Run any Skill in Manus with one click

ransomware-investigation

Stars2

Forks1

UpdatedMarch 15, 2026 at 08:19

Investigate a ransomware incident — triage, artifact analysis, attack chain reconstruction, malware analysis, network forensics, and reporting.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

valITino

valITino/dfireballz

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	ransomware-investigation
description	Investigate a ransomware incident — triage, artifact analysis, attack chain reconstruction, malware analysis, network forensics, and reporting.

Investigate the ransomware incident affecting the specified target.

Usage: /ransomware-investigation <target>

Where <target> is the evidence path or affected system — e.g. /evidence/encrypted-host/, /evidence/ransom-note.txt.

If no target is provided, ask the user for the evidence location.

Instructions

Load the investigation template: call get_template(name="ransomware-investigation", target="$ARGUMENTS")
Follow all 6 phases: Initial Triage, Artifact Analysis, Attack Chain Reconstruction, Malware Analysis, Network Forensics, Reporting
Use these MCP servers: kali-forensics, winforensics, binary-analysis, network-forensics, threat-intel, filesystem
Identify the ransomware family and C2 infrastructure
Log chain of custody for every evidence access
Generate report with MITRE ATT&CK mapping and remediation steps

More from this repository

same repository

complete-investigation

valITino/dfireballz

Run a full 11-phase forensic investigation across all MCP servers — disk, memory, Windows artifacts, malware, network, OSINT, threat intel, timeline, and reporting.

2026-03-152

full-investigation

valITino/dfireballz

Run a 6-phase forensic investigation — evidence intake, artifact collection, network analysis, threat intel, timeline reconstruction, and reporting.

2026-03-152

incident-response

valITino/dfireballz

Run a 7-phase incident response — triage, containment assessment, evidence collection, attack chain reconstruction, threat intel, impact assessment, and reporting.

2026-03-152

malware-analysis

valITino/dfireballz

Analyze a malware sample — static analysis with Ghidra/Radare2/Capa, YARA scanning, string extraction, and VirusTotal/MalwareBazaar lookup.

2026-03-152

memory-forensics

valITino/dfireballz

Analyze a memory dump — process analysis, network connections, persistence mechanisms, malware detection with Volatility3, and reporting.

2026-03-152

network-forensics

valITino/dfireballz

Analyze network traffic — PCAP triage, protocol analysis, anomaly detection, IoC extraction, stream reconstruction, and reporting.

2026-03-152

name	ransomware-investigation
description	Investigate a ransomware incident — triage, artifact analysis, attack chain reconstruction, malware analysis, network forensics, and reporting.

Investigate the ransomware incident affecting the specified target.

Usage: /ransomware-investigation <target>

Where <target> is the evidence path or affected system — e.g. /evidence/encrypted-host/, /evidence/ransom-note.txt.

If no target is provided, ask the user for the evidence location.

Instructions

Load the investigation template: call get_template(name="ransomware-investigation", target="$ARGUMENTS")
Follow all 6 phases: Initial Triage, Artifact Analysis, Attack Chain Reconstruction, Malware Analysis, Network Forensics, Reporting
Use these MCP servers: kali-forensics, winforensics, binary-analysis, network-forensics, threat-intel, filesystem
Identify the ransomware family and C2 infrastructure
Log chain of custody for every evidence access
Generate report with MITRE ATT&CK mapping and remediation steps