dfir

Name: dfir
Author: transilienceai

423stars74forks

How to install dfir?

transilienceai/communitytools/dfir

$npx -y skills add transilienceai/communitytools --skill dfir

Installs into the current project.

Summary

Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence fil

Files · 1

View on GitHub

SKILL.md

1	# DFIR
2
3	Investigate security incidents by analyzing event logs, network captures, and filesystem artifacts. Detect and reconstruct AD attack chains.
4
5	## Techniques
6
7	\| Domain \| Key Capabilities \|
8	\|--------\|-----------------\|
9	\| Windows Event Logs \| EVTX parsing, Event ID correlation, logon tracking, privilege enumeration \|
10	\| Network Forensics \| PCAP analysis, NTLM extraction, LLMNR/NBT-NS poisoning detection, relay identification \|
11	\| Filesystem Forensics \| MFT parsing, Prefetch analysis, VSS artifact recovery, Linux persistence, timeline reconstruction \|
12	\| AD Attack Detection \| Kerberoasting, AS-REP roasting, NTDS dump, NTLM relay, credential theft \|
13	\| Memory Forensics \| Volatility3 analysis: process trees, file extraction, SID resolution, command lines \|
14	\| Hash Analysis \| NTLMv2 hash construction from pcap, offline cracking validation \|
15
16	## Workflow
17
18	1. Inventory evidence — List all artifacts (EVTX, pcap, MFT, prefetch, registry)
19	2. Parse structured data — EVTX with `python-evtx`, pcap with `tshark`, MFT with `analyzeMFT`
20	3. Identify attack indicators — Key Event IDs, suspicious traffic patterns, anomalous files
21	4. Correlate across sources — Match timestamps, IPs, LogonIDs, and process IDs across artifacts
22	5. Reconstruct timeline — Build chronological attack chain with UTC timestamps
23	6. Answer investigative questions — Map findings to specific incident response queries
24
25	## Tools
26
27	```bash
28	pip install python-evtx windowsprefetch analyzeMFT
29	brew install wireshark p7zip hashcat
30	```
31
32	\| Tool \| Purpose \|
33	\|------\|---------\|
34	\| `python-evtx` \| Parse Windows .evtx files \|
35	\| `tshark` \| CLI pcap analysis (NTLM, LLMNR, SMB filters) \|
36	\| `analyzeMFT` \| Parse NTFS Master File Table \|
37	\| `windowsprefetch` \| Parse Windows prefetch files (Windows host only) \|
38	\| `hashcat` \| Hash cracking (NTLMv2 mode 5600, Kerberos mode 13100/18200) \|
39	\| `volatility3` \| Memory dump analysis (pstree, filescan, dumpfiles, getsid, cmdline) \|
40	\| `7z` \| Extract AES-encrypted evidence ZIPs \|
41
42	## Quick Reference: Key Event IDs
43
44	\| Event ID \| Log \| Indicates \|
45	\|----------\|-----\|-----------\|
46	\| 4624 \| Security \| Successful logon (check Type + IP mismatch) \|
47	\| 4768 \| Security \| TGT request (PreAuthType=0 → AS-REP roast) \|
48	\| 4769 \| Security \| TGS request (EncType=0x17 → Kerberoast) \|
49	\| 4799 \| Security \| Group membership enumerated (VSS/ntdsutil) \|
50	\| 5140 \| Security \| Network share accessed \|
51	\| 7036 \| System \| Service state change (VSS start → NTDS dump) \|
52	\| 325/326/327 \| Application \| ESENT database create/detach/close \|
53	\| 330 \| Application \| ESENT database file info \|
54	\| 3006/3008 \| DNS Client Events \| DNS query sent/response received (malicious domain lookups) \|
55	\| 106/200 \| Task Scheduler \| Scheduled task created/executed (persistence via schtasks) \|
56
57	## Reference
58
59	- [windows-event-analysis.md](reference/windows-event-analysis.md) — EVTX parsing patterns and AD attack detection
60	- [network-forensics.md](reference/network-forensics.md) — PCAP analysis for NTLM, LLMNR, relay detection
61	- [filesystem-forensics.md](reference/filesystem-forensics.md) — MFT, Prefetch, VSS artifact analysis
62
63	## Critical Rules
64
65	- Answer formatting: When forensics questions ask for "the value" of a code variable (e.g., PHP `$shell`), include language-specific string delimiters and terminators (e.g., `'value';` not just `value`). Check placeholder hints for format clues.
66	- For malicious Office OOXML, inspect more than VBA streams: attackers may split staged Base64 or script content across drawing/object descriptors, shared strings, named cells, and hidden UserForm control captions/values.
67	- When a VBA byte array starts with an `fnstenv`/`pop` decoder stub, convert signed integers to raw bytes and test a Shikata-style rolling XOR decode before treating the shellcode as corrupt.
68	- For legacy Excel BIFF/XLS malware, inspect `BOUNDSHEET` records for `hidden` or `very hidden` worksheets and specifically check for Excel 4.0 macro sheets; changing the hidden-state byte or parsing the sheet directly can expose staged strings and flag fragments that never appear in normal workbook views.
69	- For webshell traffic in PCAPs, recover static keys from the uploaded server-side code first, then decrypt operator tasking before chasing later payloads; if a dropped XOR key file is referenced by a shellcode stage, verify where the encoded region actually starts instead of XORing the whole blob from offset zero.
70	- PowerShell stager pattern (in-place reverse + base64 + IEX): when a stage-1 PS script does `[array]::Reverse($charArr)` followed by `FromBase64String("$charArr")`, the `-join` line is often a red herring — string interpolation of a cha

People who liked this also viewed

6 picks

Type

dfir

423stars74forks

View on GitHub

How to install dfir?

transilienceai/communitytools/dfir

$npx -y skills add transilienceai/communitytools --skill dfir

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# DFIR
2
3	Investigate security incidents by analyzing event logs, network captures, and filesystem artifacts. Detect and reconstruct AD attack chains.
4
5	## Techniques
6
7	\| Domain \| Key Capabilities \|
8	\|--------\|-----------------\|
9	\| Windows Event Logs \| EVTX parsing, Event ID correlation, logon tracking, privilege enumeration \|
10	\| Network Forensics \| PCAP analysis, NTLM extraction, LLMNR/NBT-NS poisoning detection, relay identification \|
11	\| Filesystem Forensics \| MFT parsing, Prefetch analysis, VSS artifact recovery, Linux persistence, timeline reconstruction \|
12	\| AD Attack Detection \| Kerberoasting, AS-REP roasting, NTDS dump, NTLM relay, credential theft \|
13	\| Memory Forensics \| Volatility3 analysis: process trees, file extraction, SID resolution, command lines \|
14	\| Hash Analysis \| NTLMv2 hash construction from pcap, offline cracking validation \|
15
16	## Workflow
17
18	1. Inventory evidence — List all artifacts (EVTX, pcap, MFT, prefetch, registry)
19	2. Parse structured data — EVTX with `python-evtx`, pcap with `tshark`, MFT with `analyzeMFT`
20	3. Identify attack indicators — Key Event IDs, suspicious traffic patterns, anomalous files
21	4. Correlate across sources — Match timestamps, IPs, LogonIDs, and process IDs across artifacts
22	5. Reconstruct timeline — Build chronological attack chain with UTC timestamps
23	6. Answer investigative questions — Map findings to specific incident response queries
24
25	## Tools
26
27	```bash
28	pip install python-evtx windowsprefetch analyzeMFT
29	brew install wireshark p7zip hashcat
30	```
31
32	\| Tool \| Purpose \|
33	\|------\|---------\|
34	\| `python-evtx` \| Parse Windows .evtx files \|
35	\| `tshark` \| CLI pcap analysis (NTLM, LLMNR, SMB filters) \|
36	\| `analyzeMFT` \| Parse NTFS Master File Table \|
37	\| `windowsprefetch` \| Parse Windows prefetch files (Windows host only) \|
38	\| `hashcat` \| Hash cracking (NTLMv2 mode 5600, Kerberos mode 13100/18200) \|
39	\| `volatility3` \| Memory dump analysis (pstree, filescan, dumpfiles, getsid, cmdline) \|
40	\| `7z` \| Extract AES-encrypted evidence ZIPs \|
41
42	## Quick Reference: Key Event IDs
43
44	\| Event ID \| Log \| Indicates \|
45	\|----------\|-----\|-----------\|
46	\| 4624 \| Security \| Successful logon (check Type + IP mismatch) \|
47	\| 4768 \| Security \| TGT request (PreAuthType=0 → AS-REP roast) \|
48	\| 4769 \| Security \| TGS request (EncType=0x17 → Kerberoast) \|
49	\| 4799 \| Security \| Group membership enumerated (VSS/ntdsutil) \|
50	\| 5140 \| Security \| Network share accessed \|
51	\| 7036 \| System \| Service state change (VSS start → NTDS dump) \|
52	\| 325/326/327 \| Application \| ESENT database create/detach/close \|
53	\| 330 \| Application \| ESENT database file info \|
54	\| 3006/3008 \| DNS Client Events \| DNS query sent/response received (malicious domain lookups) \|
55	\| 106/200 \| Task Scheduler \| Scheduled task created/executed (persistence via schtasks) \|
56
57	## Reference
58
59	- [windows-event-analysis.md](reference/windows-event-analysis.md) — EVTX parsing patterns and AD attack detection
60	- [network-forensics.md](reference/network-forensics.md) — PCAP analysis for NTLM, LLMNR, relay detection
61	- [filesystem-forensics.md](reference/filesystem-forensics.md) — MFT, Prefetch, VSS artifact analysis
62
63	## Critical Rules
64
65	- Answer formatting: When forensics questions ask for "the value" of a code variable (e.g., PHP `$shell`), include language-specific string delimiters and terminators (e.g., `'value';` not just `value`). Check placeholder hints for format clues.
66	- For malicious Office OOXML, inspect more than VBA streams: attackers may split staged Base64 or script content across drawing/object descriptors, shared strings, named cells, and hidden UserForm control captions/values.
67	- When a VBA byte array starts with an `fnstenv`/`pop` decoder stub, convert signed integers to raw bytes and test a Shikata-style rolling XOR decode before treating the shellcode as corrupt.
68	- For legacy Excel BIFF/XLS malware, inspect `BOUNDSHEET` records for `hidden` or `very hidden` worksheets and specifically check for Excel 4.0 macro sheets; changing the hidden-state byte or parsing the sheet directly can expose staged strings and flag fragments that never appear in normal workbook views.
69	- For webshell traffic in PCAPs, recover static keys from the uploaded server-side code first, then decrypt operator tasking before chasing later payloads; if a dropped XOR key file is referenced by a shellcode stage, verify where the encoded region actually starts instead of XORing the whole blob from offset zero.
70	- PowerShell stager pattern (in-place reverse + base64 + IEX): when a stage-1 PS script does `[array]::Reverse($charArr)` followed by `FromBase64String("$charArr")`, the `-join` line is often a red herring — string interpolation of a cha

People who liked this also viewed

6 picks

Type