Skill UI

A comprehensive guide for SOC analysts and digital forensics experts. This skill covers the entire lifecycle of a phishing incident, from initial user report and header analysis (SPF, DKIM, DMARC) to detonating malicious URLs/attachments in sandboxes. It guides users on scoping the attack, identifying impacted users via SIEM/proxy logs, and executing containment measures like email purges.

A comprehensive guide for conducting cloud forensics investigations across AWS, Azure, and GCP. This workflow demonstrates how to preserve volatile and non-volatile evidence, including snapshotting volumes, capturing instance metadata, and collecting critical logs (CloudTrail, Activity Log, Audit Log) to trace unauthorized access and analyze security breaches.

A comprehensive guide to investigating AWS account compromises by querying CloudTrail logs. Use boto3 or AWS Athena to filter suspicious activities—such as unauthorized API calls, S3 data exfiltration, or IAM privilege escalation—to reconstruct a detailed attacker timeline and generate a professional forensic report.

This skill guides users on performing deep runtime threat detection and forensics in cloud-native environments using Falco. It leverages Falco YAML rules to monitor syscalls, detecting critical security events such as shell spawning, file tampering (e.g., /etc/shadow), network anomalies, and privilege escalation within containers and Kubernetes clusters. Ideal for incident response, security auditing, and validating container runtime security controls.

A comprehensive guide for conducting deep disk forensics investigations. This method covers secure evidence acquisition, creating bit-for-bit forensic images, analyzing file system structures (MFT, inodes), recovering deleted files, and reconstructing timelines using industry-standard tools like Autopsy, FTK Imager, and The Sleuth Kit. Essential for legal, HR, and security incident response.

This skill guides comprehensive digital forensics investigations on compromised endpoints. It covers evidence collection (memory acquisition, disk imaging) and deep artifact analysis, including volatile data, MFT records, and prefetch files. Use it for incident response, legal evidence collection, and determining the scope of a breach by reconstructing attacker timelines.

This guide details the process of file carving using the Foremost tool in digital forensics. It demonstrates how to recover deleted or fragmented evidence (such as documents, images, and archives) from raw disk images or unallocated space by analyzing file headers and footers, independent of the file system's index. It also covers advanced techniques using custom signatures and high-performance alternatives like Scalpel.

This comprehensive guide outlines a structured workflow for investigating insider threats—incidents where authorized employees or contractors misuse their access to steal data or sabotage systems. It integrates DLP alerts, User Behavior Analytics (UBA), and digital forensics, emphasizing mandatory collaboration between Legal, HR, and Security teams to build an admissible, evidence-based case.

This comprehensive guide details techniques for performing forensic investigations on Linux systems. It covers analyzing critical logs—including auth.log, syslog, systemd journal, and auditd—to reconstruct user sessions, trace unauthorized access, detect privilege escalation, and establish detailed event timelines following a suspected security compromise.

A comprehensive guide for collecting, parsing, and correlating system, application, and security logs from diverse sources (Windows, Linux, Web). This technique is crucial for reconstructing detailed event timelines, identifying initial access vectors, tracking lateral movement, and establishing evidence of unauthorized activity during post-breach forensic investigations.

This script systematically investigates all persistence mechanisms on Windows and Linux systems. It analyzes critical areas like the Windows Registry (SYSTEM, SOFTWARE, HKCU), scheduled tasks, and common run keys to identify how malware maintains access and survives system reboots. It is essential for advanced incident response, threat hunting, and digital forensics investigations.

A comprehensive guide to analyzing volatile memory (RAM) dumps using the Volatility 3 framework. This skill enables the extraction of crucial digital evidence, including running processes, network connections, loaded modules, credentials, and encryption keys. It is essential for incident response, detecting rootkits, process hollowing, or identifying malware when traditional disk-based forensics are insufficient.