# Offensive Tool Analysis

## Hunting HackTools with Event IDs

This site summarizes the results of examining logs recorded in Windows upon execution of the 49 tools which are likely to be used by the attacker that has infiltrated a network. The following logs were examined. Note that it was confirmed that traces of tool execution is most likely to be left in event logs. Accordingly, examination of event logs is the main focus here.

{% embed url="https://jpcertcc.github.io/ToolAnalysisResultSheet/" %}
Catalog of useful Event IDs for hunting hacktools
{% endembed %}

## Analysis of Switches

This page goes into deep detail about switches of specific hacktools and what they do. Useful for trying to figure out what exactly adversary commands were doing.

{% embed url="https://tools.thehacker.recipes/mimikatz/modules/dpapi/masterkey" %}
GitBook
{% endembed %}

## Hunting for Impacket

Good article on hunting for Impacket execution within your environment.&#x20;

{% embed url="https://riccardoancarani.github.io/2020-05-10-hunting-for-impacket/" %}
Article
{% endembed %}
