Detect Windows intrusions and document findings with incident response workflows.
npx skills add https://github.com/chenchunrun/onyx-soc --skill windows-ir
Please help me install this Agent Skill. Skill: windows-ir Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/windows-ir Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill windows-ir
Windows IR often requires rapid detection and forensic analysis across many endpoints to identify intrusions, preserve evidence, and guide containment.
Run the Windows IR investigation workflow across endpoints by loading the included scripts and references.
High-intent search queries and answers about installing and using this skill.
Windows intrusion detection is performed through phase-driven checks for log, process, and persistence analysis. The workflow applies script-assisted automation to identify malicious activity and document findings with structured incident response playbooks.
Checking for persistence mechanisms on Windows endpoints is handled through phase-driven checks within the incident response workflow. This process hunting approach identifies and documents malicious persistence techniques across affected Windows endpoints.
Webshell detection on Windows servers is executed using a dedicated workflow within the incident response process. This threat hunting workflow provides references to efficiently identify webshell activity and document findings for reporting.
Yes, psutil supports process hunting and evidence collection across Windows endpoints. The Skill leverages this dependency to automate script-assisted incident response tasks, gathering forensic evidence for structured reporting.
Automated incident response reporting and evidence gathering is achieved by loading the included scripts and references. This automates the collection and documentation of forensic findings into structured playbooks for Windows security incidents.
The phase-driven workflow focuses specifically on Windows-based intrusions, log analysis, and process hunting. It requires the psutil dependency and is designed for incident responders performing endpoint forensics rather than real-time continuous monitoring.
tekgruntCollect forensic artifacts from endpoints via D&R rules.
jeremylongshoreGenerate incident response playbooks for containment, eradication, and recovery.
dandyeEnrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.
YukiIto1999Deploy Zeek to collect, parse, and analyze network traffic logs.
