Collect and analyze Windows artifacts using Velociraptor for incident response.
npx skills add https://github.com/mgreen27/dfir-skills --skill windows-analysis
Please help me install this Agent Skill. Skill: windows-analysis Source: https://github.com/mgreen27/dfir-skills/tree/main/skills/windows-analysis Command: npx skills add https://github.com/mgreen27/dfir-skills --skill windows-analysis
This Skill simplifies the workflow for analyzing Windows systems by enabling targeted artifact collection and investigation using Velociraptor.
Run Windows analysis artifacts against a Velociraptor client to identify suspicious artifacts or collect specific evidence.
High-intent search queries and answers about installing and using this skill.
Windows forensic artifact collection using Velociraptor targets event logs, registry data, and file activity to support incident response. It guides analysts through focused retrieval of suspicious processes and execution traces on Windows hosts.
Hunting for persistence mechanisms on a Windows machine involves running targeted Velociraptor queries to identify suspicious processes and binaries. This allows investigators to record hashes and metadata for further analysis.
Velociraptor supports timeline reconstruction of Windows artifacts during incident response workflows. By collecting and reviewing file activity and execution traces, you can establish a comprehensive timeline of malicious behavior.
A Velociraptor client is required to investigate suspicious binaries on Windows. The analysis runs Windows artifacts against the client to identify malicious files and collect specific evidence for incident response.
Targeted Velociraptor artifact collection improves Windows incident response by ensuring safety and relevance of collected data. It allows focused retrieval of specific evidence rather than full system captures, streamlining investigation continuity.
Analysis of Windows event logs and registry data with Velociraptor focuses on targeted collection and investigation continuity. It emphasizes ease of use and data safety, but requires a connected client for successful evidence retrieval.
grtninjaCoordinate Windows and WSL services to validate cross-host connectivity.
refractionPOINTLaunch Velociraptor forensic collections on endpoints via LimaCharlie API.
Snausage0x45Analyze file hashes across malware intelligence APIs for security triage.
YukiIto1999Identify and document endpoint compromises through Windows digital forensics investigations.
