Which specific Windows Registry artifact tracks the GUI applications launched by a user and obfuscates the names using ROT-13 encoding?

In Linux forensics, which command is specifically used to find "unlinked" files (files that have been deleted but are still held open by a running process)?

Which Windows Security Event ID corresponds to "Process Creation," providing a log of every program started on the system?

What is the specific term for the data of a very small file (typically under ~700 bytes) that is stored directly within the Master File Table (MFT) record itself?

If a Linux process is running from a malicious binary that has been deleted from the disk, what will the symbolic link `/proc/[pid]/exe` display?

Which Windows Registry key is most commonly targeted by malware to ensure persistence by executing a program automatically when a user logs in?

Which Linux command is used to identify binaries that have the SUID (Set User ID) permission bit set, which can be exploited for privilege escalation?

Unlike standard Windows Event Logs, Sysmon Event ID 1 is critical for forensic analysts because it includes which specific piece of data?

Which Loadable Kernel Module (LKM) is the standard tool for dumping physical memory (RAM) from a Linux system?

In the Windows "Sticky Keys" exploit, attackers modify the "Image File Execution Options" (IFEO) registry key to launch a command prompt. Which executable is the target of this modification?

Which Linux log file is the primary location for recording successful and failed login attempts, as well as `sudo` execution?

Which technique involves an attacker starting a legitimate Windows process (like `svchost.exe`) in a suspended state, removing its code, and writing malicious code into the empty memory space?

Which specific attribute, when set on a Linux file using `chattr`, prevents it from being modified, renamed, or deleted, even by the root user?

Which NTFS feature allows a file entry to point to multiple streams of data, effectively allowing attackers to hide payloads behind a legitimate text file?

In the Linux Audit system (auditd), which field tracks the original user ID of a person, ensuring accountability even after they escalate privileges using `sudo`?

Which "Ring" level in the Windows architecture represents Kernel Mode, where core OS components and drivers have unrestricted access to hardware?

When analyzing Linux memory for "fileless" malware, analysts look for memory pages with which suspicious permission combination?

Which Sysinternals tool allows a Windows analyst to view the parent-child relationships of processes and verify the digital signatures of running binaries?

Which directory in Linux is a pseudo-filesystem that acts as a dynamic interface to kernel data structures and running process information?