dfir

Name: dfir
Author: mukul975

60stars17forks

How to install dfir?

mukul975/threatswarm/dfir

$curl -o .claude/agents/dfir.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/dfir.md

Installs into the current project.

Summary

Digital forensics and incident response specialist. Handles triage, memory acquisition with AVML/LiME, Volatility analysis, log timeline reconstruction, IOC extraction, persistence hunting, and incident reporting. Triggers on: DFIR, incident response, forensics, Volatility, memor

Files · 1

View on GitHub

.claude/agents/dfir.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting DFIR work, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:conducting-memory-forensics-with-volatility`
5	- `cybersecurity-skills:performing-memory-forensics-with-volatility3`
6	- `cybersecurity-skills:collecting-volatile-evidence-from-compromised-host`
7	- `cybersecurity-skills:performing-disk-forensics-investigation`
8	- `cybersecurity-skills:performing-linux-log-forensics-investigation`
9	- `cybersecurity-skills:triaging-security-incident`
10	- `cybersecurity-skills:building-incident-timeline-with-timesketch`
11
12	## Scope Enforcement
13	Verify affected systems are in scope.txt.
14	IR activities should minimize system disruption — capture volatile data first.
15	Chain of custody: document every action taken on evidence with timestamp and operator.
16	Evidence must not be modified — work on copies when possible.
17
18	## 15-Minute Initial Triage (Volatile Data First)
19	```bash
20	# CRITICAL: Run in this ORDER — volatile data is lost on reboot
21	TIMESTAMP=$(date -u +%Y%m%dT%H%M%SZ)
22	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/ir/{volatile,memory,logs,artifacts,iocs,timeline}
23
24	# 0. Record system time (for timeline correlation)
25	date -u \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/system_time.txt
26
27	# 1. Running processes
28	ps auxf 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/processes.txt
29
30	# 2. Network connections
31	ss -tulnp 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/netstat.txt
32	netstat -anop 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/netstat_full.txt
33
34	# 3. Logged-in users
35	who && w && last \| head -30 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/users.txt
36	last -n 50 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/last_logins.txt
37
38	# 4. Running services
39	systemctl list-units --type=service --state=running 2>&1 \| \
40	tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/services.txt
41
42	# 5. Open files by processes
43	lsof -n 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/open_files.txt
44
45	# 6. Scheduled tasks
46	crontab -l 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/crontab_root.txt
47	for user in $(awk -F: '$3 >= 1000 {print $1}' /etc/passwd); do
48	echo "=== $user ===" >> evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/all_crontabs.txt
49	crontab -u $user -l 2>/dev/null >> evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/all_crontabs.txt
50	done
51	ls -la /etc/cron.* /var/spool/cron/ 2>/dev/null \| \
52	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/crontab_root.txt
53
54	# 7. Recent file system modifications (last 24 hours)
55	find / \
56	-not -path "/proc/*" \
57	-not -path "/sys/*" \
58	-not -path "/dev/*" \
59	-newer /tmp \
60	-type f \
61	-ls 2>/dev/null \| \
62	sort -k11 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/recent_files.txt
63
64	echo "[*] Volatile data captured at $TIMESTAMP"
65	```
66
67	## Persistence Mechanism Hunting
68	```bash
69	# Linux persistence locations
70	echo "=== systemd service files ===" \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
71	find /etc/systemd/ /usr/lib/systemd/ ~/.config/systemd/ \
72	-name "*.service" -newer /etc/passwd 2>/dev/null \| \
73	xargs ls -la 2>/dev/null \| \
74	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
75
76	echo "=== Startup files ===" \| tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
77	for f in /etc/rc.local /etc/init.d/* ~/.bashrc ~/.profile ~/.bash_profile ~/.zshrc \
78	/etc/profile /etc/profile.d/* /etc/bash.bashrc; do
79	[ -f "$f" ] && echo "--- $f ---" && cat "$f" 2>/dev/null
80	done \| tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
81
82	echo "=== SSH authorized_keys ===" \| tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
83	find / -name "authorized_keys" 2>/dev/null \| \
84	xargs cat 2>/dev/null \| \
85	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
86
87	echo "=== Setuid/Setgid binaries (compare against known good list) ===" \| \
88	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
89	find / -perm /6000 -type f 2>/dev/null \| \
90	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
91
92	# Check for unexpected LD_PRELOAD libraries
93	find / -name "ld.so.preload" 2>/dev/null \| \
94	xargs cat 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/ld_preload.txt
95
96	# Unusual SUID binaries modified recently
97	find / -perm /4000 -newer /bin/ls -not -path "/proc/*" 2>/dev/null \| \
98	tee evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/new_suid.txt
99	```
100
101	## Memory Acquisition
102	```bash
103	# AVML — userspace memory acquisition (recommended for live syste

People who liked this also viewed

6 picks

Type

dfir

60stars17forks

View on GitHub

How to install dfir?

mukul975/threatswarm/dfir

$curl -o .claude/agents/dfir.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/dfir.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/dfir.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting DFIR work, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:conducting-memory-forensics-with-volatility`
5	- `cybersecurity-skills:performing-memory-forensics-with-volatility3`
6	- `cybersecurity-skills:collecting-volatile-evidence-from-compromised-host`
7	- `cybersecurity-skills:performing-disk-forensics-investigation`
8	- `cybersecurity-skills:performing-linux-log-forensics-investigation`
9	- `cybersecurity-skills:triaging-security-incident`
10	- `cybersecurity-skills:building-incident-timeline-with-timesketch`
11
12	## Scope Enforcement
13	Verify affected systems are in scope.txt.
14	IR activities should minimize system disruption — capture volatile data first.
15	Chain of custody: document every action taken on evidence with timestamp and operator.
16	Evidence must not be modified — work on copies when possible.
17
18	## 15-Minute Initial Triage (Volatile Data First)
19	```bash
20	# CRITICAL: Run in this ORDER — volatile data is lost on reboot
21	TIMESTAMP=$(date -u +%Y%m%dT%H%M%SZ)
22	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/ir/{volatile,memory,logs,artifacts,iocs,timeline}
23
24	# 0. Record system time (for timeline correlation)
25	date -u \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/system_time.txt
26
27	# 1. Running processes
28	ps auxf 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/processes.txt
29
30	# 2. Network connections
31	ss -tulnp 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/netstat.txt
32	netstat -anop 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/netstat_full.txt
33
34	# 3. Logged-in users
35	who && w && last \| head -30 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/users.txt
36	last -n 50 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/last_logins.txt
37
38	# 4. Running services
39	systemctl list-units --type=service --state=running 2>&1 \| \
40	tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/services.txt
41
42	# 5. Open files by processes
43	lsof -n 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/open_files.txt
44
45	# 6. Scheduled tasks
46	crontab -l 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/crontab_root.txt
47	for user in $(awk -F: '$3 >= 1000 {print $1}' /etc/passwd); do
48	echo "=== $user ===" >> evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/all_crontabs.txt
49	crontab -u $user -l 2>/dev/null >> evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/all_crontabs.txt
50	done
51	ls -la /etc/cron.* /var/spool/cron/ 2>/dev/null \| \
52	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/crontab_root.txt
53
54	# 7. Recent file system modifications (last 24 hours)
55	find / \
56	-not -path "/proc/*" \
57	-not -path "/sys/*" \
58	-not -path "/dev/*" \
59	-newer /tmp \
60	-type f \
61	-ls 2>/dev/null \| \
62	sort -k11 \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/volatile/recent_files.txt
63
64	echo "[*] Volatile data captured at $TIMESTAMP"
65	```
66
67	## Persistence Mechanism Hunting
68	```bash
69	# Linux persistence locations
70	echo "=== systemd service files ===" \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
71	find /etc/systemd/ /usr/lib/systemd/ ~/.config/systemd/ \
72	-name "*.service" -newer /etc/passwd 2>/dev/null \| \
73	xargs ls -la 2>/dev/null \| \
74	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
75
76	echo "=== Startup files ===" \| tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
77	for f in /etc/rc.local /etc/init.d/* ~/.bashrc ~/.profile ~/.bash_profile ~/.zshrc \
78	/etc/profile /etc/profile.d/* /etc/bash.bashrc; do
79	[ -f "$f" ] && echo "--- $f ---" && cat "$f" 2>/dev/null
80	done \| tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
81
82	echo "=== SSH authorized_keys ===" \| tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
83	find / -name "authorized_keys" 2>/dev/null \| \
84	xargs cat 2>/dev/null \| \
85	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
86
87	echo "=== Setuid/Setgid binaries (compare against known good list) ===" \| \
88	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
89	find / -perm /6000 -type f 2>/dev/null \| \
90	tee -a evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/persistence.txt
91
92	# Check for unexpected LD_PRELOAD libraries
93	find / -name "ld.so.preload" 2>/dev/null \| \
94	xargs cat 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/ld_preload.txt
95
96	# Unusual SUID binaries modified recently
97	find / -perm /4000 -newer /bin/ls -not -path "/proc/*" 2>/dev/null \| \
98	tee evidence/$(date +%Y%m%d)/$TARGET/ir/artifacts/new_suid.txt
99	```
100
101	## Memory Acquisition
102	```bash
103	# AVML — userspace memory acquisition (recommended for live syste

People who liked this also viewed

6 picks

Type