Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
# Active network connections# Windows
netstat -anob > "$EVIDENCE_DIR/netstat_connections.txt" 2>&1
Get-NetTCPConnection | Export-Csv "$EVIDENCE_DIR/tcp_connections.csv" -NoTypeInformation
Get-NetUDPEndpoint | Export-Csv "$EVIDENCE_DIR/udp_endpoints.csv" -NoTypeInformation
# Linux
ss -tulnp > "$EVIDENCE_DIR/socket_stats.txt"
netstat -anp > "$EVIDENCE_DIR/netstat_all.txt" 2>/dev/null
cat /proc/net/tcp > "$EVIDENCE_DIR/proc_net_tcp.txt"cat /proc/net/udp > "$EVIDENCE_DIR/proc_net_udp.txt"# ARP cache
arp -a > "$EVIDENCE_DIR/arp_cache.txt"# Routing table
route print > "$EVIDENCE_DIR/routing_table.txt"# Windows
ip route show > "$EVIDENCE_DIR/routing_table.txt"# Linux# DNS cache
ipconfig /displaydns > "$EVIDENCE_DIR/dns_cache.txt"# Windows# Linux: varies by resolver, check systemd-resolve or nscd
systemd-resolve --statistics > "$EVIDENCE_DIR/dns_stats.txt" 2>/dev/null
# Active firewall rules
netsh advfirewall show allprofiles > "$EVIDENCE_DIR/firewall_rules.txt"# Windows
iptables -L -n -v > "$EVIDENCE_DIR/iptables_rules.txt"# Linux
Step 4: Capture Running Processes
# Windows - Detailed process list
tasklist /V /FO CSV > "$EVIDENCE_DIR/process_list_verbose.csv"
wmic process list full > "$EVIDENCE_DIR/wmic_process_full.txt"
Get-Process | Select-Object Id,ProcessName,Path,StartTime,CPU,WorkingSet |
Export-Csv "$EVIDENCE_DIR/ps_processes.csv" -NoTypeInformation
# Windows - Process with command line and parent
wmic process get ProcessId,Name,CommandLine,ParentProcessId,ExecutablePath /FORMAT:CSV > \
"$EVIDENCE_DIR/process_commandlines.csv"# Linux - Full process tree
ps auxwwf > "$EVIDENCE_DIR/process_tree.txt"
ps -eo pid,ppid,user,args --forest > "$EVIDENCE_DIR/process_forest.txt"cat /proc/*/cmdline 2>/dev/null | tr'\0'' ' > "$EVIDENCE_DIR/proc_cmdline_all.txt"# Process modules/DLLs loaded# Windows
listdlls.exe -accepteula > "$EVIDENCE_DIR/loaded_dlls.txt"# Linuxfor pid in $(ls /proc/ | grep -E '^[0-9]+$'); doecho"=== PID $pid ===" >> "$EVIDENCE_DIR/proc_maps.txt"cat"/proc/$pid/maps" 2>/dev/null >> "$EVIDENCE_DIR/proc_maps.txt"done# Open file handles
handle.exe -accepteula > "$EVIDENCE_DIR/open_handles.txt"# Windows (Sysinternals)
lsof > "$EVIDENCE_DIR/open_files.txt"# Linux
Step 5: Capture Logged-in Users and Sessions
# Windows
query user > "$EVIDENCE_DIR/logged_in_users.txt"
query session > "$EVIDENCE_DIR/active_sessions.txt"
net session > "$EVIDENCE_DIR/net_sessions.txt" 2>&1
net use > "$EVIDENCE_DIR/mapped_drives.txt" 2>&1
# Linuxwho > "$EVIDENCE_DIR/who_output.txt"
w > "$EVIDENCE_DIR/w_output.txt"
last -50 > "$EVIDENCE_DIR/last_logins.txt"
lastlog > "$EVIDENCE_DIR/lastlog.txt"cat /var/log/auth.log | tail -200 > "$EVIDENCE_DIR/recent_auth.txt" 2>/dev/null
