Skill UI

This guide details a comprehensive workflow for digital forensic investigations focusing on Amcache.hve registry hive. It teaches how to use AmcacheParser to extract evidence of program execution, application installation, and driver loading, including correlating SHA-1 hashes with threat intelligence and reconstructing timelines. This is crucial for DFIR work to identify deleted executables and malicious activity.

This skill performs threat hunting for persistence mechanisms by parsing Windows System event logs (Event ID 7045). It specifically detects suspicious service installations, analyzing service binary paths, and correlating these events with advanced telemetry (Sysmon/EDR) to identify indicators of compromise (MITRE ATT&CK T1543.003). Ideal for incident response and security validation.