Skill UI

Leverage Eric Zimmerman's EZ Tools suite for comprehensive Windows forensic artifact analysis. This guide details how to parse critical system data, including the Master File Table (MFT), registry hives, prefetch files, and event logs. Essential for digital forensics investigators and incident responders conducting deep system analysis.

This skill provides comprehensive forensic analysis of cryptocurrency payment flows stemming from ransomware attacks. It leverages blockchain APIs and advanced techniques to identify wallet clusters, track fund movement through obfuscation methods like mixers and peel chains, and map funds to exchanges. It is crucial for law enforcement, incident responders, and threat intelligence analysts conducting ransomware attribution.

A comprehensive framework for advanced forensic analysis of UEFI firmware and boot process integrity. It details methods to detect firmware implants in SPI flash, audit UEFI variables (PK, KEK, DB), inspect the EFI System Partition (ESP) for unauthorized components, and analyze boot chain anomalies. Ideal for investigating advanced persistent threats (APTs) and verifying system security posture against rootkits and bootkit techniques.

This skill detects AI-generated deepfake audio used in voice phishing (vishing) attacks. It functions by extracting critical spectral features (including MFCCs, spectral centroid, and zero-crossing rate) and passing them through advanced machine learning models (like Random Forest and Gradient Boosting). The system supports batch forensic analysis, provides confidence scores, and generates detailed reports to verify the authenticity of recorded voice calls, making it essential for cybersecurity incident response and fraud investigation.

This skill detects malicious Command and Control (C2) communications tunneled through the DNS protocol. It analyzes DNS query logs for indicators such as DNS tunneling tools (Iodine, dnscat2), Domain Generation Algorithms (DGA), and encoded payloads within TXT/CNAME records. Techniques include Shannon entropy analysis of subdomains, statistical anomaly detection, and machine learning classification. Ideal for network security analysts conducting deep threat hunting and forensic investigations.

Utilize advanced media intelligence to analyze audio, image, video, and text for synthetic manipulation and AI-generated content. This skill detects deepfakes, traces the original AI synthesis source, applies and detects watermarks, verifies speaker identity, and provides comprehensive media provenance analysis, ensuring media authenticity claims are rigorously supported.

A comprehensive, structured framework for conducting sophisticated Open Source Intelligence (OSINT) and cryptocurrency forensic investigations. This guide covers operational security (OpSec), target profiling, advanced transaction tracing across multiple blockchain layers (L1/L2), wallet analysis, and identifying linked digital assets. Use this methodology to guide systematic, multi-dimensional intelligence collection campaigns.

A comprehensive guide for advanced memory forensics using Volatility 2 and 3. This playbook covers artifact extraction, including hidden process detection, network connections, credential dumping, DLL analysis, and code injection detection (malfind). It is essential for incident response, malware analysis, and reconstructing attack timelines from memory dumps.

A comprehensive playbook for digital forensic experts. It details systematic techniques and tools for detecting and extracting hidden data embedded across various media types, including images (LSB, PNG chunks, JPEG DCT, EXIF metadata), audio (spectrogram, DTMF), and files (polyglots, appended data). Essential for deep-dive forensic investigations.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.

Plaso (log2timeline) is an open-source engine used to generate forensic super-timelines. This skill guides the process of normalizing hundreds of diverse artifact types—including MACB times, registry keys, EVTX logs, and browser history—into a single, cohesive chronological view. The workflow covers extraction, filtering, and importing the timeline into Timesketch for collaborative analysis, which is crucial for incident response, correlating complex activity chains, and detecting anti-forensic techniques like timestomping.

Chainsaw is a fast, Rust-based tool for digital forensics and threat hunting. It enables analysts to rapidly perform Sigma rule checks and keyword searches across collected Windows Event Logs (.evtx) and specialized artifacts (like shimcache and SRUM). Ideal for first-response and offline analysis, it provides detection capabilities without needing a SIEM ingestion pipeline, allowing quick hypothesis testing in the field or air-gapped environments.