'forensics' 검색 결과

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Disk imaj forensics — The Sleuth Kit (TSK), Autopsy, deleted file recovery, MFT/inode analizi, slack space, EWF/RAW imajlar

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-c

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Forensics kategorisi SKILL.md — Memory, disk, PCAP, steganography araçları kurma rehberi

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

GitHub 공개 소프트웨어의 기록과 보관 자료를 대조해 의심스러운 변경을 조사합니다. 삭제된 정보 복구를 시도하고 침해 단서와 증거를 담은 보고서를 작성합니다.

• 의심스러운 커밋과 빌드 절차 조사
• 기록에서 사라진 커밋 복구 조사
• 인증 정보 유출 경위 조사

Investigate memory dumps, disk records, and captured network traffic while preserving evidence. The skill guides timeline reconstruction and examination of system traces to identify suspicious activity and produce findings that others can review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preserve evidence before starting an incident investigation
• Inspect processes and connections in memory dumps
• Build timelines from event logs and execution traces

Investigate security incidents using memory dumps, saved copies of RAM. The skill guides memory acquisition, process and network analysis, suspicious code detection, and evidence extraction with Volatility and related tools, including checks for capture integrity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Capturing RAM before shutting down a system under investigation
• Finding suspicious processes and network connections in memory
• Extracting executables and strings for malware analysis

Investigate suspected rootkits, malware that hides its presence, by comparing process lists, inspecting memory, and checking system integrity. Use Volatility and Windows or Linux scanners to identify hidden processes, suspicious drivers, altered system calls, and concealed connections.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating compromise when standard tools show no anomalies
• Comparing process lists to find hidden activity
• Examining suspicious drivers and concealed connections

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Collect evidence from a compromised computer before shutdown or remediation erases it. Preserve memory, network connections, processes, and system state, then record integrity hashes and handling history to support incident investigation and evidence tracking.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preserving evidence before shutting down a compromised computer
• Collecting memory evidence for suspected fileless malware
• Recording active connections and processes during an intrusion

Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a payment address found in a ransom note
• Tracing funds after a ransom payment
• Comparing related wallets across ransomware incidents

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Examine Outlook PST and OST archives to extract messages, headers, attachments, and recoverable deleted items. Use the extracted records to trace email routing, reconstruct communication patterns, and support incident investigations or legal evidence review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious emails in Outlook archives
• Tracing message routes through email headers
• Extracting attachments for further analysis

Reconstruct USB device usage on Windows by comparing registry records, Event Logs, and device installation logs. Identify devices, correlate connection times and drive letters, and build a timeline for removable media investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected data removal through USB storage
• Checking whether unapproved USB devices were connected
• Correlating USB connections with malware execution

Investigate captured network traffic and connection records with Wireshark, Zeek, and NetFlow analysis. Identify communications with attacker infrastructure, trace movement between internal systems, estimate data transfers, and produce findings linked to packet evidence and timestamps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious periodic connections
• Measuring the volume and destination of data transfers
• Tracing attacker movement between internal systems