Belkasoft Incident Investigations is a tool for digital incident investigations and is aimed to incident response professionals, working in a corporate environment. The product helps to identify traces left over from malware and hacking attempts on a Windows computer.
Key Features
• Detect suspicious traces in most typical locations, including registries, event logs and less known files
• Analyze how malicious code persisted in the system by analyzing services, scheduled tasks, WMI subscriptions, Applinit DLLs and so on
• Learn how and when malware was executed by examining various artifacts such as Amcache and Shimcache, Syscache, BAM and DAM
• Extract remote connections details including IP and time stamps for RDP and TeamViewer
• Find potential initial attack vector by analyzing recently opened documents and browser links, latest downloads and so on
• Search inside extracted information, bookmark important data and create reports in multiple formats
Why Should You Consider Belkasoft N?
Use Cases:
Endpoint attacks,malicious email activity,anomalous user activity,remote access attacks,attacks correlation with known vulnerabilities.