Download

Skill UI

Browse and discover 10585+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search windows-forensics , found 16 results

Default Newest Most Downloaded

Memory Forensics Analysis Techniques

memory-forensics

sickn33/antigravity-awesome-skills

This comprehensive guide provides techniques for acquiring, analyzing, and extracting artifacts from memory dumps. It covers best practices for digital forensics, crucial for incident response and malware analysis. Users learn how to use industry-standard tools like Volatility 3 on Windows, Linux, and macOS, including process, network, and registry deep dives.

Analyzing USB Device Connection History

analyzing-usb-device-connection-history

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive digital forensics technique used to investigate removable media usage. It parses artifacts from Windows registry (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs to track which USB devices were connected, when they were used, and establishing a timeline for potential data exfiltration or insider threat activity.

Analyzing Windows Amcache Forensic Artifacts

analyzing-windows-amcache-artifacts

mukul975/Anthropic-Cybersecurity-Skills

A specialized tool for digital forensics investigators that parses the Windows Amcache.hve registry hive. It extracts crucial evidence regarding program execution history, application installation metadata, and loaded driver binaries. By correlating SHA-1 hashes and reconstructing timelines, users can determine which executables ran on a system, aiding in incident response and threat detection.

Analyzing Windows Prefetch Files for Forensics

analyzing-windows-prefetch-with-python

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a method to parse Windows Prefetch files (.pf) using Python, allowing security analysts to reconstruct detailed application execution histories. It is crucial for incident response, enabling the detection of renamed binaries, identifying suspicious execution patterns, and building accurate chronological timelines of system activity for deep forensic investigation.

Analyzing Windows Registry for Digital Forensics

analyzing-windows-registry-for-artifacts

mukul975/Anthropic-Cybersecurity-Skills

This comprehensive forensic workflow guides investigators through the extraction and detailed analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, etc.). It is used during incident response to uncover critical artifacts, including user activity history, malware persistence mechanisms (autorun keys), installed software records, and evidence of system compromise.

Analyzing Windows Shellbag Registry Artifacts

analyzing-windows-shellbag-artifacts

mukul975/Anthropic-Cybersecurity-Skills

Shellbags are critical Windows registry artifacts that record user interaction history with directories, storing view settings and browsing paths. This toolset allows analysts to reconstruct folder access history, detect connections to removable media, and prove navigation to network shares, even if the original folders no longer exist on the system. Essential for digital forensics and incident response.

Analyzing Windows Event Logs for Forensics

extracting-windows-event-logs-artifacts

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive workflow for extracting, parsing, and analyzing Windows Event Logs (EVTX). It guides security professionals in using advanced tools like Chainsaw and Hayabusa, combined with Sigma rules, to detect critical security incidents such as lateral movement, privilege escalation, and persistence mechanisms during incident response and digital forensic investigations.

Endpoint Forensics Collection with Velociraptor

implementing-velociraptor-for-ir-collection

mukul975/Anthropic-Cybersecurity-Skills

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

Analyzing Malware Persistence Mechanisms

performing-malware-persistence-investigation

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a systematic methodology for investigating malware persistence mechanisms across Windows and Linux systems. It covers analyzing critical areas like the Windows Registry (SYSTEM, SOFTWARE, Run keys), Scheduled Tasks, and WMI artifacts. Use it during incident response, threat hunting, or digital forensics to ensure all unauthorized startup entries are found and remediated.

Volatility3 Memory Forensics Toolkit

performing-memory-forensics-with-volatility3-plugins

mukul975/Anthropic-Cybersecurity-Skills

This automated toolkit streamlines memory forensics using the Volatility3 framework. It is designed to analyze raw memory dumps from Windows, Linux, and macOS, revealing complex threats such as process injection, hidden rootkits, malicious code artifacts, and illicit network connections that traditional disk-based methods cannot detect. Essential for real-time incident response and deep security auditing.

Performing Windows Forensic Artifact Analysis

performing-windows-artifact-analysis-with-eric-zimmerman-tools

mukul975/Anthropic-Cybersecurity-Skills

Leverage Eric Zimmerman's EZ Tools suite for comprehensive Windows forensic artifact analysis. This guide details how to parse critical system data, including the Master File Table (MFT), registry hives, prefetch files, and event logs. Essential for digital forensics investigators and incident responders conducting deep system analysis.

Analyzing Windows LNK Files Artifacts

analyzing-windows-lnk-files-for-artifacts

mukul975/Anthropic-Cybersecurity-Skills

This comprehensive guide provides a detailed workflow for parsing Windows LNK shortcut files in a digital forensics context. It extracts critical artifacts including target paths, timestamps (creation, access, modification), volume serial numbers, and machine identifiers. It is essential for reconstructing user file access history, tracking accessed files on network shares, and building robust forensic timelines.

Language