Timeline & Artifact Analysis

Build a forensic super-timeline from Windows artifacts (MFT, Prefetch, event logs, registry) with Plaso, then read it to reconstruct the full attack from initial access to objective and map each step to MITRE ATT&CK.