252 skills · sorted by relevance
Search Windows PowerShell logs for traces of Empire, a framework used after a system is compromised. Identify characteristic launch commands, encoded code, module calls, and communication paths, then report suspicious events with timelines and severity scores.
Examine Windows shortcut files to recover target paths, timestamps, drive identifiers, and machine details. Organize these traces into an investigation timeline covering local documents, USB devices, network shares, and suspicious startup shortcuts.
Analyze Windows PowerShell event logs to reconstruct scripts split across records and identify encoded commands, suspicious downloads, and security scanning bypass attempts. Produce a report with recovered scripts, risk scores, and mappings to documented attack techniques.
Analyze Windows Registry files to uncover user activity, installed software, USB connections, and automatic startup entries. Organize these traces into investigation summaries and timelines to help examine suspicious activity and possible malware persistence.
Parse Windows Prefetch files, which store traces of program execution, to extract run counts, timestamps, and referenced files. Build execution timelines and compare findings with other forensic evidence when investigating suspicious software or tool usage.
Examine NTFS disk images for residual or hidden data beyond standard file recovery. Analyze file metadata, change records, unused space within allocated storage, and Alternate Data Streams to reconstruct available activity and identify suspicious timestamp differences.
Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.
Analyze Zeek and NetFlow records for ransomware-related activity, including regular callbacks to attacker infrastructure, TOR connections, and possible data exfiltration. Combine indicators into risk scores and structured reports with timelines to support threat hunting and incident investigation.
Examine Windows shortcuts and Jump Lists, records of recently used files, to reconstruct user activity. Extract paths, timestamps, and device details with LECmd and JLECmd, including traces that remain after target files are deleted.
Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.
Investigate Linux intrusions using auditd records. Configure audit rules, search events with ausearch, summarize activity with aureport, reconstruct a timeline of suspicious actions, and forward logs to a central security monitoring system.
Use Scapy, a Python library for working with network packets, to inspect saved captures or authorized live traffic. Summarize protocols and connections, identify suspicious patterns, craft test packets, and export findings as structured JSON reports.
Analyze suspicious email headers to trace delivery routes and assess sender spoofing. Review SPF, DKIM, and DMARC sender authentication results, compare sender and reply addresses, and examine links and attachment hashes for phishing indicators.
Analyze memory dumps with Volatility3 to find heap spraying, an attack that fills memory with attacker-controlled data. Examine suspicious allocations and repeated byte patterns, extract suspicious code, and report affected processes and memory regions in JSON.
Examine captured network traffic for hidden malware communications in DNS, ICMP, and HTTP. Analyze domain patterns, packet sizes, and traffic frequency to identify suspicious channels used for remote control or data theft.
Analyze disk images with Autopsy and The Sleuth Kit to recover deleted files, search content, and examine recorded activity. Build investigation timelines and visual reports that help stakeholders understand evidence from one or multiple disk images.
Investigate failed or stuck GSD workflows using Git history, planning documents, and file state. Produce a structured diagnostic report with evidence, detected anomalies, and recommendations to help identify causes and decide corrective actions.
Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.
Examine what a file claims about itself and what it actually contains — powered by Apache Tika. True content-based type detection (extensions lie), provenance claims (authors, dates, creating application), revision and tamper signals (PDF incremental updates, tracked changes, hidden slides, zip integrity), hidden and embedded content (attachments, macros), risk indicators (PDF JavaScript actions, encryption), and content digests. Evidence gathering, not verdicts: Tika reports what the file asserts and what parsing observed; it does not attribute authorship or validate signatures. Use for triaging suspicious files, provenance questions, e-discovery-style review, or "is this file what it claims to be."
The English summary is being prepared. Showing the original description.
Recover deleted commits from GitHub using REST API, web interface, and git fetch. Use when you have commit SHAs and need to retrieve actual commit content, diffs, or patches. Includes techniques for accessing "deleted" commits that remain on GitHub servers.
The English summary is being prepared. Showing the original description.
Generate, export, load, and verify forensic evidence from GitHub sources. Use when creating verifiable evidence objects from GitHub API, GH Archive, Wayback Machine, local git repositories, or security vendor reports. Handles evidence storage, querying, and re-verification against original sources.
The English summary is being prepared. Showing the original description.
Orchestrates multi-agent forensic investigations on public GitHub repositories, coordinating parallel evidence collection, hypothesis formation, verification, and report generation.
The English summary is being prepared. Showing the original description.
Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since 2011.
The English summary is being prepared. Showing the original description.
Recover deleted GitHub content using the Wayback Machine and Archive.org APIs. Use when repositories, files, issues, PRs, or wiki pages have been deleted from GitHub but may persist in web archives. Covers CDX API queries, URL patterns, and systematic recovery workflows.
The English summary is being prepared. Showing the original description.