07-incident-response

Name: 07-incident-response
Author: Masriyan

190stars37forks

How to install 07-incident-response?

masriyan/claude-code-cybersecurity-skill/07-incident-response

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 07-incident-response

Installs into the current project.

Summary

IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology

Files · 1

View on GitHub

SKILL.md

1	# Incident Response & Digital Forensics
2
3	## Purpose
4
5	Enable Claude to assist with structured incident response operations following NIST SP 800-61 and the SANS PICERL framework. Claude generates IR playbooks, guides evidence collection with chain of custody, constructs forensic timelines, interprets memory forensics output, and produces post-incident reports.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Creating an incident response playbook (ransomware, phishing, breach, etc.)
13	- Evidence collection and chain of custody procedures
14	- Forensic timeline construction from logs or artifacts
15	- Memory forensics using Volatility
16	- Post-incident report generation
17	- DFIR (Digital Forensics and Incident Response) procedures
18	- Containment and eradication strategies
19	- Root cause analysis for security incidents
20	- IR metrics, SLA tracking, or reporting for management
21
22	---
23
24	## Prerequisites
25
26	```bash
27	pip install pyyaml jinja2 pandas python-dateutil
28	```
29
30	Recommended DFIR tools:
31	- `Volatility 3` — Memory forensics framework
32	- `Autopsy / Sleuth Kit` — Disk forensics
33	- `plaso / log2timeline` — Supertimeline generation
34	- `KAPE` — Evidence collection (Windows)
35	- `Velociraptor` — Enterprise-scale endpoint forensics
36	- `FTK Imager` — Forensic imaging (Windows)
37	- `dd / dcfldd / dc3dd` — Disk imaging (Linux)
38
39	---
40
41	## PICERL Framework Overview
42
43	Every IR engagement follows the PICERL lifecycle:
44
45	\| Phase \| Key Actions \| Skill Outputs \|
46	\|-------\|------------\|---------------\|
47	\| Preparation \| Verify tools, comms, access \| Readiness checklist \|
48	\| Identification \| Confirm incident, scope, severity \| Incident classification \|
49	\| Containment \| Isolate systems, stop spread \| Containment actions list \|
50	\| Eradication \| Remove threat, close access \| Eradication checklist \|
51	\| Recovery \| Restore systems, verify integrity \| Recovery runbook \|
52	\| Lessons Learned \| Post-incident review \| IR report + improvements \|
53
54	---
55
56	## Core Capabilities
57
58	### 1. IR Playbook Creation
59
60	When the user asks to create a playbook for a specific incident type:
61
62	Claude generates detailed, role-assigned playbooks in this structure:
63
64	Ransomware Response Playbook (Example):
65
66	```markdown
67	# IR Playbook: Ransomware Attack
68	Version: 2.0 \| Owner: SOC Manager \| Review: Quarterly
69
70	## Trigger Conditions
71	- Multiple encrypted files discovered (ransom extension detected)
72	- Ransom note found on file shares or desktop
73	- EDR alert for mass file modification activity
74	- User reports files inaccessible with unfamiliar extensions
75
76	## Severity Classification
77	- CRITICAL: Domain controller / backup infrastructure affected
78	- HIGH: Production servers / business-critical data affected
79	- MEDIUM: Isolated workstation, contained environment
80
81	---
82
83	## Phase 1: Identification (Target: 15 minutes)
84	IR Lead:
85	- [ ] Confirm incident is ransomware (verify encrypted files + ransom note)
86	- [ ] Determine initial infection vector (phishing? RDP? Supply chain?)
87	- [ ] Identify Patient Zero — first encrypted system
88	- [ ] Assess scope: How many systems? Which business units?
89	- [ ] Declare incident severity and notify stakeholders
90	- [ ] Open incident ticket and begin documentation
91
92	Forensics:
93	- [ ] DO NOT REBOOT infected systems (preserve volatile evidence)
94	- [ ] Capture memory dump: `winpmem_mini_x64_rc2.exe output.raw`
95	- [ ] Collect running processes: `tasklist /v > processes.txt`
96	- [ ] Collect network connections: `netstat -ano > netstat.txt`
97
98	## Phase 2: Containment (Target: 30 minutes)
99	Network Team:
100	- [ ] Isolate affected systems (pull network cable or quarantine in VLAN)
101	- [ ] Block identified C2 IPs/domains at perimeter firewall
102	- [ ] Disable RDP externally if RDP was the initial vector
103	- [ ] Preserve network capture if encryption is still occurring
104
105	Active Directory:
106	- [ ] Identify all accounts used by the ransomware (service accounts, domain accounts)
107	- [ ] Reset passwords for all potentially compromised accounts
108	- [ ] Revoke active sessions for affected accounts
109	- [ ] Check for newly created privileged accounts
110
111	## Phase 3: Eradication
112	- [ ] Identify all persistence mechanisms (registry, services, scheduled tasks)
113	- [ ] Remove all malicious artifacts
114	- [ ] Verify no backdoors remain (check with Autoruns, process scanning)
115	- [ ] Patch the exploited vulnerability if one was used
116
117	## Phase 4: Recovery
118	- [ ] Restore from clean backup (verified pre-infection)
119	- [ ] Validate backup integrity before restoration
120	- [ ] Rebuild from gold image if backup compromised
121	- [ ] Verify data integrity after restoration
122	- [ ] Phased return to production
123
124	## Phase 5: Lessons Learned (Within 2 weeks

People who liked this also viewed

6 picks

Type

07-incident-response

190stars37forks

View on GitHub

How to install 07-incident-response?

masriyan/claude-code-cybersecurity-skill/07-incident-response

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 07-incident-response

Installs into the current project.

Summary

IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology

Files · 1

View on GitHub

SKILL.md

1	# Incident Response & Digital Forensics
2
3	## Purpose
4
5	Enable Claude to assist with structured incident response operations following NIST SP 800-61 and the SANS PICERL framework. Claude generates IR playbooks, guides evidence collection with chain of custody, constructs forensic timelines, interprets memory forensics output, and produces post-incident reports.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Creating an incident response playbook (ransomware, phishing, breach, etc.)
13	- Evidence collection and chain of custody procedures
14	- Forensic timeline construction from logs or artifacts
15	- Memory forensics using Volatility
16	- Post-incident report generation
17	- DFIR (Digital Forensics and Incident Response) procedures
18	- Containment and eradication strategies
19	- Root cause analysis for security incidents
20	- IR metrics, SLA tracking, or reporting for management
21
22	---
23
24	## Prerequisites
25
26	```bash
27	pip install pyyaml jinja2 pandas python-dateutil
28	```
29
30	Recommended DFIR tools:
31	- `Volatility 3` — Memory forensics framework
32	- `Autopsy / Sleuth Kit` — Disk forensics
33	- `plaso / log2timeline` — Supertimeline generation
34	- `KAPE` — Evidence collection (Windows)
35	- `Velociraptor` — Enterprise-scale endpoint forensics
36	- `FTK Imager` — Forensic imaging (Windows)
37	- `dd / dcfldd / dc3dd` — Disk imaging (Linux)
38
39	---
40
41	## PICERL Framework Overview
42
43	Every IR engagement follows the PICERL lifecycle:
44
45	\| Phase \| Key Actions \| Skill Outputs \|
46	\|-------\|------------\|---------------\|
47	\| Preparation \| Verify tools, comms, access \| Readiness checklist \|
48	\| Identification \| Confirm incident, scope, severity \| Incident classification \|
49	\| Containment \| Isolate systems, stop spread \| Containment actions list \|
50	\| Eradication \| Remove threat, close access \| Eradication checklist \|
51	\| Recovery \| Restore systems, verify integrity \| Recovery runbook \|
52	\| Lessons Learned \| Post-incident review \| IR report + improvements \|
53
54	---
55
56	## Core Capabilities
57
58	### 1. IR Playbook Creation
59
60	When the user asks to create a playbook for a specific incident type:
61
62	Claude generates detailed, role-assigned playbooks in this structure:
63
64	Ransomware Response Playbook (Example):
65
66	```markdown
67	# IR Playbook: Ransomware Attack
68	Version: 2.0 \| Owner: SOC Manager \| Review: Quarterly
69
70	## Trigger Conditions
71	- Multiple encrypted files discovered (ransom extension detected)
72	- Ransom note found on file shares or desktop
73	- EDR alert for mass file modification activity
74	- User reports files inaccessible with unfamiliar extensions
75
76	## Severity Classification
77	- CRITICAL: Domain controller / backup infrastructure affected
78	- HIGH: Production servers / business-critical data affected
79	- MEDIUM: Isolated workstation, contained environment
80
81	---
82
83	## Phase 1: Identification (Target: 15 minutes)
84	IR Lead:
85	- [ ] Confirm incident is ransomware (verify encrypted files + ransom note)
86	- [ ] Determine initial infection vector (phishing? RDP? Supply chain?)
87	- [ ] Identify Patient Zero — first encrypted system
88	- [ ] Assess scope: How many systems? Which business units?
89	- [ ] Declare incident severity and notify stakeholders
90	- [ ] Open incident ticket and begin documentation
91
92	Forensics:
93	- [ ] DO NOT REBOOT infected systems (preserve volatile evidence)
94	- [ ] Capture memory dump: `winpmem_mini_x64_rc2.exe output.raw`
95	- [ ] Collect running processes: `tasklist /v > processes.txt`
96	- [ ] Collect network connections: `netstat -ano > netstat.txt`
97
98	## Phase 2: Containment (Target: 30 minutes)
99	Network Team:
100	- [ ] Isolate affected systems (pull network cable or quarantine in VLAN)
101	- [ ] Block identified C2 IPs/domains at perimeter firewall
102	- [ ] Disable RDP externally if RDP was the initial vector
103	- [ ] Preserve network capture if encryption is still occurring
104
105	Active Directory:
106	- [ ] Identify all accounts used by the ransomware (service accounts, domain accounts)
107	- [ ] Reset passwords for all potentially compromised accounts
108	- [ ] Revoke active sessions for affected accounts
109	- [ ] Check for newly created privileged accounts
110
111	## Phase 3: Eradication
112	- [ ] Identify all persistence mechanisms (registry, services, scheduled tasks)
113	- [ ] Remove all malicious artifacts
114	- [ ] Verify no backdoors remain (check with Autoruns, process scanning)
115	- [ ] Patch the exploited vulnerability if one was used
116
117	## Phase 4: Recovery
118	- [ ] Restore from clean backup (verified pre-infection)
119	- [ ] Validate backup integrity before restoration
120	- [ ] Rebuild from gold image if backup compromised
121	- [ ] Verify data integrity after restoration
122	- [ ] Phased return to production
123
124	## Phase 5: Lessons Learned (Within 2 weeks

People who liked this also viewed

6 picks

Type