What problem does it solve? Turning many scattered forensic artifacts into one coherent, replayable chronology is the hardest part of DFIR work. This Skill guides the reconstruction of attacker activity by anchoring events, normalizing timestamps, and correlating artifacts across sources so you can prove the exact order of compromise, persistence, and exfiltration. ## Core Features & Use Cases - Timeline Anchor Selection: Identify the smallest reliable anchors such as first execution, first logon, first network session, or first mailbox action, while recording clock source, timezone, and drift. - Cross-Artifact Correlation: Link EVTX, Sysmon, registry, Amcache, prefetch, browser, mail, PCAP, memory, and filesystem artifacts using shared identifiers like PID, logon ID, GUID, message ID, and hash. - Decisive Story Compression: Reduce the full chronology to the minimal sequence proving initial access, persistence, lateral movement, or exfiltration, keeping inferred edges separate from confirmed events. - Use Case: During a CTF or incident response engagement, you receive EVTX logs, a PCAP, and registry hives from a compromised host. Use this Skill to build the ordered chain from foothold to persistence and pinpoint the exact event where the decisive artifact appears. ## Quick Start Ask the assistant to build a forensic timeline correlating the provided EVTX logs, PCAP, and registry artifacts to reconstruct the attacker's actions in order.
