F00044 "Forensic analysis"

Tactic stage: TA08

Summary: Can be used in all phases for all techniques.

Detects techniques:

DISARM Frameworks provided CC-by-SA by the DISARM Foundation