windows-execution-analysis

You can collect Windows process execution artifacts for incident response by using this Skill to automatically gather forensic evidence like registry user assists, prefetch files, and process timelines across multiple clients. It works with Velociraptor to streamline evidence collection.

Key Windows forensic artifacts for investigating process execution include registry user assists, prefetch files, and system process timelines. This Skill targets these specific artifacts to help identify malicious activity and verify process behaviors during an investigation.

Yes, you can use Velociraptor with this Skill to gather process execution evidence across multiple Windows hosts. It automates collection from specified clients and generates reports that help investigators quickly identify suspicious activity during a breach.

Yes, this Windows forensic analysis tool reuses previously collected evidence when available. This reduces redundant collection operations across clients, saves time during incident response, and helps ensure data integrity throughout the investigation process.

The best way to analyze prefetch files and registry user assists during a breach is to automate their collection and correlation with process timelines. This Skill integrates with Velociraptor to gather these artifacts and generate reports highlighting suspicious process behaviors.