Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser history, prefetch, LNK, and more), then triage and filter the results in Timesketch. Use when reconstructing the full sequence of events on a compromised or forensically imaged host during a DFIR investigation.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Authorized Use Only: Build timelines only from evidence you are authorized to analyze. Work from forensic images/copies and preserve chain of custody.
Plaso (Plaso Langar Að Safna Öllu) is the open-source engine behind log2timeline, the standard for building forensic super timelines — a single chronological, normalized view fusing hundreds of artifact types (file-system MACB times, registry, EVTX, browser history, prefetch, LNK, $UsnJrnl, syslog, and more) into one timeline. Plaso has three core CLI tools:
.plaso storage file using its large parser/plugin set..plaso file.The resulting timeline is enormous, so analysts triage it in Timesketch — a collaborative, web-based timeline analysis platform that ingests .plaso files (or CSV/JSONL) and supports filtering, tagging, starring, saved searches, and automated analyzers.
docker pull log2timeline/plaso
# Run a tool, mounting your evidence/output directory
docker run -v /cases:/data log2timeline/plaso log2timeline.py --version
sudo add-apt-repository ppa:gift/stable
sudo apt-get update && sudo apt-get install -y plaso-tools
.plaso storage file.| ID | Official Technique Name | Relevance to this skill |
|---|---|---|
| T1070 | Indicator Removal | Super timelines reveal indicator-removal behavior (log clearing, file deletion, timestomping) by exposing inconsistencies between MACB timestamps, the USN journal, and event logs. |
Plaso is a defensive forensics engine; the mapping reflects the anti-forensic adversary behavior super timelines are well suited to detect.
log2timeline.py writes a .plaso file from a source. --storage-file names the output; the source can be an .E01, raw image, mount point, or directory.
log2timeline.py --storage-file timeline.plaso /cases/greendale/image.E01
Scope parsers for speed/relevance with --parsers (presets like win7, webhist, or explicit parser names):
log2timeline.py --parsers "win7,!filestat" --storage-file timeline.plaso /cases/image.E01
pinfo.py reports source, parsers used, event counts, and any warnings.
pinfo.py timeline.plaso
psort.py selects an output module with -o, writes with -w, normalizes the timezone with --output-time-zone, and accepts an event filter expression to scope a date range.
psort.py --output-time-zone 'UTC' \
-o l2tcsv \
-w supertimeline.csv \
timeline.plaso \
"date > datetime('2026-01-01T00:00:00') AND date < datetime('2026-01-27T00:00:00')"
For Timesketch-friendly JSON lines, use the json_line output module:
psort.py --output-time-zone 'UTC' -o json_line -w supertimeline.jsonl timeline.plaso
psteal.py runs extraction and CSV export together for quick triage.
psteal.py --source /cases/greendale/image.E01 -o l2tcsv -w supertimeline.csv
Use the official timesketch_importer CLI to upload the .plaso (or CSV/JSONL) into a sketch. Timesketch chunks/reassembles and indexes the file.
timesketch_importer \
--host http://127.0.0.1:5000 \
--username admin \
--timeline_name "greendale-host01" \
--sketch_id 1 \
timeline.plaso
In the sketch UI:
data_type (e.g. windows:evtx:record, fs:stat).Look for MACB timestamps that disagree with $UsnJrnl entries (timestomping), gaps or EventLog cleared (1102) records, and deleted-then-recreated files — all visible on the unified timeline.
| Resource | Purpose | Link |
|---|---|---|
| Plaso (log2timeline) | Timeline engine + tools | https://github.com/log2timeline/plaso |
| Plaso documentation | Tool usage and parsers | https://plaso.readthedocs.io/ |
| Timesketch | Timeline analysis platform | https://github.com/google/timesketch |
| Timesketch docs | Deployment, importer, analyzers | https://timesketch.org/ |
| Plaso Docker image | Reproducible runtime | https://hub.docker.com/r/log2timeline/plaso |
| Command | Purpose |
|---|---|
log2timeline.py --storage-file out.plaso <source> | Extract events |
log2timeline.py --parsers <preset> ... | Scope parsers |
pinfo.py out.plaso | Inspect storage file |
psort.py -o l2tcsv -w out.csv out.plaso "<filter>" | Filter + export CSV |
psort.py -o json_line -w out.jsonl out.plaso | Export JSONL |
psteal.py --source <img> -o l2tcsv -w out.csv | Extract + export in one step |
timesketch_importer --host ... <file> | Import into Timesketch |
.plaso storage file produced from the source imageまだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
日本語の概要は準備中です。原文の説明を表示しています。
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
日本語の概要は準備中です。原文の説明を表示しています。
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.
日本語の概要は準備中です。原文の説明を表示しています。
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
日本語の概要は準備中です。原文の説明を表示しています。
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
日本語の概要は準備中です。原文の説明を表示しています。