Skill UI

This guide provides deep debugging techniques for complex Salesforce issues. Learn to analyze Apex debug logs, optimize SOQL query plans, diagnose governor limit violations, and perform EventLogFile forensics. Essential for resolving critical performance bottlenecks and advanced system errors in a professional development environment.

A comprehensive guide for advanced memory forensics using Volatility 2 and 3. This playbook covers artifact extraction, including hidden process detection, network connections, credential dumping, DLL analysis, and code injection detection (malfind). It is essential for incident response, malware analysis, and reconstructing attack timelines from memory dumps.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.

A comprehensive guide for conducting memory forensics to extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps (LSASS). This technique is crucial during incident response or breach assessment to identify compromised accounts or investigate lateral movement.

A comprehensive guide and toolkit for digital forensics experts to parse and analyze raw email headers (Received, Message-ID, etc.). This method traces the true origin of suspicious emails, validates sender authenticity by analyzing SPF, DKIM, and DMARC records, and confirms or rules out email spoofing attempts. Essential for incident response and phishing investigation.

A specialized tool for blockchain forensics, designed to trace the movement of ransomware payments across public blockchains (like Bitcoin). By leveraging APIs from services like Chainalysis and WalletExplorer, it identifies wallet clusters, tracks funds through mixers and tumblers, and maps fund flow from the victim to final exchange deposits. Essential for law enforcement attribution and threat intelligence gathering.

CHIPSEC is an open-source framework designed to assess the low-level security configuration of x86 platform firmware and hardware. It verifies critical security controls such as SPI flash write protection, BIOS locks, SMM/SMRR configuration, and Secure Boot variable integrity. Users can run automated tests, dump SPI flash memories for forensics, and detect potential firmware implants that persist below the operating system layer.

This skill details the process of generating comprehensive forensic super-timelines using Plaso's log2timeline tools. It fuses diverse artifacts—including file-system MACB times, registry data, EVTX, and browser histories—into a single, normalized chronological view. This is critical for reconstructing the full sequence of events on compromised or forensically imaged systems during Digital Forensics and Incident Response (DFIR) investigations, helping analysts detect anti-forensic activity.

Velociraptor is a powerful open-source platform for endpoint visibility and digital forensics. It allows users to deploy agents across thousands of endpoints and execute sophisticated VQL (Velociraptor Query Language) queries. This enables large-scale, on-demand forensic artifact collection, TTP hunting, and continuous monitoring during incident response, even on air-gapped or unmanaged systems.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

This guide details the process of parsing core Windows forensic artifacts, including MFT, Prefetch, Registry hives, ShellBags, and Amcache. Utilizing Eric Zimmerman's specialized EZ Tools, raw evidence is converted into standardized CSV/JSON formats. This process is crucial for Digital Forensics and Incident Response (DFIR) investigations, enabling analysts to reconstruct program execution, file access history, and persistence mechanisms, which can then be loaded into Timeline Explorer for unified analysis.

KAPE (Kroll Artifact Parser and Extractor) is a specialized, rapid triage tool for incident response. It collects specific, volatile forensic artifacts (like registry hives, event logs, and browser data) from compromised Windows systems. It is designed for remote, at-scale artifact collection when full disk imaging is impractical, enabling analysts to quickly build a defensible, parseable dataset for initial investigation and containment.