|

Cyber Analysis 101

To look for hashes in your environment, you should check devices using an enterprise EDR or a similar solution with visibility into each connected device. But first, it is recommended to research the hash via a reputation tool such as VirusTotal – Home.

To find IP addresses in your environment, use an enterprise SIEM solution to search. Generally, you will want to check the firewall logs. A search of the last 30 days is usually a good starting point. Again, you should do some research here using tools such as VirusTotal – Home and URL/IP Lookup | Webroot BrightCloud

To look for filenames in your environment, you should check devices using an enterprise EDR or a similar solution with visibility into each connected device. But first, it is recommended to research the hash via a tool such as IP Address Tools, Network Tools, DNS Tools | IPVoid or MX Lookup Tool – Check your DNS MX Records online – MxToolbox.

Proxy searches are most effective when searching via a user.

Similar Posts