Results for “dfir”

Build a shared incident timeline in Timesketch from endpoint, server, and cloud logs. Search events, add tags and investigator notes, reconstruct the attack sequence, and organize findings into a story for incident reporting.

• Reconstructing the sequence of an incident
• Reviewing evidence with multiple analysts
• Combining Plaso output and other logs

Reconstruct Windows folder browsing activity from Shellbag registry records using SBECmd and ShellBags Explorer. Investigate traces of deleted directories, disconnected USB drives, and network shares while accounting for limits in what the records and timestamps show.

• Reconstructing a user's folder browsing history
• Investigating browsing traces on disconnected USB drives
• Checking access traces for deleted folders

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.

• Combine logs and network captures into an incident timeline
• Trace attacker actions from initial access to persistence
• Separate confirmed event order from inferred gaps

Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.

• Reconstructing the sequence of a computer compromise
• Comparing events across logs and file records
• Investigating timestamp changes and cleared logs

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Advanced CV for infrastructure inspection including forest fire detection, wildfire precondition assessment, roof inspection, hail damage analysis, thermal imaging, and 3D Gaussian Splatting reconstruction. Expert in multi-modal detection, insurance risk modeling, and reinsurance data pipelines. Activate on "fire detection", "wildfire risk", "roof inspection", "hail damage", "thermal analysis", "Gaussian Splatting", "3DGS", "insurance inspection", "defensible space", "property assessment", "catastrophe modeling", "NDVI", "fuel load". NOT for general drone flight control, SLAM, path planning, or sensor fusion (use drone-cv-expert), GPU shader development (use metal-shader-expert), or generic object detection without inspection context (use clip-aware-embeddings).

The English summary is being prepared. Showing the original description.

Advanced CV for infrastructure inspection including forest fire detection, wildfire precondition assessment, roof inspection, hail damage analysis, thermal imaging, and 3D Gaussian Splatting reconstruction. Expert in multi-modal detection, insurance risk modeling, and reinsurance data pipelines. Activate on "fire detection", "wildfire risk", "roof inspection", "hail damage", "thermal analysis", "Gaussian Splatting", "3DGS", "insurance inspection", "defensible space", "property assessment", "catastrophe modeling", "NDVI", "fuel load". NOT for general drone flight control, SLAM, path planning, or sensor fusion (use drone-cv-expert), GPU shader development (use metal-shader-expert), or generic object detection without inspection context (use clip-aware-embeddings).

The English summary is being prepared. Showing the original description.

Advanced CV for infrastructure inspection including forest fire detection, wildfire precondition assessment, roof inspection, hail damage analysis, thermal imaging, and 3D Gaussian Splatting reconstruction. Expert in multi-modal detection, insurance risk modeling, and reinsurance data pipelines. Activate on "fire detection", "wildfire risk", "roof inspection", "hail damage", "thermal analysis", "Gaussian Splatting", "3DGS", "insurance inspection", "defensible space", "property assessment", "catastrophe modeling", "NDVI", "fuel load". NOT for general drone flight control, SLAM, path planning, or sensor fusion (use drone-cv-expert), GPU shader development (use metal-shader-expert), or generic object detection without inspection context (use clip-aware-embeddings).

The English summary is being prepared. Showing the original description.

Retrieve climate-related disaster records, including floods, cyclones, droughts, and heatwaves. Check affected countries, severity, status, and population figures, then consult climate anomalies and related news for broader context.

• Check ongoing floods and cyclones
• Review disaster severity and affected populations
• Explore climate anomalies and related news

Organize CTF investigations by mapping the supplied targets, tracing one minimal path, and selecting the relevant specialist workflow. Findings are grounded in observed behavior and reproducible evidence, with a clean baseline used for verification.

• Choosing an analysis path for a CTF challenge
• Tracing a minimal path through challenge infrastructure
• Packaging reproducible evidence for a solution

Analyze binaries, malware samples, memory dumps, and packet captures in sandboxed security challenges. Trace program behavior, investigate crashes, and verify exploit conditions while preserving original files, decoded artifacts, and observable evidence for reproducible findings.

• Reverse engineer a binary’s structure and behavior
• Unpack a malware sample and separate its components
• Investigate crashes and verify exploit conditions

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Find WMI event subscriptions that let attackers retain access to Windows systems. Correlate Sysmon events with stored subscriptions and Autoruns results, inspect execution triggers and commands, and document risks and recommended remediation.

• Triaging Sysmon alerts for events 19, 20, and 21
• Finding WMI persistence during incident response
• Distinguishing suspicious subscriptions from legitimate settings

Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.

• Investigating malware that runs only in memory
• Checking suspicious processes and network connections
• Investigating signs of credential theft

Analyze Windows Registry files to uncover user activity, installed software, USB connections, and automatic startup entries. Organize these traces into investigation summaries and timelines to help examine suspicious activity and possible malware persistence.

• Investigating suspicious automatic startup entries
• Reconstructing user activity around an incident
• Checking USB device connection traces

Examine Windows shortcut files to recover target paths, timestamps, drive identifiers, and machine details. Organize these traces into an investigation timeline covering local documents, USB devices, network shares, and suspicious startup shortcuts.

• Reconstruct document access history from Windows shortcuts
• Trace references to files on USB devices
• Investigate access to network shares

Analyze NTFS file records and change journals to investigate deleted files on Windows disks. Recover surviving metadata and content where possible, reconstruct file activity timelines, and compare timestamps for signs of deliberate manipulation.

• Recovering names and paths of deleted files
• Assessing whether deleted file content can be recovered
• Reconstructing file creation, modification, and deletion timelines

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Build fire effects in Three.js, including fireballs, moving flame fronts, whirls, and smouldering ground. A reusable module combines rising flames, temperature-based color, smoke, sparks, heat distortion, and shared firelight, with a five-stage demonstration.

• Creating held flames and thrown fireballs
• Building expanding walls and rings of fire
• Staging fire whirls with smoke columns

A 1970s European editorial poster in motion — a red rule draws across, a giant tilted figure drops in, a three-line headline rises line-by-line, an italic serif standfirst fades.

The English summary is being prepared. Showing the original description.

IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology

The English summary is being prepared. Showing the original description.

Think and work like an expert Air Quality Scientist. Use when a task calls for Air Quality Scientist judgment. Reasons from source emissions through transformation, transport, and dose using SMOKE/MOVES inventories, WRF-driven CTMs like CMAQ and CAMx, PMF/ME-2 apportionment, and concentration-response functions, while treating rotational PMF ambiguity, AOD-to-PM bias in humid regions, uncalibrated low-cost sensors, and untreated wildfire exceptional events as first-class failure modes.

The English summary is being prepared. Showing the original description.

Computes a numeric or categorical answer to a quantitative data-science question by cleaning and analyzing local data files (CSV, Excel, TSV, and scientific formats .npz/.fits/.h5) with pandas, numpy, and scipy. Use whenever a task ships its own dataset (in whatever local directory it provides) and asks you to derive a value via statistical, geospatial, temporal, ratio, percentage, growth-rate, correlation, signal-processing, orbital, or forecasting analysis. Spans domains including archeology (demographics, paleoclimate proxies, radiocarbon dating, historical conflicts); biomedical/bioinformatics (tumor histology, genes, proteins, peptides, genomic variants); environmental (water quality, bacterial/Enterococcus exceedance, rainfall correlations, environmental justice); legal/consumer (fraud, identity theft, consumer complaints by state/metro); wildfire (incidents, causes, suppression costs, acres burned, fatalities, geospatial intersections); and astronomy/heliophysics/space weather (satellite telemetry TLE/Swarm/SP3, indices OMNI/GOES, solar activity, atmospheric density, orbital mechanics, forecasting).

The English summary is being prepared. Showing the original description.