tsale/awesome-dfir-skills

admiralty-system

Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis. Use this skill whenever you need to evaluate a CTI report, breach claim, dark web forum post, threat…

لغة النص الأصلي: الإنجليزية

threat-actor-profiling

Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat actor, create a TA report, analyze an APT group, build an adversary profile, assess threat actor capability, map…

لغة النص الأصلي: الإنجليزية

osquery-query-helper

Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.

لغة النص الأصلي: الإنجليزية

malware-analysis

Professional malware analysis workflow for PE executables and suspicious files. Triggers on file uploads with requests like "analyze this malware", "analyze this sample", "what does this executable do", "check this file for malware", or any request to examine…

لغة النص الأصلي: الإنجليزية

analysing-attack

Analyse Mitre ATT&CK tactics, techniques and sub-techniques. Use when performing analysis of threat detections, threat models, security risks or cyber threat intelligence

لغة النص الأصلي: الإنجليزية

windows-intrusion-timeline-targeted

Create a targeted intrusion timeline for a Windows incident using whatever artifacts are available (event logs, EDR, SIEM exports, triage notes).

لغة النص الأصلي: الإنجليزية

suspicious-powershell-hunt-cross-platform-ideas

Hypothesis-driven hunt plan for suspicious PowerShell, plus query snippets for common telemetry.

لغة النص الأصلي: الإنجليزية

initial-incident-intake-scoping

First-hour intake checklist + questions that produce an actionable scope and evidence plan.

لغة النص الأصلي: الإنجليزية