GCED: GIAC Certified Enterprise Defender

Alternate Data Streams are supported by NTFS. Therefore, only the 4GB NTFS partition must be searched; the FAT16 and FAT32 partitions do not need an Alternate Data Stream search.

HijackThis is designed to identify and remove unwanted browser toolbars, Browser Helper Objects, and related Internet Explorer configuration entries.

dir creates a directory listing, /s traverses subdirectories, and /a can include files and directories with the specified attributes. The > redirection operator writes that listing to IRCD.txt on the USB drive; it does not copy the listed files, acquire a forensic image, or compare hashes. Microsoft documents that dir displays directory contents and that its output can be redirected to a file.

UDP port 514 is the standard Syslog transport port, whereas port 6514 is designated for secure Syslog transports. The -n flag avoids DNS and service-name resolution, which is appropriate for an air-gapped network, and -X displays packet payload in hexadecimal and ASCII so plaintext Syslog messages can be inspected. RFC 5426: Transmission of Syslog Messages over UDP

A threat is any circumstance or event with the potential to cause harm through a system, including the potential for a threat source to exploit a particular information-system vulnerability. An exploit is the mechanism used to take advantage of that vulnerability, rather than the potential danger itself.