dfir

What problem does it solve?

Digital forensics and incident response often involve collecting and analyzing scattered data sources (Windows Event Logs, PCAPs, and filesystem artifacts) to detect intrusions and reconstruct attacks. This Skill provides a cohesive framework to parse, correlate, and interpret evidence across sources for faster and more reliable investigations.

Core Features & Use Cases

• Windows EVTX parsing and event-id correlation for authentication and privilege escalation.
• PCAP-based network forensics including NTLM/NTLMv2 patterns, LLMNR/NTLM relay detection, and timeline reconstruction.
• Filesystem artifact analysis (MFT, NTFS, VSS) and AD attack detection for threat hunting and incident response.

Quick Start

Load a Windows evidence bundle and run the DFIR workflow to automatically parse EVTX, PCAPs, and MFT data.