For any file examined, look for alternate data streams and also pull the first X bytes of the stream. Running hunts on the first X bytes would help determine if its a binary, script, or other forensically interesting stuff.
Fields:
timestamp
device_domain
device_name
default_hash
path
size
stream_name
For any file examined, look for alternate data streams and also pull the first X bytes of the stream. Running hunts on the first X bytes would help determine if its a binary, script, or other forensically interesting stuff.
Fields:
timestamp
device_domain
device_name
default_hash
path
size
stream_name