BC%82%E5%8F%8A%E8%AF%AF%E6%8A%A5%E6%BC%8F%E6%8A%A5%E5%88%86%E6%9E%90/index.html围绕 0x02 web后门检查取证结果，分析如何从不同查杀工具的判定差异中判断真实威胁，如何处理误报和漏报。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%8F%E8%A7%88%E5%99%A8%E4%B8%8B%E8%BD%BD%E4%B8%8ELNK%E5%92%8CJumpList%E7%94%A8%E6%88%B7%E6%93%8D%E4%BD%9C%E9%93%BE%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 18:10:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%8F%E8%A7%88%E5%99%A8%E4%B8%8B%E8%BD%BD%E4%B8%8ELNK%E5%92%8CJumpList%E7%94%A8%E6%88%B7%E6%93%8D%E4%BD%9C%E9%93%BE%E5%88%86%E6%9E%90/index.html围绕浏览器下载记录、LNK、Recent、Jump List 等结果，分析用户是否看到、点击、打开并推动了下载执行链。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%8A%AB%E6%8C%81%E4%B8%8E%E6%89%A7%E8%A1%8C%E9%93%BE%E6%B1%A1%E6%9F%93%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 02:10:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%8A%AB%E6%8C%81%E4%B8%8E%E6%89%A7%E8%A1%8C%E9%93%BE%E6%B1%A1%E6%9F%93%E5%88%86%E6%9E%90/index.html围绕 PATH、Windir/SystemRoot、.env 文件、GCONV_PATH 与运行时环境注入，分析环境变量如何被攻击者用于提权、执行劫持、凭据泄露与云侧入侵。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%97%85%E6%AF%92%E6%9F%A5%E6%9D%80%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E5%A4%9A%E5%BC%95%E6%93%8E%E5%88%A4%E5%AE%9A%E5%B7%AE%E5%BC%82%E5%8F%8ARootkit%E6%AE%8B%E7%95%99%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 07:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%97%85%E6%AF%92%E6%9F%A5%E6%9D%80%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E5%A4%9A%E5%BC%95%E6%93%8E%E5%88%A4%E5%AE%9A%E5%B7%AE%E5%BC%82%E5%8F%8ARootkit%E6%AE%8B%E7%95%99%E5%88%86%E6%9E%90/index.html围绕 0x02 病毒查杀检查取证结果，分析如何从 ClamAV、chkrootkit、rkhunter 等工具的判定差异中判断真实威胁，如何处理 Rootkit 残留问题。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%8F%E8%A7%88%E5%99%A8%E9%85%8D%E7%BD%AE%E5%BC%82%E5%B8%B8%E4%B8%8E%E7%97%95%E8%BF%B9%E6%B8%85%E7%90%86%E7%BB%93%E6%9E%9C%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 21:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%8F%E8%A7%88%E5%99%A8%E9%85%8D%E7%BD%AE%E5%BC%82%E5%B8%B8%E4%B8%8E%E7%97%95%E8%BF%B9%E6%B8%85%E7%90%86%E7%BB%93%E6%9E%9C%E5%88%A4%E6%96%AD%E5%88%86%E6%9E%90/index.html围绕 0x02 浏览器相关检查中 IE 注册表配置、TypedURLs、InetCpl.cpl 痕迹清理等结果，分析浏览器劫持、配置篡改与痕迹清除的判定方法和结论边界。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Hosts%E5%8A%AB%E6%8C%81%E4%B8%8E%E5%86%85%E7%BD%91%E9%87%8D%E5%AE%9A%E5%90%91%E7%97%95%E8%BF%B9%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 09:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Hosts%E5%8A%AB%E6%8C%81%E4%B8%8E%E5%86%85%E7%BD%91%E9%87%8D%E5%AE%9A%E5%90%91%E7%97%95%E8%BF%B9%E5%88%86%E6%9E%90/index.html围绕 Windows hosts、Linux /etc/hosts、本地回环映射、登录页重定向与内网域名伪解析，分析攻击者如何利用 Hosts 劫持实现钓鱼、拦截、横向与内网控制。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%81%E9%87%8F%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E5%9F%BA%E7%A1%80%E8%A7%A3%E8%AF%BB%E4%B8%8E%E5%BC%82%E5%B8%B8%E6%A8%A1%E5%BC%8F%E8%AF%86%E5%88%AB/index.htmlWed, 17 Jun 2026 08:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%81%E9%87%8F%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E5%9F%BA%E7%A1%80%E8%A7%A3%E8%AF%BB%E4%B8%8E%E5%BC%82%E5%B8%B8%E6%A8%A1%E5%BC%8F%E8%AF%86%E5%88%AB/index.html围绕 0x02 流量检查取证结果，分析如何从 pcap 抓包文件中识别异常流量模式，建立网络基线，发现潜在的安全威胁。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%98%B2%E7%81%AB%E5%A2%99%E8%A7%84%E5%88%99%E7%AF%A1%E6%94%B9%E4%B8%8E%E6%94%BE%E8%A1%8C%E9%93%BE%E8%B7%AF%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 09:30:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%98%B2%E7%81%AB%E5%A2%99%E8%A7%84%E5%88%99%E7%AF%A1%E6%94%B9%E4%B8%8E%E6%94%BE%E8%A1%8C%E9%93%BE%E8%B7%AF%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.html围绕 Windows Firewall、WFP、netsh、New-NetFirewallRule、iptables 与 ufw，分析攻击者如何通过放行、阻断或静默规则为横向、RDP、EDR规避和隧道建立让路。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E5%BC%82%E5%B8%B8%E5%88%A4%E6%96%AD%E4%B8%8E%E5%85%A5%E4%BE%B5%E5%85%B3%E8%81%94%E5%88%86%E6%9E%90/index.htmlWed, 17 Jun 2026 09:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%90%AF%E5%8A%A8%E9%A1%B9%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E5%BC%82%E5%B8%B8%E5%88%A4%E6%96%AD%E4%B8%8E%E5%85%A5%E4%BE%B5%E5%85%B3%E8%81%94%E5%88%86%E6%9E%90/index.html围绕 0x02 启动项检查取证结果，分析如何判断启动项是否异常，如何与入侵时间线关联，以及如何识别持久化机制。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Linux%E8%BD%AF%E4%BB%B6%E5%8C%85%E6%8A%95%E6%AF%92%E4%B8%8E%E5%BC%82%E5%B8%B8%E5%AE%89%E8%A3%85%E7%97%95%E8%BF%B9%E5%88%86%E6%9E%90/index.htmlTue, 16 Jun 2026 10:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Linux%E8%BD%AF%E4%BB%B6%E5%8C%85%E6%8A%95%E6%AF%92%E4%B8%8E%E5%BC%82%E5%B8%B8%E5%AE%89%E8%A3%85%E7%97%95%E8%BF%B9%E5%88%86%E6%9E%90/index.html围绕 apt、yum、dnf、rpm、dpkg、本地仓库与伪装系统包，分析攻击者如何借软件包安装落地后门、维持持久化，并给出 Linux 主机现场排查命令。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E8%AE%A1%E5%88%92%E4%BB%BB%E5%8A%A1%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E6%8C%81%E4%B9%85%E5%8C%96%E6%84%8F%E5%9B%BE%E5%8F%8A%E9%9A%90%E8%97%8F%E4%BB%BB%E5%8A%A1%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.htmlMon, 22 Jun 2026 09:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E8%AE%A1%E5%88%92%E4%BB%BB%E5%8A%A1%E6%A3%80%E6%9F%A5%E7%BB%93%E6%9E%9C%E4%B8%8E%E6%8C%81%E4%B9%85%E5%8C%96%E6%84%8F%E5%9B%BE%E5%8F%8A%E9%9A%90%E8%97%8F%E4%BB%BB%E5%8A%A1%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.html围绕 0x02 计划任务检查取证结果，分析如何判断计划任务是否异常，如何识别攻击者的持久化意图，以及如何检测隐藏计划任务。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Windows%E6%B3%A8%E5%86%8C%E8%A1%A8%E5%8F%96%E8%AF%81%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90%E4%B8%8E%E5%85%A5%E4%BE%B5%E7%97%95%E8%BF%B9%E8%AF%86%E5%88%AB/index.htmlMon, 22 Jun 2026 14:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/Windows%E6%B3%A8%E5%86%8C%E8%A1%A8%E5%8F%96%E8%AF%81%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90%E4%B8%8E%E5%85%A5%E4%BE%B5%E7%97%95%E8%BF%B9%E8%AF%86%E5%88%AB/index.html围绕 Windows 注册表的 Hive 结构、事务日志、关键取证 Artifacts，分析攻击者如何利用注册表实现持久化、执行、用户活动追踪，以及如何从注册表中恢复被删除的证据。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F%E6%97%B6%E9%97%B4%E6%88%B3%E5%8F%96%E8%AF%81%E4%B8%8ETimestomp%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.htmlMon, 22 Jun 2026 18:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F%E6%97%B6%E9%97%B4%E6%88%B3%E5%8F%96%E8%AF%81%E4%B8%8ETimestomp%E6%A3%80%E6%B5%8B%E5%88%86%E6%9E%90/index.html围绕 NTFS 文件系统的 MACE 时间戳、$SI 与 $FN 属性差异、USN Journal、$LogFile，分析攻击者如何进行 Timestomp 反取证，以及如何从多个 Artifacts 中检测时间戳篡改。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E4%B8%8EVolatility%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.htmlTue, 23 Jun 2026 18:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E4%B8%8EVolatility%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.html围绕内存取证的完整工作流，分析如何使用 Volatility 3 从内存镜像中提取进程、网络连接、注入代码、凭据等关键取证数据，以及如何检测无文件恶意软件和进程注入攻击。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%BD%91%E7%BB%9C%E6%B5%81%E9%87%8F%E5%8F%96%E8%AF%81%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.htmlTue, 23 Jun 2026 23:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E7%BD%91%E7%BB%9C%E6%B5%81%E9%87%8F%E5%8F%96%E8%AF%81%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.html围绕网络流量取证的完整分析流程，深入分析 PCAP 文件结构、网络协议取证价值、Wireshark/TShark 分析技术、恶意网络活动检测、C2 通信识别、数据外泄分析、DNS 隧道检测、加密流量分析等技术，以及如何从网络流量中提取关键取证证据。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/NTFS%E4%BA%A4%E9%94%99%E6%95%B0%E6%8D%AE%E6%B5%81%E4%B8%8E%E9%AB%98%E7%BA%A7%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.htmlFri, 26 Jun 2026 10:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/NTFS%E4%BA%A4%E9%94%99%E6%95%B0%E6%8D%AE%E6%B5%81%E4%B8%8E%E9%AB%98%E7%BA%A7%E6%96%87%E4%BB%B6%E7%B3%BB%E7%BB%9F%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.html围绕 NTFS 文件系统高级特性的取证分析，深入分析交错数据流（ADS）原理与攻击、NTFS 元数据取证（$MFT/$I30/$LogFile/$UsnJrnl）、ADS 隐藏与检测、数据恢复、文件系统级 Rootkit 取证等技术。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%82%AE%E4%BB%B6%E7%B3%BB%E7%BB%9F%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.htmlWed, 01 Jul 2026 14:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E9%82%AE%E4%BB%B6%E7%B3%BB%E7%BB%9F%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/index.html围绕邮件系统取证的完整技术体系，深入分析 Exchange/Microsoft 365 日志分析、邮件头溯源、邮件附件分析、钓鱼邮件取证、邮件网关日志分析、DKIM/SPF/DMARC 验证、邮件系统持久化检测等技术。https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%8F%E8%A7%88%E5%99%A8%E5%8F%96%E8%AF%81%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.htmlWed, 01 Jul 2026 18:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/%E8%AF%81%E6%8D%AE%E5%88%86%E6%9E%90/%E6%B5%8F%E8%A7%88%E5%99%A8%E5%8F%96%E8%AF%81%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.html围绕浏览器取证的完整技术体系，深入分析 Chrome/Firefox/Edge 数据库结构、历史记录分析、Cookie 分析、缓存分析、下载记录分析、扩展分析、隐身模式痕迹、浏览器同步数据取证等技术。