Download

Skill UI

Browse and discover 5970+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Forensics , found 24 results

Default Newest Most Downloaded

Forensics Data Collector

forensics-data-collector

jeremylongshore/claude-code-plugins-plus-skills

Auto-activating skill that guides analysts through forensics data collector operations, aligning advanced security practices with compliance frameworks while generating validated code and configurations for enterprise deployments.

Disk Imaging Forensics

acquiring-disk-image-with-dd-and-dcfldd

mukul975/Anthropic-Cybersecurity-Skills

Steps to create forensic bit-for-bit copies with dd or dcfldd, including write-blocking, hash logging, and verification for incident response and legal evidence acquisition.

Browser Artifact Analysis Tool

analyzing-browser-forensics-with-hindsight

mukul975/Anthropic-Cybersecurity-Skills

Hindsight parses Chromium browser artifacts to recover history, downloads, cookies, autofill entries, saved passwords, cache, extensions, and other web data, producing timelines or XLSX/JSON/SQLite reports for incident response, insider threat, and criminal investigations.

Docker Container Forensics

analyzing-docker-container-forensics

mukul975/Anthropic-Cybersecurity-Skills

Guide to investigate compromised Docker containers by collecting container state, exporting filesystem layers, auditing volumes, logs, and host artifacts, and comparing images to detect malicious activity during incident response.

Outlook PST Forensic Analysis

analyzing-outlook-pst-for-email-forensics

mukul975/Anthropic-Cybersecurity-Skills

Extract forensic evidence from Outlook PST/OST archives using libpff-based tooling and Python scripts to recover deleted items, headers, attachments, and metadata for incident response and legal investigations.

Detecting Fileless Malware

detecting-fileless-malware-techniques

mukul975/Anthropic-Cybersecurity-Skills

Detects fileless malware in memory by analyzing PowerShell, WMI, registry-resident payloads, and LOLBin behaviors, guiding persistence, LOLBin abuse, and memory forensics investigations when no disk artifacts exist.

Process Injection Detection

detecting-process-injection-techniques

mukul975/Anthropic-Cybersecurity-Skills

Detects malicious process injection techniques through memory forensics, Sysmon/API monitoring, and behavioral signals, aiding EDR/SIEM teams in spotting DLL injection, hollowing, APC/thread hijacking, reflective loading, and similar stealthy attacks.

Rootkit Activity Detection

detecting-rootkit-activity

mukul975/Anthropic-Cybersecurity-Skills

Detects stealthy rootkit behavior on compromised hosts by using memory forensics, cross-view process comparisons, kernel hook scanning, module validation, and hidden artifact discovery to confirm kernel-level compromise before remediation.

Windows Event Log Forensics

extracting-windows-event-logs-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Extract, parse, and analyze EVTX files with Chainsaw, Hayabusa, and EvtxECmd to uncover lateral movement, persistence, and privilege escalation during incident response and forensic investigations.

Cloud Forensics Playbook

performing-cloud-forensics-investigation

mukul975/Anthropic-Cybersecurity-Skills

Guides investigators through preserving evidence and analyzing logs, snapshots, and metadata across AWS, Azure, and GCP, covering breach response, IAM analysis, and incident triage in cloud environments.

AWS CloudTrail Forensics

performing-cloud-forensics-with-aws-cloudtrail

mukul975/Anthropic-Cybersecurity-Skills

Use boto3, Athena, and the AWS CLI to query CloudTrail logs, reconstruct attacker timelines, surface suspicious API calls and credential abuse, then craft forensic reports for AWS incident response.

Cloud Native Falco Forensics

performing-cloud-native-forensics-with-falco

mukul975/Anthropic-Cybersecurity-Skills

Deploy Falco YAML rules to monitor containers and Kubernetes for runtime threats, parse alerts, and investigate compromises by catching shell spawns, file tampering, net anomalies, or privilege escalations.

Language