🪷
RedLotus Guide
  • ScreenSharing Introducttion and Principles
    • Introduction
      • What is a Hack Check (Screenshare)?
      • The Goal: Demonstrating Cheat Usage
      • The Staffer's Perspective and the Learning Process
    • Red Lotus Principles
      • Red Lotus Principles for Ethical and Effective ScreenSharing
      • Requirements for ScreenSharers
      • ScreenSharing Protocols (Video Recording)
      • Anti-Corruption Measures
  • ScreenSharing General Knowledge
    • Windows Fundamentals
      • File Systems: The Foundation
        • File System (Definition, Types: NTFS, FAT32, etc.)
        • Journaling (Definition, Purpose)
      • Fundamental Timestamps
      • Key NTFS Components
        • Master File Table ($MFT) - The File Catalog
        • The Journal ($USNJrnl) - The Change Log
        • $LogFile (Metadata Log) - Specific Log for Metadata Changes
        • Alternate Data Streams (ADS) - Hidden Data Streams
        • File Attributes (Read-Only, Hidden, etc.) - Manipulable Properties
    • Common Windows Artifacts and Their Basic Analysis
      • Execution Traces and Recent Activity
        • Prefetch ( C:\Windows\Prefetch )
        • Temporary Files ( %temp% )
        • Recent Items ( shell:recent )
        • Recycle Bin ( C:$Recycle.bin )
      • Other Notable Folders/Locations
      • Windows Registry: Introduction
        • Registry Structure: Hives, Keys, and Values
        • Registry Value Types (Brief Overview)
      • Windows Event Logs: Introduction
        • Event Log Structure ( .evtx Files)
        • The EventLog Service
        • Event Viewer ( eventvwr.msc )
    • Manual SS Techniques (Basic and Intermediate)
      • Introduction to Process and Memory Analysis
      • Process Hacker / System Informer: Introduction and Configuration
        • Key Capabilities for ScreenSharing:
        • Configuration: Enabling Kernel Mode Driver
        • General Process Filtering Steps:
      • Specific Processes to Analyze and Search Patterns
        • explorer.exe (Windows Explorer)
        • csrss.exe (Client Server Runtime Subsystem)
        • PlugPlay Service (Sometimes shown under DCOMLaunch)
        • svchost.exe (-s dps) (Diagnostic Policy Service)
        • PcaSvc (Program Compatibility Assistant Service)
        • Other Relevant Processes
      • Windows Prefetch Analysis (WinPrefetchView / PECmd)
        • Understanding Prefetch
        • Information Stored in Prefetch Files
        • Analysis Tools
        • Troubleshooting and Evasion Detection
      • LastActivityView: Artifact Aggregation
        • Data Sources
        • Functionality in ScreenSharing
        • Limitations and Considerations
      • Search Everything: Rapid File System Search
        • Core Features
        • Usage in ScreenSharing
      • Journal Analysis (JournalTrace / Echo Easy Journal Viewer)
        • The USN Journal ( $UsnJrnl )
        • GUI Parsing Tools
        • Application in ScreenSharing
        • Limitations
      • Regedit / Registry Explorer (Registry Viewers - Basic Usage)
        • Understanding the Windows Registry
        • Accessing the Registry
        • Forensically Relevant Registry Keys/Locations
        • Key Considerations for ScreenSharing
      • Event Viewer (Basic Usage for Common IDs)
        • Understanding Event Viewer
        • Accessing Event Viewer
        • Log Storage
        • Checking the EventLog Service
        • Key Event Logs and IDs for ScreenSharing
        • Key Considerations for ScreenSharing
      • Recuva (Deleted File Recovery)
        • Understanding Recuva
        • Usage in ScreenSharing
        • Limitations
    • More Artifact Analysis for ScreenSharing
      • Advanced JumpLists/RecentDocs Analysis
      • Amcache/Syscache/RecentFileCache Analysis
      • Activities Cache Analysis
      • SRUM (System Resource Usage Monitor) Analysis
      • Volume Shadow Copies (VSS) Analysis
      • $INDX ($i30 Index Attributes) Analysis
      • Process and Memory Dump Analysis (Kernel Live Dump, RAM Dump)
      • YARA Rules
      • File Entropy Analysis
      • Detect It Easy (DiE)
      • Velociraptor
      • Magnet EDD (Encrypted Disk Detector)
    • Common Bypass Techniques in ScreenSharing
      • Introduction to Bypass Categories
      • Concealment and Obfuscation
        • Spoofed Extensions
        • Unicode Characters in File Names/Paths
        • Alternate Data Streams (ADS)
        • Code Obfuscation
      • Steganography
      • Artifact and System Manipulation
        • Timestamp Manipulation (Timestomping)
        • Hexadecimal File Modification (Hex Editing)
        • Attribute Manipulation (Read-Only)
        • Service Thread Suspension
        • Command Prompt (CMD) Obfuscation
        • Disabling System Features via Registry/Group Policy
      • Artifact Clearing Techniques
        • Prefetch Clearing
        • Registry Clearing (BAM, RecentDocs, etc.)
        • USN Journal Clearing
        • Event Log Clearing/Manipulation
        • Recycle Bin Clearing
        • File Replacement (Replace Method)
      • Permission and Inheritance Modification
        • Using cacls (or similar) for Permission Changes
        • Disabling Registry/Folder Inheritance
      • Disk Partition Manipulation for Evasion
        • Mechanism of Evasion
        • Forensic Implications
      • Task Scheduler Bypass Techniques
        • Mechanism of Evasion
        • Detection
      • Scripting Languages for Evasion
        • Mechanisms of Evasion
        • Forensic Implications
      • Fileless Malware and Living-off-the-Land Binaries (LOLBins)
        • Mechanisms of Evasion
        • Forensic Implications and Detection
      • COM Hijacking
      • Shellcode Injection
      • Powershell Remoting
      • Suspicious DLLs and DLL Injection Techniques
      • Process Hollowing
      • Unsigned / Fake Digital Signatures
      • Environment and Hardware Bypasses
        • External USB Drives (FAT32 vs. NTFS):
        • Virtual Machines (VMs):
        • Cloud Storage (OneDrive, Google Drive, etc.):
    • Ban Evasion and Alt Account Detection
      • Understanding Ban Evasion
      • Identifying Alternate Accounts During ScreenShare
      • Reviewing Ban Policies
      • Importance of Documentation and Evidence
  • ScreenSharing Minecraft Knowledge
    • Minecraft Architecture and Analysis
      • Minecraft and Java
        • Minecraft Architecture (Java, JVM)
        • Launchers (Official, Custom: Lunar, Badlion, etc.)
        • .minecraft Folder (Location, Structure)
        • Categorizing Minecraft Cheats (Context for Analysis)
      • Specific Analysis for Minecraft
        • Forge Mod Analysis
        • Javaedit - Detection via Hash/Content
    • Mouse, Macro, and Input Analysis
      • Understanding Mouse Input Manipulation
      • Macro Analysis
        • Definition and Purpose in Cheating
        • Detecting Software-Based Macros
        • Detecting On-Board Macros
      • Debounce Time Analysis
        • Definition and Mouse Abuse
        • Server Rules Context
        • General Detection Strategy
        • Detection by Mouse Brand
  • ScreenShare Tools
    • Spok's Tools
      • Paths Parser
      • BAM parser
      • Prefetch Parser
      • Kernel Live Dump Analyzer
      • Replaceparser
      • JournalTrace
      • pcasvc executed
      • ActivitiesCache execution
      • process-parser
      • Spokwn Powershell Scripts
      • Streams Script
      • ActivitiesCache Script
    • Rancio's Tools
      • Tools
    • Echo's Tools
      • Tools
    • Specific PowerShell Scripts
      • Main RedLotus Scripts
  • Automatic ScreenShare Tools
    • coming soon
Powered by GitBook
On this page
  1. ScreenSharing Minecraft Knowledge
  2. Mouse, Macro, and Input Analysis

Debounce Time Analysis

Definition and Mouse AbuseServer Rules ContextGeneral Detection StrategyDetection by Mouse Brand
PreviousDetecting On-Board MacrosNextDefinition and Mouse Abuse

Last updated 2 months ago