Skip to content
RDPCacheparser

Posts tagged: #lateral-movement

← Back to all posts
RDP Lateral Movement Forensics: Source Host Artifacts
Which artifacts on the RDP source host show where a user connected and when, and how to use them to date and attribute what the bitmap cache shows.
lateral-movementrdp-bitmap-cacheevent-logsregistry
RDP Bitmap Cache Forensics: The Complete Guide
What the RDP bitmap cache is, where it lives, what its tiles can show about a remote session, how to date it, and how to parse bcache*.bmc and Cache*.bin files.
rdp-bitmap-cachelateral-movementremote-desktopdfir