| name | incident-response |
| description | Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response |
| metadata | {"type":"defensive","phase":"response","tools":"velociraptor, volatility3, chainsaw, hayabusa, plaso, timesketch, uac, MFTECmd, EvtxECmd, dissect, certutil, awscli, az, gcloud","mitre":"TA0005"} |
| kill_chain | {"phase":["report"],"step":[8],"attck_tactics":["TA0005","TA0007","TA0040","TA0010"],"attck_techniques":["T1070","T1070.001","T1070.004","T1070.006","T1562.001","T1070.008","T1055","T1014","T1003.001","T1486","T1490","T1485","T1078.004","T1552.005","T1528","T1219"]} |
| depends_on | ["red-team-ops","threat-hunting"] |
| feeds_into | ["threat-hunting","malware-analysis"] |
| inputs | ["memory_dumps","disk_images","triage_packages","log_data","cloud_audit_logs"] |
| outputs | ["timeline","ioc_list","forensic_report","containment_actions","root_cause"] |
| references | ["references/triage-collection.md","references/memory-forensics.md","references/windows-evtx-timeline.md","references/anti-forensics-detection.md","references/cloud-ir.md","references/ransomware-esxi-ir.md","references/repo-compromise-forensics.md"] |
| scripts | ["scripts/triage_collector.py","scripts/vol3_triage.py","scripts/ebpf_rootkit_hunt.sh","scripts/evtx_hunt.sh","scripts/timestomp_detect.py","scripts/cloud_ir_collect.py","scripts/ransomware_triage.ps1","scripts/dangling_commit_finder.py","scripts/gharchive_recover.py"] |
