Endpoint and Host

Need	Open
First host checks and pivots	Host triage
Native Windows audit events	Windows Event IDs
Cross-provider event lookup	Event and Activity Reference
Process, network, registry, WMI telemetry	Sysmon Event IDs
Injection and executable-memory clues	Process and memory hunting
Script activity	PowerShell
Logging-policy, provider, and forwarding integrity	Telemetry integrity and policy recovery
Common footholds	Persistence
Platform commands	Windows · Linux · macOS