Results for “forensics”

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

The English summary is being prepared. Showing the original description.

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.

The English summary is being prepared. Showing the original description.

Disk imaj forensics — The Sleuth Kit (TSK), Autopsy, deleted file recovery, MFT/inode analizi, slack space, EWF/RAW imajlar

The English summary is being prepared. Showing the original description.

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-c

The English summary is being prepared. Showing the original description.

Forensics kategorisi SKILL.md — Memory, disk, PCAP, steganography araçları kurma rehberi

The English summary is being prepared. Showing the original description.

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

The English summary is being prepared. Showing the original description.

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.

The English summary is being prepared. Showing the original description.

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.

The English summary is being prepared. Showing the original description.

Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.

The English summary is being prepared. Showing the original description.

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.

The English summary is being prepared. Showing the original description.

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

The English summary is being prepared. Showing the original description.

Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.

The English summary is being prepared. Showing the original description.

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.

The English summary is being prepared. Showing the original description.

Investigate suspected malicious changes in open-source software on GitHub by comparing repository history, APIs, and archives. Attempt to recover deleted evidence, identify signs of compromise, and produce a report separating verified facts from hypotheses.

• Investigate suspicious commits or workflow changes
• Attempt to recover commits hidden by rewritten history
• Trace possible credential leaks

Investigate memory dumps, disk records, and captured network traffic while preserving evidence. The skill guides timeline reconstruction and examination of system traces to identify suspicious activity and produce findings that others can review.

• Preserve evidence before starting an incident investigation
• Inspect processes and connections in memory dumps
• Build timelines from event logs and execution traces

Investigate security incidents using memory dumps, saved copies of RAM. The skill guides memory acquisition, process and network analysis, suspicious code detection, and evidence extraction with Volatility and related tools, including checks for capture integrity.

• Capturing RAM before shutting down a system under investigation
• Finding suspicious processes and network connections in memory
• Extracting executables and strings for malware analysis

Investigate suspected rootkits, malware that hides its presence, by comparing process lists, inspecting memory, and checking system integrity. Use Volatility and Windows or Linux scanners to identify hidden processes, suspicious drivers, altered system calls, and concealed connections.

• Investigating compromise when standard tools show no anomalies
• Comparing process lists to find hidden activity
• Examining suspicious drivers and concealed connections

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Reconstruct USB device usage on Windows by comparing registry records, Event Logs, and device installation logs. Identify devices, correlate connection times and drive letters, and build a timeline for removable media investigations.

• Investigating suspected data removal through USB storage
• Checking whether unapproved USB devices were connected
• Correlating USB connections with malware execution

Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.

• Investigating a payment address found in a ransom note
• Tracing funds after a ransom payment
• Comparing related wallets across ransomware incidents

Examine Outlook PST and OST archives to extract messages, headers, attachments, and recoverable deleted items. Use the extracted records to trace email routing, reconstruct communication patterns, and support incident investigations or legal evidence review.

• Investigating suspicious emails in Outlook archives
• Tracing message routes through email headers
• Extracting attachments for further analysis

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Examine Linux authentication logs, shell history, SSH keys, scheduled tasks, and system settings to investigate a compromise. Help reconstruct activity, identify ways attackers maintain access, and document suspicious accounts, files, and configuration changes.

• Investigating a potentially compromised Linux server
• Finding mechanisms that maintain unauthorized access
• Tracing user activity through logs and command history