Skill UI

This specialized skill is designed for Digital Forensics and Incident Response (DFIR) scenarios. It correlates evidence from multiple disparate sources—including EVTX, PCAP, registry, memory, and filesystem artifacts—to build a comprehensive, ordered, and replayable forensic timeline. Use it when the goal is to map the full sequence of attacker actions, establishing initial access, lateral movement, and persistence chains based on cross-source evidence correlation.

A specialized skill for analyzing complex, host-to-host lateral movement chains within a Windows environment. It focuses on tracing protocols like WinRM, SMB, and RDP, replaying captured Kerberos tickets, understanding privilege edges, and identifying the exact accepting service or host that facilitates credential movement. Used in advanced penetration testing and digital forensics scenarios.

This is the master workflow and default entrypoint for complex CTF, exploit, and digital forensics challenges. It establishes a 'sandbox model,' treating presented targets as internal and guiding the user through a systematic investigation process. The orchestrator maps the entry surface, proves minimal attack paths, and intelligently routes the investigation to the most relevant specialized domain (e.g., pwn, crypto, cloud, AD) while maintaining a cohesive analysis flow.

A comprehensive guide for authorized digital forensics investigation. It covers critical areas including memory dump analysis (using Volatility), disk timeline reconstruction, PCAP network traffic analysis, and system artifact triage (like Event Logs and Prefetch). Essential for incident response, evidence preservation, and threat hunting to maintain a robust chain of custody.