BTL1 tools cheat sheet

Phishing analysis

PhishTool

Parses an email file: headers, sender path, SPF/DKIM/DMARC results, URLs and attachments, and records your verdict.

URL2PNG

Screenshots a URL from a remote service, so you see the page without opening it on your own machine.

WannaBrowser

Fetches a URL with the user agent you choose and shows the returned HTML, without rendering it in your browser.

DomainTools

WHOIS and domain history: registrar, registration date and owner changes. A domain registered days ago is a red flag.

CyberChef

Decodes and transforms data in the browser: Base64, URL encoding, hex, defanging URLs, extracting IOCs.

VirusTotal

Reputation from many engines for a hash, URL, domain or IP. Search the hash first: an uploaded file can be seen by others.

Threat intelligence

MITRE ATT&CK

Knowledge base of attacker tactics and techniques with IDs, such as T1566 Phishing. Used to label what you find.

MISP

Open-source platform for storing and sharing threat intelligence as events, attributes and indicators.

OpenCTI

Open-source threat intelligence platform that links actors, campaigns, malware and indicators in STIX 2.1.

Digital forensics

FTK Imager

Creates forensic images (raw/dd or E01), captures memory, and hashes the image so integrity can be verified later.

KAPE

Kroll Artifact Parser and Extractor: targets collect artifacts from a system, modules then parse them.

Autopsy

Open-source GUI for disk images: file system, deleted files, keyword search, web artifacts and timelines.

Volatility

Memory forensics: running processes and their tree, network connections, command lines, injected code.

Scalpel

Carves files out of an image or unallocated space by their header and footer signatures.

PECmd

Parses Windows Prefetch files: which program ran, how many times and when it last ran.

JumpList Explorer

Reads Windows jump lists: files recently or frequently opened with each application.

Windows File Analyzer

Decodes Windows artifacts such as shortcut (.lnk) files, Prefetch, thumbnail caches and the Recycle Bin.

Browser History Capturer / Viewer

Collects browser history from a system, then displays and searches it in one timeline.

ProcDump

Sysinternals command-line tool that writes a process's memory to a dump file for later analysis.

SIEM

Splunk

Searches indexed logs with SPL, for example index=main sourcetype=… | stats count by src_ip.

Sigma

Generic detection rules written in YAML, converted into the query language of a specific SIEM.

Incident response

Wireshark

Packet capture analysis: display filters (ip.addr==, dns, http.request), Follow TCP Stream, Export Objects.

Event Viewer

Windows' own log viewer. Filter the Security, System and PowerShell logs by event ID.

DeepBlueCLI

PowerShell script that hunts Windows event logs for suspicious activity: password spraying, new services, encoded commands.

PowerShell

Get-WinEvent to query logs, Get-FileHash to hash files, Get-Process and Get-NetTCPConnection for live state.

Linux CLI

grep, sort | uniq -c, sha256sum and strings: enough to cut a large log or binary down to what matters.

TheHive

Case management for incident response: cases, tasks, observables and alerts, often fed by MISP.

Facts you will look up

4624 / 4625

Successful logon / failed logon (Security log).

4688

A new process was created (needs process creation auditing).

4720 / 4732

A user account was created / a member was added to a security-enabled local group.

1102

The Security audit log was cleared.

7045

A service was installed (System log).

Logon types

2 interactive · 3 network · 10 remote interactive (RDP).

Sysmon

Event 1 process creation · 3 network connection.

PICERL

Preparation · Identification · Containment · Eradication · Recovery · Lessons learned.

Cyber Kill Chain

Reconnaissance · Weaponization · Delivery · Exploitation · Installation · Command and control · Actions on objectives.

Evidence

Hash an image when you take it and again before you analyse it. Collect the most volatile data, such as memory, first.

Tool list from the Centri BTL1 certification page, checked 2 November 2026. The grouping by domain and the descriptions are CertSprint's own. CertSprint is not affiliated with Centri.