competition-forensic-timeline

Name: competition-forensic-timeline
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-forensic-timeline?

zhaoxuya520/reverse-skill/competition-forensic-timeline

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-forensic-timeline

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memor

Files · 1

View on GitHub

SKILL.md

1	# Competition Forensic Timeline
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the hard part is not finding one artifact, but turning many artifacts into one replayable chronology.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Pick the smallest reliable anchor: first execution, first logon, first network session, first file write, or first mailbox action.
12	2. Normalize timestamps, time zones, hostnames, users, process IDs, message IDs, and file paths before correlating.
13	3. Build one minimal chain from foothold to persistence, execution, access, or exfiltration.
14	4. Separate confirmed event order from inferred gaps.
15	5. Reproduce the decisive timeline segment that yields the artifact or privilege conclusion.
16
17	## Workflow
18
19	### 1. Establish Timeline Anchors
20
21	- Collect only the active surfaces: EVTX, Sysmon, registry, Amcache, prefetch, browser artifacts, mail traces, PCAPs, memory, or filesystem metadata.
22	- Record clock source, timezone, and any drift or truncation that could reorder events.
23	- Link shared identifiers across sources: PID, logon ID, GUID, message ID, hostname, username, IP, or hash.
24
25	### 2. Correlate The Execution Graph
26
27	- Track process tree, service or task creation, network sessions, file writes, registry changes, mailbox rules, or token use as one path.
28	- Distinguish causal edges from coincidence by matching identifiers and adjacency, not just nearby timestamps.
29	- Keep raw artifact and parsed summary side by side so every step can be traced back.
30
31	### 3. Compress To The Decisive Story
32
33	- Reduce the timeline to the smallest sequence that proves initial access, persistence, lateral movement, collection, or artifact recovery.
34	- Call out missing validation steps separately instead of mixing them into confirmed chronology.
35	- If the task becomes mainly about malware config extraction or a Windows pivot edge, switch to the tighter specialized skill.
36
37	## Read This Reference
38
39	- Load `references/forensic-timeline.md` for anchor selection, cross-source correlation, and evidence packaging.
40	- If the hard part is packet reassembly, protocol framing, or transferred-object extraction from a capture, prefer `$competition-pcap-protocol`.
41
42	## What To Preserve
43
44	- Source file paths, event IDs, logon IDs, message IDs, PIDs, hashes, and timestamps with timezone noted
45	- One compact timeline table or ordered list for the decisive segment
46	- Raw artifacts, parsed output, and inferred edges kept separate

People who liked this also viewed

6 picks

Type

competition-forensic-timeline

8.8kstars1.4kforks

View on GitHub

How to install competition-forensic-timeline?

zhaoxuya520/reverse-skill/competition-forensic-timeline

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-forensic-timeline

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition Forensic Timeline
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the hard part is not finding one artifact, but turning many artifacts into one replayable chronology.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Pick the smallest reliable anchor: first execution, first logon, first network session, first file write, or first mailbox action.
12	2. Normalize timestamps, time zones, hostnames, users, process IDs, message IDs, and file paths before correlating.
13	3. Build one minimal chain from foothold to persistence, execution, access, or exfiltration.
14	4. Separate confirmed event order from inferred gaps.
15	5. Reproduce the decisive timeline segment that yields the artifact or privilege conclusion.
16
17	## Workflow
18
19	### 1. Establish Timeline Anchors
20
21	- Collect only the active surfaces: EVTX, Sysmon, registry, Amcache, prefetch, browser artifacts, mail traces, PCAPs, memory, or filesystem metadata.
22	- Record clock source, timezone, and any drift or truncation that could reorder events.
23	- Link shared identifiers across sources: PID, logon ID, GUID, message ID, hostname, username, IP, or hash.
24
25	### 2. Correlate The Execution Graph
26
27	- Track process tree, service or task creation, network sessions, file writes, registry changes, mailbox rules, or token use as one path.
28	- Distinguish causal edges from coincidence by matching identifiers and adjacency, not just nearby timestamps.
29	- Keep raw artifact and parsed summary side by side so every step can be traced back.
30
31	### 3. Compress To The Decisive Story
32
33	- Reduce the timeline to the smallest sequence that proves initial access, persistence, lateral movement, collection, or artifact recovery.
34	- Call out missing validation steps separately instead of mixing them into confirmed chronology.
35	- If the task becomes mainly about malware config extraction or a Windows pivot edge, switch to the tighter specialized skill.
36
37	## Read This Reference
38
39	- Load `references/forensic-timeline.md` for anchor selection, cross-source correlation, and evidence packaging.
40	- If the hard part is packet reassembly, protocol framing, or transferred-object extraction from a capture, prefer `$competition-pcap-protocol`.
41
42	## What To Preserve
43
44	- Source file paths, event IDs, logon IDs, message IDs, PIDs, hashes, and timestamps with timezone noted
45	- One compact timeline table or ordered list for the decisive segment
46	- Raw artifacts, parsed output, and inferred edges kept separate

People who liked this also viewed

6 picks

Type