skills.rest
rjonhaas
rjonhaasCOMMUNITY
Explore all skills by this author →
GitHub

Windows Artifacts (EZ Tools / Autoruns / Event Logs)

Parse Windows forensic artifacts into CSV outputs for DFIR triage.

1|Updated Apr 25, 2026
Search Tags:#execution evidence#windows forensics#persistence triage#event log analysis#autorunsc#evtx parsing#mft timeline
One-click install
npx skills add https://github.com/rjonhaas/SIFTics --skill windows-artifacts-ez-tools-autoruns-event-logs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Windows Artifacts (EZ Tools / Autoruns / Event Logs)
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/windows-artifacts
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill windows-artifacts-ez-tools-autoruns-event-logs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Windows incident response often stalls because analysts need reliable evidence of execution, persistence, and user activity across many host-based artifacts.

Core Features & Use Cases

  • Execution evidence extraction: Pulls and parses Prefetch, Amcache, Shimcache/AppCompatCache, MFT/USN Change Journal, and timeline artifacts to reconstruct what ran and when.
  • Persistence and autorun triage: Guides review of ASEP/Autorunsc outputs (services, drivers, tasks, boot execute, WMI, etc.) to identify suspicious enabled persistence.
  • Event log investigation: Parses EVTX logs and highlights key authentication, process creation, PowerShell, RDP, Defender, task scheduler, WMI, and system events to connect host behavior to suspicious activity.
  • Practical pivots and correlation: Uses hashes, timestamps, and artifacts’ paths to pivot across outputs and reduce false positives (e.g., timestomping confidence rules).

Quick Start

Run this skill by parsing Windows evidence artifacts into CSV outputs (Prefetch, Amcache/Shimcache, MFT/USN, and EVTX) and then pivot on hashes, timestamps, and suspicious paths to build an execution/persistence timeline.

Frequently Asked Questions about Windows Artifacts (EZ Tools / Autoruns / Event Logs)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I parse Windows Prefetch and Amcache artifacts for execution evidence?▼

Windows execution evidence is reconstructed by parsing Prefetch, Amcache, and Shimcache artifacts into structured CSV outputs. This allows analysts to correlate hashes, timestamps, and file paths to build an accurate execution timeline.

What is the best way to triage Autoruns persistence entries during a DFIR investigation?▼

Autoruns persistence triage involves reviewing Autorunsc outputs across services, drivers, tasks, boot execute, and WMI to identify suspicious enabled entries. Filtering noise through hash and path correlation helps isolate malicious persistence mechanisms.

How do I investigate Windows EVTX event logs for suspicious process creation and PowerShell activity?▼

Windows EVTX investigation parses event logs to highlight key authentication, process creation, PowerShell, RDP, Defender, task scheduler, WMI, and system events. This connects host behavior to suspicious activity by correlating command lines and timestamps.

Can I use Zimmerman EZ Tools outputs for MFT timeline reconstruction on a SIFT workstation?▼

Zimmerman EZ Tools outputs are fully supported for MFT timeline reconstruction on a SIFT workstation. The skill parses MFT and USN Change Journal data into structured formats to reconstruct user and system activity accurately.

How does timestomping detection work when analyzing MFT and execution artifacts?▼

Timestomping detection works by applying confidence rules to assess discrepancies between MFT timestamps and execution artifacts like Prefetch. Analysts filter false positives by pivoting across hashes, timestamps, and artifact paths to validate findings.

Related Skills

Explore More Data & Analytics Skills→
LeoWSY-hashblueLeoWSY-hashblue
3

dfir

Correlates EVTX, PCAP, memory, and MFT artifacts to reconstruct Windows incident timelines.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-forensic-timeline

Correlate EVTX, Sysmon, registry, memory, and PCAP artifacts into a defendable attacker timeline.

Community
Advanced
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced
jd-opensourcejd-opensource
299

pentest-ctf-forensics

Identify and extract artifacts from memory dumps, PCAPs, and disk images.

Official
Intermediate