windows-analysis

What problem does it solve?

This Skill simplifies the workflow for analyzing Windows systems by enabling targeted artifact collection and investigation using Velociraptor.

Core Features & Use Cases

• Investigation Workflow: Guides analysts through collecting and reviewing Windows event logs, registry data, and file activity artifacts.
• Targeted Data Collection: Allows focused retrieval of suspicious processes, execution traces, or persistence mechanisms on Windows hosts.
• Use Case: An investigator suspects malicious activity on a Windows machine and runs a Velociraptor-based query to identify malicious binaries, then records the hashes and metadata for further analysis.

Quick Start

Run Windows analysis artifacts against a Velociraptor client to identify suspicious artifacts or collect specific evidence.