Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
# Active network connections# Windows
netstat -anob > "$EVIDENCE_DIR/netstat_connections.txt" 2>&1
Get-NetTCPConnection | Export-Csv "$EVIDENCE_DIR/tcp_connections.csv" -NoTypeInformation
Get-NetUDPEndpoint | Export-Csv "$EVIDENCE_DIR/udp_endpoints.csv" -NoTypeInformation
# Linux
ss -tulnp > "$EVIDENCE_DIR/socket_stats.txt"
netstat -anp > "$EVIDENCE_DIR/netstat_all.txt" 2>/dev/null
cat /proc/net/tcp > "$EVIDENCE_DIR/proc_net_tcp.txt"cat /proc/net/udp > "$EVIDENCE_DIR/proc_net_udp.txt"# ARP cache
arp -a > "$EVIDENCE_DIR/arp_cache.txt"# Routing table
route print > "$EVIDENCE_DIR/routing_table.txt"# Windows
ip route show > "$EVIDENCE_DIR/routing_table.txt"# Linux# DNS cache
ipconfig /displaydns > "$EVIDENCE_DIR/dns_cache.txt"# Windows# Linux: varies by resolver, check systemd-resolve or nscd
systemd-resolve --statistics > "$EVIDENCE_DIR/dns_stats.txt" 2>/dev/null
# Active firewall rules
netsh advfirewall show allprofiles > "$EVIDENCE_DIR/firewall_rules.txt"# Windows
iptables -L -n -v > "$EVIDENCE_DIR/iptables_rules.txt"# Linux
Step 4: Capture Running Processes
# Windows - Detailed process list
tasklist /V /FO CSV > "$EVIDENCE_DIR/process_list_verbose.csv"
wmic process list full > "$EVIDENCE_DIR/wmic_process_full.txt"
Get-Process | Select-Object Id,ProcessName,Path,StartTime,CPU,WorkingSet |
Export-Csv "$EVIDENCE_DIR/ps_processes.csv" -NoTypeInformation
# Windows - Process with command line and parent
wmic process get ProcessId,Name,CommandLine,ParentProcessId,ExecutablePath /FORMAT:CSV > \
"$EVIDENCE_DIR/process_commandlines.csv"# Linux - Full process tree
ps auxwwf > "$EVIDENCE_DIR/process_tree.txt"
ps -eo pid,ppid,user,args --forest > "$EVIDENCE_DIR/process_forest.txt"cat /proc/*/cmdline 2>/dev/null | tr'\0'' ' > "$EVIDENCE_DIR/proc_cmdline_all.txt"# Process modules/DLLs loaded# Windows
listdlls.exe -accepteula > "$EVIDENCE_DIR/loaded_dlls.txt"# Linuxfor pid in $(ls /proc/ | grep -E '^[0-9]+$'); doecho"=== PID $pid ===" >> "$EVIDENCE_DIR/proc_maps.txt"cat"/proc/$pid/maps" 2>/dev/null >> "$EVIDENCE_DIR/proc_maps.txt"done# Open file handles
handle.exe -accepteula > "$EVIDENCE_DIR/open_handles.txt"# Windows (Sysinternals)
lsof > "$EVIDENCE_DIR/open_files.txt"# Linux
Step 5: Capture Logged-in Users and Sessions
# Windows
query user > "$EVIDENCE_DIR/logged_in_users.txt"
query session > "$EVIDENCE_DIR/active_sessions.txt"
net session > "$EVIDENCE_DIR/net_sessions.txt" 2>&1
net use > "$EVIDENCE_DIR/mapped_drives.txt" 2>&1
# Linuxwho > "$EVIDENCE_DIR/who_output.txt"
w > "$EVIDENCE_DIR/w_output.txt"
last -50 > "$EVIDENCE_DIR/last_logins.txt"
lastlog > "$EVIDENCE_DIR/lastlog.txt"cat /var/log/auth.log | tail -200 > "$EVIDENCE_DIR/recent_auth.txt" 2>/dev/null
