Host

Need	Open
A repeatable investigation frame	Universal triage model
First host checks	Host triage
Native Windows audit events	Windows Event IDs
Process, network, registry, WMI telemetry	Sysmon Event IDs
Injection and executable-memory clues	Process and memory hunting
Script activity	PowerShell
Common footholds	Persistence
Platform commands	Windows · Linux · macOS