skills.rest
LeoWSY-hashblue
LeoWSY-hashblueCOMMUNITY
Explore all skills by this author →
GitHub

dfir

Correlates EVTX, PCAP, memory, and MFT artifacts to reconstruct Windows incident timelines.

3|1|Updated May 26, 2026
Search Tags:#timeline#pcap#memory-dump#incident-response#dfir#mft#evtx
One-click install
npx skills add https://github.com/LeoWSY-hashblue/-communitytools-custom --skill dfir-leowsy-hashblue
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dfir
Source: https://github.com/LeoWSY-hashblue/-communitytools-custom/tree/main/skills/dfir
Command: npx skills add https://github.com/LeoWSY-hashblue/-communitytools-custom --skill dfir-leowsy-hashblue

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Digital forensics and incident response teams need a consistent, repeatable framework to parse and correlate Windows event logs, memory dumps, filesystem artifacts, and network captures to identify attacker techniques and reconstruct timelines.

Core Features & Use Cases

  • Correlation across EVTX, memory, MFT, and network artifacts to build a coherent incident timeline.
  • Quick-reference workflows for common IR tasks: daemon detection, LSA/credential misuse signals, Kerberos/NTLM abuse, and NTFS/MFT artifact correlation.
  • Use case examples: investigating a suspected LNK/phishing chain, tracing a credential dump, or validating lateral movement with cross-artifact consistency.

Quick Start

Describe how to start a DFIR analysis session using Windows EVTX, memory dumps, and MFT artifacts.

Frequently Asked Questions about dfir

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reconstruct an attack timeline from EVTX, MFT, and memory dump artifacts?▼

To reconstruct an attack timeline, you correlate EVTX, MFT, memory dump, and PCAP artifacts using artifact-specific correlation keys to identify attacker techniques and build a coherent chronological sequence across Windows environments.

What is the best way to investigate a suspected LNK phishing chain and credential dump?▼

Investigating a LNK phishing chain and credential dump involves applying quick-reference workflows to correlate filesystem and memory artifacts, validating lateral movement signals, and tracing the attack chain through cross-artifact consistency.

Can I use this DFIR workflow to detect Kerberos and NTLM credential abuse signals?▼

Yes, you can detect Kerberos and NTLM abuse by parsing Windows EVTX logs and correlating them with memory artifacts to identify credential misuse signals, LSA exploits, and daemon detection across the incident timeline.

Do I need python-evtx and analyzeMFT to parse Windows event logs and MFT for incident response?▼

Yes, robust incident response requires python-evtx to parse EVTX files and analyzeMFT to analyze MFT artifacts, alongside memory forensics tooling, to effectively correlate Windows event logs, filesystem, and memory data.

How does cross-artifact correlation work when tracing lateral movement in Windows environments?▼

Cross-artifact correlation for tracing lateral movement works by validating consistency across EVTX logs, memory dumps, MFT, and PCAP captures, applying specific correlation keys to reconstruct attacker techniques and incident timelines.

Related Skills

Explore More Data & Analytics Skills→
wgpsecwgpsec
1.6k

ctf-forensics

Triage and analyze disk images, memory dumps, PCAP captures, and stego media.

Official
Advanced
DuqueOMDuqueOM
5

secret-breach-response

Detect leaked credentials in repositories, logs, or artifacts and initiate incident response.

Community
Advanced
jd-opensourcejd-opensource
299

pentest-ctf-forensics

Identify and extract artifacts from memory dumps, PCAPs, and disk images.

Official
Intermediate
YukiIto1999YukiIto1999

dfir

Analyzes Windows event logs, PCAPs, and filesystem artifacts to detect security incidents.

Community
Advanced