SUEYTAME

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

Detect and analyze Linux persistence mechanisms including crontab entries,

Detect PowerShell Empire framework artifacts in Windows event logs by

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX

Parse Windows Prefetch files to determine program execution history including

Analyzes encryption algorithms, key management, and file encryption

Monitor and analyze ransomware group data leak sites (DLS) to track victim

Identify ransomware network indicators including C2 beaconing patterns,

Traces ransomware cryptocurrency payment flows using blockchain analysis

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

Leverages Splunk Enterprise Security and SPL (Search Processing Language)

Examine file system slack space, MFT entries, USN journal, and alternate