Analyzes Windows event logs, PCAPs, and filesystem artifacts to detect security incidents.
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill dfir
Please help me install this Agent Skill. Skill: dfir Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/dfir Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill dfir
Digital forensics and incident response often involve collecting and analyzing scattered data sources (Windows Event Logs, PCAPs, and filesystem artifacts) to detect intrusions and reconstruct attacks. This Skill provides a cohesive framework to parse, correlate, and interpret evidence across sources for faster and more reliable investigations.
Load a Windows evidence bundle and run the DFIR workflow to automatically parse EVTX, PCAPs, and MFT data.
High-intent search queries and answers about installing and using this skill.
Windows event log analysis for incident response is automated by parsing EVTX files and correlating event IDs to detect authentication anomalies and privilege escalation patterns. The Skill structures these workflows to quickly identify security incidents across Windows environments.
Reconstructing an attack timeline from PCAP and EVTX files is achieved through cross-source correlation. The Skill parses network forensics artifacts like NTLM relay patterns alongside Windows event logs to build a cohesive, chronological history of an intrusion.
Yes, you can use this DFIR workflow to analyze NTFS filesystem artifacts. It supports parsing MFT, NTFS, and Volume Shadow Copies (VSS) to detect Active Directory attacks and extract IOCs during threat hunting investigations.
Cross-source correlation during a forensic investigation works by parsing and interpreting evidence from EVTX, PCAP, and filesystem artifacts together. This cohesive framework detects intrusions faster and more reliably than analyzing scattered data sources independently.
Yes, this incident response Skill detects LLMNR and NTLM relay attacks from network traffic. It performs PCAP-based network forensics to identify NTLM/NTLMv2 patterns and reconstruct the timeline of relay attacks.
To start a digital forensics investigation you need to load a Windows evidence bundle containing EVTX, PCAP, and MFT data. Running the DFIR workflow then automatically parses these sources to detect security incidents.
LeoWSY-hashblueCorrelates EVTX, PCAP, memory, and MFT artifacts to reconstruct Windows incident timelines.
dirnbauerGenerate security incident reports using NIST SP 800-61 and SANS-aligned templates.
Happy-Technologies-LLCCorrelate security incidents with events, vulnerabilities, and threat intelligence.
YukiIto1999Collect, parse, and correlate Windows EVTX, Linux syslog, and web access logs into a unified forensic timeline.
