Menü
Run THOR scans and propose the exact command line for Windows, Linux, or macOS. Use when the user wants to scan a host, a directory, a mounted image, or a memory dump with THOR v10/v11.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
| name | thor-scan |
| description | Run THOR scans and propose the exact command line for Windows, Linux, or macOS. Use when the user wants to scan a host, a directory, a mounted image, or a memory dump with THOR v10/v11. |
Goal: produce a safe, reproducible THOR command line and minimal preflight checks.
Rules
Preflight checklist
ls or dir). This immediately tells you:
thor64.exe (Windows), thor-linux-64 (Linux), thor-macosx (macOS)thor64-lite.exe (Windows), thor-lite-linux-64 (Linux), thor-lite-macos (macOS)--lab mode, check license type first:
grep -i forensiclab *.lic - if found, --lab is available-a Filescan --intense --norescontrol --cross-platformImportant flag rules
--lab --intense together - --lab already includes intense mode--lab - requires Forensic Lab license--lab - always use the alternative flag combinationUse these references when needed
Example templates
Output format
Entry point and router for THOR-related work: running scans, analyzing THOR logs, troubleshooting THOR behavior, maintaining THOR installs, THOR Lens workflows, writing THOR plugins (v11+), and creating custom signatures/IOCs.
Create and deploy custom IOCs, YARA rules, Sigma rules, and STIX indicators for THOR scans.
Write, package, and use THOR plugins to extend scanner functionality. THOR v11+ only.
Troubleshoot THOR runs that are stuck, slow, failing to start, stopping early, or produce missing output. Use when the user reports freezes, long runtimes, high CPU pauses, scan aborts, or licensing/update issues.
THOR Lens workflows for forensic timeline analysis. A web UI that imports THOR v11 audit trail JSONL logs for interactive exploration. Requires THOR v11 (audit trail not available in v10).
Interpret THOR scan results and explain what findings mean. Use when the user pastes THOR log lines, shares a log file, or asks how to triage Notices/Warnings/Alerts.